# US 12,602,543 B2 · Large language model engine analysis and tracking of dark web data and threat actors

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,602,543 B2
- Document ID: US12602543B2
- Status: Granted
- Kind: B2
- Application number: 18/791,394
- Filed: 2024-07-31
- Published: 2026-02-05
- Granted: 2026-04-14
- Earliest claimed: 2024-07-31
- Assignees: Intuit Inc.
- Applicants: Intuit Inc.
- Inventors: Abhishek Tatti; Scott Cruickshanks Kennedy; Daniel Poremba; Marshall J. Vanderhoof; Luiza Nacshon; Caroline Shouraboura
- Web page: https://patentgrep.com/patent/US12602543B2

## CPC

- G06F 40/205: Parsing
- G06F 40/284: Lexical analysis, e.g. tokenisation or collocates
- G06F 40/30: Semantic analysis
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method includes obtaining multiple raw dark web posts. The multiple raw dark web posts are preprocessed to obtain a tokenized dark web post set. A prompt is constructed for a threat analyzer large language model (LLM). The prompt includes at least a first tokenized dark web post a set of threat personas, each threat persona including a category and a definition, and an instruction to categorize the first tokenized dark web post with a threat persona and generate a first explanation corresponding to the categorization of the first tokenized dark web post. The prompt is processed by the threat analyzer LLM, to obtain a first annotated post and a corresponding first threat persona category. The first annotated post includes a post summary corresponding to the first tokenized dark web post, and the first explanation. The first explanation is based on a first threat persona definition.

## Claims

### Claim 1

A method comprising:
obtaining a plurality of raw dark web posts, each raw dark web post of the plurality of raw dark web posts including a natural language utterance;
preprocessing the plurality of raw dark web posts to obtain a tokenized dark web post set;
constructing a prompt for a threat analyzer large language model (LLM), including
at least a first tokenized dark web post of the tokenized dark web post set,
a set of threat personas, each threat persona of the set of threat personas comprising a category and a definition, and
an instruction to categorize the first tokenized dark web post with a threat persona of the set of threat personas and generate a first explanation corresponding to the categorization of the first tokenized dark web post;
processing the prompt with the threat analyzer LLM, to obtain a first annotated post and a corresponding first threat persona category, wherein
the first annotated post includes a post summary corresponding to the first tokenized dark web post, and
the first explanation, wherein the first explanation is based on a first threat persona definition; and
adding the first annotated post and the corresponding first threat persona category to a post-persona catalog in a data repository.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
selecting, by a threat activity tracker, from the post-persona catalog, a set of annotated posts corresponding to a second threat persona category to obtain a post-persona subset; and
presenting, by the threat activity tracker, via a web interface, a dashboard displaying at least one visualization of the post-persona subset to a user.

### Claim 3 (depends on 1)

The method of claim 1, wherein preprocessing of the plurality of raw dark web posts further comprises:
performing a set of preprocessing operations on each raw dark web post of the plurality of raw dark web posts to obtain a corresponding plurality of preprocessed dark web posts, wherein the set of preprocessing operations includes translation, stop word removal, and noise removal;
storing the plurality of preprocessed dark web posts in the data repository;
classifying a subset of the plurality of preprocessed dark web posts, wherein each preprocessed dark web post of the subset of preprocessed dark web posts is classified into one of a relevant class and a non-relevant class, to obtain a post classifier training dataset; and
storing the post classifier training dataset in the data repository.

### Claim 4 (depends on 1)

The method of claim 1, wherein preprocessing of the plurality of raw dark web posts further comprises:
training a post classifier ML model with a post classifier training dataset obtained from the data repository, to obtain a trained post classifier ML model, wherein the post classifier ML model is a Gaussian Naïve Bayes (GNB) model, and wherein the post classifier training dataset includes a plurality of preprocessed dark web posts classified with a plurality of class labels, the training comprising:
calculating a prior probability for each class label of the plurality of class labels, wherein the prior probability of each class label is the probability of an occurrence of each class label in the post classifier training dataset, to obtain a plurality of prior probabilities corresponding respectively to the plurality of class labels; and
calculating a mean and a standard deviation corresponding to each feature of a plurality of features corresponding to the post classifier training dataset, to obtain a plurality of Gaussian distributions of the plurality of features, corresponding to each class label of the plurality of class labels.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
obtaining a first instance of the post classifier training dataset having a plurality of feature values corresponding to the plurality of features of the post classifier training dataset;
calculating a probability of each feature value of the plurality of feature values of the first instance corresponding to each class label of the plurality of class labels, based on a Gaussian probability density function, to obtain a plurality of feature value probabilities corresponding to each class label of the plurality of class labels, for the first instance;
applying a Bayes theorem function to the plurality of feature value probabilities corresponding to each class label of the plurality of class labels, for the first instance, to obtain a plurality of posterior probabilities corresponding respectively to the plurality of class labels;
calculating a combined probability value as a product of a posterior probability value corresponding to each class label of the plurality of class labels and a prior probability value corresponding to each class label of the plurality of class labels, to obtain a plurality of combined probability values corresponding respectively to the plurality of class labels, for the first instance; and
selecting a class label from the plurality of class labels with a highest posterior probability value for the first instance as a predicted class for the first instance.

