Social networks’ reach makes them a tempting target for malicious users to post spam messages intended to pollute social environments, deceive normal users, or sway political opinions. The increasing amount of malicious content has resulted in growing economic loss and adverse social impacts. This project aims to mitigate malicious online behavior by modeling it through a dynamic malicious knowledge graph. Inspired by human learning processes, the graph will gradually accumulate knowledge, becoming over time a powerful tool for analyzing and mitigating online misbehavior. Through modeling the relationships between concepts, content, and actors online, the graph will support research on the evolution of malicious communities and the detection of malicious behavior; the graph itself will be designed to be adaptable across security contexts, and the underlying methods designed to be usable in other applications that require modeling interaction online. To this end, the team will share datasets and software toolkits developed in this project with the research community, and the findings will be integrated into instructional materials in the form of book chapters, course materials, and tutorials to be widely disseminated. The team will also engage undergraduate students, including those from under-represented groups in computing, through a summer tutorial series and research activities. <br/><br/>This project focuses on developing a holistic framework to construct the dynamic malicious knowledge graph, organized around three main thrusts. The first thrust is to develop a real-time malicious content detector that addresses challenging issues such as feature variations, real-time scalable processing, and label scarcity. The second thrust is to conduct periodical analysis on the accumulated data to identify emerging malicious patterns, behaviors, and latent features with the goal of identifying sophisticated, stealthy malicious actors while growing the graph’s size and structure. The third thrust focuses on the design of the knowledge graph itself, including its structure, construction, label-aided evolution, and continuous self-monitoring. The resulting solutions will be first evaluated on real-world datasets to be gathered and then deployed into real-world social networks for full evaluation.<br/><br/>This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.