arXiv subjects

Howie Huang

Publications and source records attributed to Howie Huang.

3 recordsLinked to original sources

arXiv2025

SENTINEL: A Multi-Modal Early Detection Framework for Emerging Cyber Threats using Telegram

Cyberattacks pose a serious threat to modern sociotechnical systems, often resulting in severe technical and societal consequences. Attackers commonly target systems and infrastructure through methods such as malware, ransomware, or other forms of technical exploitation. Most traditional mechanisms to counter these threats rely on post-hoc detection and mitigation strategies, responding to cyber incidents only after they occur rather than preventing them proactively. Recent trends reveal social media discussions can serve as reliable indicators for detecting such threats. Malicious actors often exploit online platforms to distribute attack tools, share attack knowledge and coordinate. Experts too, often predict ongoing attacks and discuss potential breaches in online spaces. In this work, we present SENTINEL, a framework that leverages social media signals for early detection of cyber attacks. SENTINEL aligns cybersecurity discussions to realworld cyber attacks leveraging multi modal signals, i.e., combining language modeling through large language models and coordination markers through graph neural networks. We use data from 16 public channels on Telegram related to cybersecurity and open source intelligence (OSINT) that span 365k messages. We highlight that social media discussions involve active dialogue around cyber threats and leverage SENTINEL to align the signals to real-world threats with an F1 of 0.89. Our work highlights the importance of leveraging language and network signals in predicting online threats.

cs.SI↗

arXiv2025

ALETHEIA: Combating Social Media Influence Campaigns with Graph Neural Networks

Influence campaigns are a growing concern in the online spaces. Policymakers, moderators and researchers have taken various routes to fight these campaigns and make online systems safer for regular users. To this end, our paper presents ALETHEIA, a system that formalizes the detection of malicious accounts (or troll accounts) used in such operations and forecasts their behaviors within social media networks. We analyze influence campaigns on Reddit and X from different countries and highlight that detection pipelines built over a graph-based representation of campaigns using a mix of topological and linguistic features offer improvement over standard interaction and user features. ALETHEIA uses state-of-the-art Graph Neural Networks (GNNs) for detecting malicious users that can scale to large networks and achieve a 3.7% F1-score improvement over standard classification with interaction features in prior work. Furthermore, ALETHEIA employs a first temporal link prediction mechanism built for influence campaigns by stacking a GNN over a Recurrent Neural Network (RNN), which can predict future troll interactions towards other trolls and regular users with an average AUC of 96.6%. ALETHEIA predicts troll-to-troll edges (TTE) and troll-to-user edges (TUE), which can help identify regular users being affected by malicious influence efforts. Overall, our results highlight the importance of utilizing the networked nature of influence operations (i.e., structural information) when predicting and detecting malicious coordinated activity in online spaces.

cs.SI↗

arXiv2022

Mnemonic: A Parallel Subgraph Matching System for Streaming Graphs

Finding patterns in large highly connected datasets is critical for value discovery in business development and scientific research. This work focuses on the problem of subgraph matching on streaming graphs, which provides utility in a myriad of real-world applications ranging from social network analysis to cybersecurity. Each application poses a different set of control parameters, including the restrictions for a match, type of data stream, and search granularity. The problem-driven design of existing subgraph matching systems makes them challenging to apply for different problem domains. This paper presents Mnemonic, a programmable system that provides a high-level API and democratizes the development of a wide variety of subgraph matching solutions. Importantly, Mnemonic also delivers key data management capabilities and optimizations to support real-time processing on long-running, high-velocity multi-relational graph streams. The experiments demonstrate the versatility of Mnemonic, as it outperforms several state-of-the-art systems by up to two orders of magnitude.

cs.DC↗