System and Article of Manufacture to Analyze Twitter Data to Discover Suspicious Users and Malicious Content
AssigneeThe United States of America as represented by the Secretary of the Air Force
InventorsPRAVEEN RAO, CHARLES KAMHOUA, LAURENT NJILLA, KEVIN KWIAT
Life of this patent
Estimating the term…
Abstract
The invention comprises a system and article of manufacture to discover potential cyber threats on Twitter. The invention provides a unified framework for modeling and reasoning about the veracity of tweets to discover suspicious users and malicious content. The invention builds on the concept of Markov logic networks (MLNs) for knowledge representation and reasoning under uncertainty.
Claims32
An article of manufacture comprising a non-transitory storage medium having a plurality of programming instructions stored therein, the programming instructions being configured to program an apparatus to implement on the apparatus one or more subsystems or services to analyze Twitter data to discover suspicious users and malicious content by
- collecting tweets from Twitter;
- flagging malicious and benign URLs and domains;
- generating ground predicates based on said tweets, said flagged URLs and domains, and a knowledge base of predicates and formulas;
- generating a subset of said ground predicates based on an input set of queries;
- learning weights of said formulas based on said subset of ground predicates, said tweets, and said knowledgebase;
- updating said knowledgebase with first order predicates and formulas that capture the content of said tweets and the behavior of Twitter users;
- performing probabilistic inference on said queries based on said updated knowledgebase;
- combining results;
- and
- outputting suspicious Twitter users and malicious Twitter content.
A system for analyzing Twitter data to discover suspicious users and malicious content, comprising:
- at least one computer server executing a plurality of programming instructions stored therein;
- at least one source of externally stored data;
- a communications channel for receiving tweets from Twitter;
- and
- a user interface for querying said system;
- and
- said programming instructions configured to program said computer server to perform tasks, said tasks further comprising communicating with:
- said at least one source of external data,
- said communications channel for receiving tweets from Twitter, and
- said user interface
- so as to identify and output suspicious Twitter users and malicious Twitter content.
Dependencies are inferred from the claim text.