### Claim 6 (depends on 1)

The method of claim 1, wherein preprocessing of the plurality of raw dark web posts further comprises:
classifying each preprocessed dark web post of a plurality of preprocessed dark web posts obtained from the data repository, by a trained post classifier ML model into one of a relevant class and a non-relevant class, to obtain a corresponding plurality of classified dark web posts; and
storing the plurality of classified dark web posts in the data repository.

### Claim 7 (depends on 1)

The method of claim 1, wherein preprocessing of the plurality of raw dark web posts further comprises:
selecting a plurality of classified dark web posts from the data repository, wherein each classified dark web post of the plurality of classified dark web posts is classified into a relevant class; and
creating an attack utterances dictionary comprising a plurality of utterances, each utterance of the plurality of utterances having at least one frequently occurring phrase identified from the selected plurality of classified dark web posts, wherein the occurrence of the frequently occurring phrase is higher than a phrase frequency threshold.

### Claim 8 (depends on 1)

The method of claim 1, wherein preprocessing of the plurality of raw dark web posts further comprises:
selecting a plurality of classified dark web posts from the data repository, wherein each classified dark web post of the plurality of classified dark web posts is classified into a relevant class; and
tokenizing the plurality of classified dark web posts by a tokenizer, based on a transformed pointwise mutual information function and an attack utterances dictionary, to obtain the tokenized dark web post set.

### Claim 9

A system comprising:
at least one computer processor;
a data repository, in communication with the at least one computer processor and stored on a physical storage device, configured to store a plurality of raw dark web posts; and
a dark web analyzer executing on the at least one computer processor, wherein:
the dark web analyzer is configured to cause the at least one computer processor to
obtain the plurality of raw dark web posts, each raw dark web post of the plurality of raw dark web posts including a natural language utterance,
cause a preprocessor executing on the at least one computer processor to preprocess the plurality of raw dark web posts to obtain a tokenized dark web post set,
construct a prompt for a threat analyzer LLM, including at least a first tokenized dark web post of the tokenized dark web post set;
a set of threat personas, each threat persona of the set of threat personas comprising a category and a definition, and
an instruction to categorize the first tokenized dark web post with a threat persona of the set of threat personas and generate a first explanation corresponding to the categorization of the first tokenized dark web post;
cause the threat analyzer LLM executing on the at least one computer processor to process the prompt, to obtain a first annotated post and a corresponding first threat persona category,
wherein the first annotated post includes a post summary corresponding to the first tokenized dark web post, and
the first explanation, wherein the first explanation is based on a first threat persona definition; and
add the first annotated post and the corresponding first threat persona category to a post-persona catalog in the data repository.

### Claim 10 (depends on 9)

The system of claim 9, further comprising:
a threat activity tracker, executing on the at least one computer processor, and configured to:
select, from the post-persona catalog, a set of annotated posts corresponding to a second threat persona category to obtain a post-persona subset; and
present, via a web interface, a dashboard displaying at least one visualization of the post-persona subset to a user.

### Claim 11 (depends on 9)

The system of claim 9, wherein the preprocessor is configured to:
perform a set of preprocessing operations on each raw dark web post of the plurality of raw dark web posts to obtain a corresponding plurality of preprocessed dark web posts, wherein the set of preprocessing operations includes translation, stop word removal, and noise removal;
store the plurality of preprocessed dark web posts in the data repository;
obtain a post classifier training dataset created by classifying a subset of the plurality of preprocessed dark web posts, wherein each preprocessed dark web post of the subset of preprocessed dark web posts is classified into one of a relevant class and a non-relevant class; and
store the post classifier training dataset in the data repository.

### Claim 12 (depends on 9)

The system of claim 9, wherein the dark web analyzer is further configured to:
train a post classifier ML model with a post classifier training dataset obtained from the data repository, to obtain a trained post classifier ML model,
wherein the post classifier ML model is a Gaussian Naïve Bayes model, and
wherein the post classifier training dataset includes a plurality of preprocessed dark web posts classified with a plurality of class labels, comprising:
calculating a prior probability for each class label of the plurality of class labels, wherein the prior probability of each class label is the probability of an occurrence of each class label in the post classifier training dataset, to obtain a plurality of prior probabilities corresponding respectively to the plurality of class labels; and
calculating a mean and a standard deviation corresponding to each of a feature of a plurality of features corresponding to the post classifier training dataset, to obtain a plurality of Gaussian distributions of the plurality of features, corresponding to each class label of the plurality of class labels.

