Amelia Shapiro

Studying the PRC Offensive Cybersecurity Ecosystem with AI-Enabled Open-Source Social Network Graphs

In this talk we will discuss methodology for building and analyzing social graphs of adversarial networks using AI. We will also show analytical findings from our 3200-node 5000-edge graph of China’s offensive cyber-enabling ecosystem, and discuss methodological pitfalls one can encounter doing open-source social network graph analysis and how AI can ameliorate or exacerbate them. 

In an era where AI can build an entire graph in days, understanding when graph algorithms can be trusted based on how the graph was constructed is a key role of the analyst. It can be difficult to draw conclusions from datasets that are not just incomplete, but from which the most important pieces of data are most likely to be missing. For example, when a graph of a country’s intelligence ecosystem contains only open-source and leaked data, betweenness centrality, which is usually among the most generally applicable traditional centrality algorithms, will grossly underrate that country’s premier intelligence agency. That does not mean betweenness centrality has no role in graph analysis, and using our graph we will demonstrate where it is most analytically useful. Similarly, certain entities in the graph are much more connected than they otherwise would be because of leak data. In our data i-Soon is a prime example of this phenomenon. As a result, using variants of word2vec that prioritize structural similarity to find similar nodes are more likely to output i-Soon as being similar to Qianxin than similar to an entity closer to its real size and scope. 

Finally, we will show ways to circumvent AI-graph based analytic pitfalls not just in the analysis stage but also in the graph-building stage and show off some of the outputs that our AI-built graph has to offer.