Social media has influenced socio-political aspects of many societies around the world. It is an effortless way for people to enhance their communication, connect with like-minded people, and share ideas. Online social networks (OSNs) can be used for noble causes by bringing together communities with common shared interests and to promote awareness of various causes. However, there is a dark side to the use of OSNs. OSNs can also be used as a coordination and amplification platform for attacks. For instance, adversaries can increase the impact of an attack by causing panic in an area by promoting attacks using OSNs. Public data can help adversaries to determine the best timing for attacks, scheduling attacks, and then using OSNs to coordinate attacks on networks or physical locations. This convergence of the cyber and physical worlds is known as cybernetics. In this paper, we introduce an integrated method to identify malicious behavior and the actors responsible for propagating this behavior via online social networks. Throughout history we have used surveillance techniques to monitor negative behavior, activities, and information. Quantitative socio-technical methods such as deviant cyber flash mob (DCFM) detection and focal structure analysis (FSA) can provide reconnaissance capabilities that enable cities and governments to look beyond internal data and identify threats based on active events. Groups of powerful hackers can be identified through FSA which is an integrated model that uses a betweenness centrality method at the node-level and spectral modularity at group-level to identify a hidden malicious and powerful focal structure (a subset of the network). Assessment of groups using DCFM methods can help to identify powerful actors and prevent attacks. In this study, we examine multiple data sets integrating the DCFM and FSA models to help cybersecurity experts see a better picture of the threat which will help to plan a better response.

社交媒体已经影响了全世界许多社会的社会政治方面。这是人们轻松交流，与志同道合的人建立联系并分享想法的一种轻松方式。在线社交网络（OSN）可以通过将具有共同共同利益的社区聚集在一起，并提高人们对各种原因的认识，从而用于崇高的原因。但是，OSN的使用存在阴暗面。OSN也可以用作攻击的协调和放大平台。例如，攻击者可以通过使用OSN发起攻击，在某个地区引起恐慌，从而增加攻击的影响。公开数据可以帮助攻击者确定最佳的攻击时机，安排攻击时间，然后使用OSN协调对网络或物理位置的攻击。网络与物理世界的融合被称为控制论。在本文中，我们介绍了一种用于识别恶意行为的综合方法以及负责通过在线社交网络传播此行为的行为者。在整个历史中，我们一直使用监视技术来监视负面行为，活动和信息。定量的社会技术方法，例如异常的网络快闪（DCFM）检测和焦点结构分析（FSA），可以提供侦察功能，使城市和政府能够查看内部数据以外的内容，并根据活动事件识别威胁。可以通过FSA识别强大的黑客群体，FSA是一种集成模型，它使用节点级别的中间集中性方法和团队级别的频谱模块化来识别隐藏的恶意和强大的焦点结构（网络的子集）。使用DCFM方法对小组进行评估可以帮助识别强大的参与者并防止攻击。在本研究中，我们研究了集成DCFM和FSA模型的多个数据集，以帮助网络安全专家更好地了解威胁的情况，从而有助于计划更好的应对措施。