arXiv subjects

Mohammed Almukaynizi

Publications and source records attributed to Mohammed Almukaynizi.

3 recordsLinked to original sources

arXiv2026

SnapScope: A Platform for City-Scale Collection and Exploration of Public Snap Map Data

Snapchat's Snap Map is an ephemeral stream of geotagged public video and image stories, but the platform provides no documented API, no prior work describes a reproducible system for collecting this data at city scale, and no tool exists for managing and exploring the collected data interactively. We present SnapScope, an integrated platform that pairs a back-end collection pipeline with a web-based front end for scraper management, interactive data exploration, side-by-side neighborhood comparison, and data export. We deploy the platform over Riyadh, Saudi Arabia, collecting 515,364 unique public snaps across 23 days on a 1 km grid of 2,740 query points. A saturation probe over 21 consecutive runs shows that 94.8% of returned observations are duplicates of already-stored records. We provide a privacy-safe aggregate dataset under CC BY 4.0. The platform is city-agnostic and redeployable by substituting grid coordinates and boundary polygons.

cs.SI↗

arXiv2018

DARKMENTION: A Deployed System to Predict Enterprise-Targeted External Cyberattacks

Recent incidents of data breaches call for organizations to proactively identify cyber attacks on their systems. Darkweb/Deepweb (D2web) forums and marketplaces provide environments where hackers anonymously discuss existing vulnerabilities and commercialize malicious software to exploit those vulnerabilities. These platforms offer security practitioners a threat intelligence environment that allows to mine for patterns related to organization-targeted cyber attacks. In this paper, we describe a system (called DARKMENTION) that learns association rules correlating indicators of attacks from D2web to real-world cyber incidents. Using the learned rules, DARKMENTION generates and submits warnings to a Security Operations Center (SOC) prior to attacks. Our goal was to design a system that automatically generates enterprise-targeted warnings that are timely, actionable, accurate, and transparent. We show that DARKMENTION meets our goal. In particular, we show that it outperforms baseline systems that attempt to generate warnings of cyber attacks related to two enterprises with an average increase in F1 score of about 45% and 57%. Additionally, DARKMENTION was deployed as part of a larger system that is built under a contract with the IARPA Cyber-attack Automated Unconventional Sensor Environment (CAUSE) program. It is actively producing warnings that precede attacks by an average of 3 days.

cs.CR↗

arXiv2018

Finding Cryptocurrency Attack Indicators Using Temporal Logic and Darkweb Data

With the recent prevalence of darkweb/deepweb (D2web) sites specializing in the trade of exploit kits and malware, malicious actors have easy-access to a wide-range of tools that can empower their offensive capability. In this study, we apply concepts from causal reasoning, itemset mining, and logic programming on historical cryptocurrency-related cyber incidents with intelligence collected from over 400 D2web hacker forums. Our goal was to find indicators of cyber threats targeting cryptocurrency traders and exchange platforms from hacker activity. Our approach found interesting activities that, when observed together in the D2web, subsequent cryptocurrency-related incidents are at least twice as likely to occur than they would if no activity was observed. We also present an algorithmic extension to a previously-introduced algorithm called APT-Extract that allows to model new semantic structures that are specific to our application.

cs.CR↗