Abstract: There is provided a method, comprising: extracting user feature profiles for users of a social network, each feature profile being structured and including user features extracted from unstructured user generated text, indications of participation in groups, and structured user profiles, training a clustering-component of a model to cluster the feature profiles, training a matching-component of the model to compute a distance score indicative of statistical similarity between a feature profile of a target user and features profiles of other users of a same cluster, using a training dataset of pairs of feature profiles extracted from common clusters, each pair assigned a distance score label, providing the model for: identifying a certain cluster of a certain user, and computing distance scores between the feature profile of the certain user and other feature profiles of other users of the certain cluster for selecting one user for establishment of a communication session.

Abstract: Examples disclosed herein relate to security indicator scores. The examples enable obtaining a security indicator created by a first user where the security indicator may comprise a first observable, and obtaining, from a first source entity, a first sighting of the first observable. The first sighting of the first observable may indicate that the first observable has been observed by the first source entity where the first source entity is associated with a first level of source reliability. The examples enable determining a number of sightings of the first observable. The examples enable determining a first observable score based on the number of sightings of the first observable and the first level of source reliability, and determining an indicator score associated with the security indicator based on the first observable score. The indicator score may be presented to a community of users via a user interface.

Abstract: Examples disclosed herein relate to providing enhanced threat intelligence on a security information sharing platform. Some examples may enable correlating a first set of items of threat information from the security information sharing platform. Some examples may enable, responsive to determining that the correlated first set of items of threat information indicate a first malicious action type, creating a new security indicator comprising information from the correlated first set of items of threat information and associating the new security indicator with the first malicious action type. Some examples may enable determining whether a first threat pattern exists based on the new security indicator.

Abstract: There is provided a method, comprising: extracting user feature profiles for users of a social network, each feature profile being structured and including user features extracted from unstructured user generated text, indications of participation in groups, and structured user profiles, training a clustering-component of a model to cluster the feature profiles, training a matching-component of the model to compute a distance score indicative of statistical similarity between a feature profile of a target user and features profiles of other users of a same cluster, using a training dataset of pairs of feature profiles extracted from common clusters, each pair assigned a distance score label, providing the model for: identifying a certain cluster of a certain user, and computing distance scores between the feature profile of the certain user and other feature profiles of other users of the certain cluster for selecting one user for establishment of a communication session.

Abstract: Examples disclosed herein relate to security indicator scores. The examples enable obtaining a security indicator created by a first user where the security indicator may comprise a first observable, and obtaining, from a first source entity, a first sighting of the first observable. The first sighting of the first observable may indicate that the first observable has been observed by the first source entity where the first source entity is associated with a first level of source reliability. The examples enable determining a number of sightings of the first observable. The examples enable determining a first observable score based on the number of sightings of the first observable and the first level of source reliability, and determining an indicator score associated with the security indicator based on the first observable score. The indicator score may be presented to a community of users via a user interface.

Abstract: Examples disclosed herein relate to providing enhanced threat intelligence on a security information sharing platform. Some examples may enable correlating a first set of items of threat information from the security information sharing platform. Some examples may enable, responsive to determining that the correlated first set of items of threat information indicate a first malicious action type, creating a new security indicator comprising information from the correlated first set of items of threat information and associating the new security indicator with the first malicious action type. Some examples may enable determining whether a first threat pattern exists based on the new security indicator.