### Claim 13 (depends on 12)

The system of claim 12, wherein the dark web analyzer is further configured to train the post classifier ML model, the training further comprising:
obtaining a first instance of the post classifier training dataset having a plurality of feature values corresponding to the plurality of features of the post classifier training dataset;
calculating a probability of each feature value of the plurality of feature values of the first instance corresponding to each class label of the plurality of class labels, based on a Gaussian probability density function, to obtain a plurality of feature value probabilities corresponding to each class label of the plurality of class labels, for the first instance;
applying a Bayes theorem function to the plurality of feature value probabilities corresponding to each class label of the plurality of class labels, for the first instance, to obtain a plurality of posterior probabilities corresponding respectively to the plurality of class labels for the first instance;
calculating a combined probability value as a product of a posterior probability value corresponding to each class label of the plurality of class labels and a prior probability value corresponding to each class label of the plurality of class labels, to obtain a plurality of combined probability values corresponding respectively to the plurality of class labels, for the first instance; and
selecting a class label from the plurality of class labels with a highest posterior probability value for the first instance as a predicted class for the first instance.

### Claim 14 (depends on 9)

The system of claim 9, wherein the dark web analyzer is further configured to:
cause a trained post classifier ML model executing on the at least one computer processor to classify each preprocessed dark web post of a plurality of preprocessed dark web posts obtained from the data repository, into one of a relevant class and a non-relevant class, to obtain a corresponding plurality of classified dark web posts; and
store the plurality of classified dark web posts in the data repository.

### Claim 15 (depends on 9)

The system of claim 9, wherein the dark web analyzer is further configured to:
select a plurality of classified dark web posts from the data repository, wherein each classified dark web post of the plurality of classified dark web posts is classified into a relevant class; and
create an attack utterances dictionary comprising a plurality of utterances, each utterance of the plurality of utterances having at least one frequently occurring phrase identified from the selected plurality of classified dark web posts, wherein the occurrence of the frequently occurring phrase is higher than a phrase frequency threshold.

### Claim 16 (depends on 9)

The system of claim 9, wherein the dark web analyzer is further configured to:
select a plurality of classified dark web posts from the data repository, wherein each classified dark web post of the plurality of classified dark web posts is classified into a relevant class; and
cause a tokenizer executing on the at least one computer processor to tokenize the plurality of classified dark web posts, based on a transformed pointwise mutual information function and an attack utterances dictionary, to obtain the tokenized dark web post set.

### Claim 17

A method, comprising:
obtaining, by a dark web analyzer, a plurality of raw dark web posts from a data repository on a physical storage device, each raw dark web post of the plurality of raw dark web posts including a natural language utterance;
performing, by a preprocessor, a set of preprocessing operations on each raw dark web post of the plurality of raw dark web posts to obtain a corresponding plurality of preprocessed dark web posts, wherein the set of preprocessing operations includes translation, stop word removal, and noise removal;
classifying a subset of the plurality of preprocessed dark web posts, wherein each preprocessed dark web post of the subset of preprocessed dark web posts is classified into one of a relevant class and a non-relevant class, to obtain a post classifier training dataset;
training, by the dark web analyzer, a post classifier ML model with the post classifier training dataset, to obtain a trained post classifier ML model, wherein the post classifier ML model is a Gaussian Naïve Bayes model; and
classifying, by the trained post classifier ML model, each preprocessed dark web post of the plurality of preprocessed dark web posts, into one of the relevant class and the non-relevant class, to obtain a corresponding plurality of classified dark web posts.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
selecting, by the dark web analyzer, a set of classified dark web posts from the plurality of classified dark web posts, wherein the set of classified dark web posts is classified into the relevant class;
creating an attack utterances dictionary comprising a plurality of utterances, each utterance of the plurality of utterances having at least one frequently occurring phrase identified from the set of classified dark web posts, wherein the occurrence of the frequently occurring phrase is higher than a phrase frequency threshold; and
tokenizing, by a tokenizer, the set of classified dark web posts, based on a transformed pointwise mutual information function and the attack utterances dictionary, to obtain a tokenized dark web post set.

### Claim 19 (depends on 18)

The method of claim 18, further comprising:
constructing, by the dark web analyzer, a prompt for a threat analyzer LLM, including at least a first tokenized dark web post of the tokenized dark web post set,
a set of threat personas, each threat persona of the set of threat personas comprising a category and a definition, and
an instruction to categorize the first tokenized dark web post with a threat persona of the set of threat personas and generate a first explanation corresponding to the categorization of the first tokenized dark web post;
processing the prompt with the threat analyzer LLM, to obtain a first annotated post and a corresponding first threat persona category, wherein
the first annotated post includes a post summary corresponding to the first tokenized dark web post, and
the first explanation, wherein the first explanation is based on a first threat persona definition; and
adding, by the dark web analyzer, the first annotated post and the corresponding first threat persona category to a post-persona catalog in the data repository.

### Claim 20 (depends on 19)

The method of claim 19, further comprising:
selecting, by a threat activity tracker, from the post-persona catalog, a set of annotated posts corresponding to a second threat persona category to obtain a post-persona subset; and
presenting, by the threat activity tracker, via a web interface, a dashboard displaying at least one visualization of the post-persona subset to a user.