Social-HUMINT: An LLM-Augmented Unified Framework for Measuring Social Media Exposure

📄 arXiv: 2610.31573v1 📥 PDF

作者: Pellegrino Casoria, Simon Pietro Romano

分类: cs.CR, cs.AI, cs.SI

发布日期: 2026-10-22

💡 一句话要点

提出Social-HUMINT框架以量化社交媒体曝光风险

🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)

关键词: 社交媒体分析 网络安全 社交工程 大型语言模型 用户隐私 数据提取 属性推断 易受攻击性评估

📋 核心要点

  1. 现有方法未能全面覆盖社交媒体分析与网络安全之间的联系，导致对社交工程攻击的评估不足。
  2. 论文提出了一种统一的框架，将社交媒体情报与网络人类情报结合，量化社交媒体曝光的风险。
  3. 实验结果显示，该框架在提取和推断准确性上显著优于现有基线，F1得分达到97.3%。

📝 摘要（中文）

在后API时代，社交媒体分析变得廉价且自动化。大型语言模型（LLMs）能够从非结构化内容中提取结构化信息，并推断用户未公开的属性。个人的真实曝光并非其发布的内容，而是可以从中推断出的信息。随着这些做法的常态化，社交工程攻击的风险日益增加，亟需一个共享的评估和缓解框架。本文通过量化目标的可被分析程度及其所导致的社交工程攻击风险，使曝光可测量。我们将社交媒体情报（SOCMINT）与网络人类情报（Cyber-HUMINT）统一为一个包含38种能力的分类法，经过领域专家验证。我们将核心路径（提取、推断和易受攻击性评估）实现为一个增强LLM的多代理管道，并在真实参与者的公共数据上进行了评估。

🔬 方法详解

问题定义：本文旨在解决社交媒体分析与网络安全评估之间的脱节，现有方法无法全面量化用户的社交媒体曝光及其潜在风险。

核心思路：通过将社交媒体情报（SOCMINT）与网络人类情报（Cyber-HUMINT）结合，构建一个统一的框架，量化用户的社交媒体曝光及其对社交工程攻击的易受攻击性。

技术框架：整体架构包括数据提取、属性推断和易受攻击性评估三个主要模块，利用增强型LLM技术实现多代理管道的功能。

关键创新：最重要的创新在于将SOCMINT与Cyber-HUMINT整合为一个统一的分类法，形成38种能力的框架，填补了现有模型的空白。

关键设计：在提取阶段，使用LLM进行数据处理，确保提取的F1得分达到97.3%；在推断阶段，采用用户行为匹配算法，评估个性化参与选项的排名能力。

🖼️ 关键图片

fig_0
fig_1
fig_2

📊 实验亮点

实验结果显示，提取准确性达到F1 = 97.3%，推断属性评分为4.73/5，均显著高于基于规则和命名实体识别的基线，表明该框架在社交媒体曝光评估中的有效性和准确性。

🎯 应用场景

该研究的潜在应用领域包括网络安全、社交媒体分析和用户隐私保护等。通过量化社交媒体曝光，安全分析师可以更好地评估和缓解潜在的社交工程攻击风险，从而提升防御能力。

📄 摘要（原文）

In the post-API landscape, social-media profiling has become inexpensive and automated: Large Language Models (LLMs) can extract structured information from unstructured content and deduce attributes users never disclosed. A person's true exposure is not what they post but what can be inferred from it. As these practices become routine, exposure to social engineering attacks becomes an operational certainty, demanding a shared framework for assessment and mitigation. We make this exposure measurable by quantifying how accurately a target can be profiled, and how far that profile enables social engineering attacks. Because no existing model fully spans this continuum, we unify Social Media Intelligence (SOCMINT) and Cyber Human Intelligence (Cyber-HUMINT), two individual-focused disciplines that evolved separately, into a single doctrine-grounded taxonomy of 38 capabilities across the Cyber Threat Intelligence lifecycle, where user profiling bridges passive collection and active engagement. Domain experts validated the taxonomy (Fleiss' $κ$ = 0.92). We operationalize its core path (extraction, inference, and susceptibility assessment) as an LLM-augmented multi-agent pipeline, evaluated on real participants' public data. Susceptibility is assessed indirectly: the pipeline predicts how each target would rank personalized engagement options, matching their actual choices significantly above chance. This ranking capacity captures the personalization on which tailored attacks depend. The underlying profiles are accurate: extraction reaches F1 = 97.3%, and inferred attributes score 4.73/5, both far above rule-based and NER-based baselines at negligible cost. The framework augments security analysts' tradecraft rather than replacing it and enables defenders to gauge their own exposure before an adversary does.