Lion Cipher Lab

Detect coordinated inauthentic behavior from scratch

• Threat Intel Analyst
• Advanced
• ~90 min
• Free · no account required

Why it matters

There is already a Lion Cipher lab on influence operations -- 'Map an influence operation with the DISARM framework' -- and it is deliberately a DIFFERENT job from this one. That lab is a mapping exercise: you have already concluded that some activity is an operation, and you name its tactics and techniques in a shared vocabulary so analysts and platforms can compare notes. It answers 'what is this operation doing?' This lab answers the question that comes BEFORE that one, and it is the genuinely hard part of the discipline: is there a coordinated operation hiding in this data AT ALL, and can…

What you'll learn

• the core CIB idea: you find an influence operation not account-by-account but by its COORDINATION -- accounts acting together in ways organic users do not
• building a co-share network from raw posts: accounts are nodes, an edge is two accounts sharing the same artifact, edge weight is how often
• measuring a detector honestly with PRECISION and RECALL against ground-truth labels instead of eyeballing a graph
• why the naive 'they shared the same hashtag' detector is worthless (precision 0.06) -- organic virality means normal people co-share popular things
• adding temporal tightness (a co-share window delta) and seeing exactly which NAMED organic phenomenon still fools it (breaking-news bursts)
• adding content near-duplication with character-shingle Jaccard similarity, and seeing which phenomenon fools THAT alone (copypasta chains)
• the real lesson in numbers: coordination is the CONJUNCTION of same-artifact + tight-time + near-identical-text, because each single signal has an innocent explanation
• naming the false-positive traps you must beat: organic virality, breaking news, authentic fandoms, and the base-rate problem
• keeping the three ideas separate that everyone collapses: coordination is not inauthenticity is not attribution
• reporting a finding in estimative language and mapping the observed behaviour to DISARM / ATT&CK-style TTPs with an honest confidence level

Steps in this lab

1. What coordinated inauthentic behavior is, and why you hunt the coordination, not the accounts
2. How this lab differs from the DISARM mapping lab -- and why you need both
3. Make sure you have Python (zero assumptions)
4. Why synthetic data with ground truth -- and why that is the honest way to learn this
5. Create the script -- paste it into a file called cib.py
6. Run it, and read the NAIVE result: why 'they shared the same hashtag' is worthless
7. Add temporal tightness -- and meet the first false-positive trap that beats it
8. Add content near-duplication -- and meet the trap that beats THAT, alone
9. When NOT to trust this: coordination is not inauthenticity is not attribution
10. Write the finding: map to TTPs and state your confidence honestly

Open the full interactive lab →