From Observable Connections to Obfuscated Coordination in an Era of Fragmented and Encrypted Data

Recent events have made it clear how critical is early detection of any form of terrorist activity. But identifying terrorist cells is a complex task: Recruitment networks may operate on entirely different platforms than those used for fundraising or military coordination. What’s more, operatives are often instructed to exercise caution and abstain from communicating on social media and other unsecured channels. So how can early-stage hostile activity be detected before an attack unfolds?

"We call this proactive cyber," explains Dr. Somin, "the goal is to identify hostile activity at the planning stage, long before an attack occurs. One of the main questions I tackled during my postdoc was how to uncover hidden coordination mechanisms behind interpersonal connections, even when they don’t show up directly in the data."

Dr. Somin joined the Faculty of Engineering in April 2025. She is 38 years old, married, and a mother of three. She holds a BSc in mathematics and computer science, as well as an MSc in computer science with a focus on machine learning. After graduating, she spent five years at Endor, working as a data scientist and later as head of the machine learning department. At the same time, she began her PhD in industrial engineering and management at Tel Aviv University.

“My goal was to apply my machine learning expertise to the study of human connections," she explains. "Classic machine learning usually focuses on personal attributes such as name, height, family status, location, salary, and tries to predict behavior based on that. But human behavior is heavily influenced by relationships. For example, when we tried to model the spread of COVID-19, the most important question wasn’t whether I was married or how many kids I had, but who I came in contact with. Similarly, if all my friends switched to a new bank, I would be more likely to switch, too. And if all my friends joined ISIS, the greater the odds that I share that inclination. This web of influence means that the structure of connections is as important as individual characteristics, and that became the focus of my doctoral research."

From Financial Fraud to Fake News

After completing her PhD, Dr. Somin pursued a postdoctoral fellowship at MIT's Media Lab, where she took her research a step further and attempted to explore hidden interpersonal dynamics, even when they are not directly reflected in the data.

"The digital world is distributed across so many platforms, and there is practically no entity that can access all of them and draw conclusions from the plethora of information, not to mention that some actors deliberately obscure these connections. I set out to identify relationships between people operating on different platforms and whose data is seemingly unconnected, and pinpoint indications of coordination towards a common goal—for instance, being part of the same organization, or planning hostile activities."

How can we uncover such connections when often much of the data is encrypted or siloed, and the platforms are less than eager to share it? The answer lies in temporal analysis—duration, time, and frequency of network activity.

"We generate a ‘temporal fingerprint’ for each user and look for users with similar patterns, that is, involved in the same or related activities," says Dr. Somin. "During my postdoc, for example, I developed systems capable of detecting hidden coordination between individuals, even when no direct connection is observable and the information concerning their activity is encrypted or scattered across multiple platforms. Using Temporal Graph Neural Networks (GNNs), I was able to uncover connections between different profiles of the same person and identify groups working in coordination toward shared goals. Such systems can have a wide range of applications. Cybersecurity, of course, but also identifying influence campaigns and inauthentic behavior online, or spotting financial fraud. Thanks to our systems, organizations can share with us their data in an encrypted manner, which enables them to establish predictions while preserving their users’ privacy."

What’s Happening in the Real World?

Now, as a member of the Industrial Engineering and Information Systems program, Dr. Somin is bringing this research to the Faculty of Engineering.

"Information systems are a major component of industrial engineering and management," she says. "Today’s industry is data-driven; we have multitudes of information from which we need to produce decisions. This data comes from diverse sources, at different times, and we can't always detect direct connections. The ability to identify obfuscated coordination or dependencies, even without explicit connections, is crucial to understanding what’s really happening in the field. A good example is Silicon Valley Bank, an American bank whose collapse two years ago was triggered by rumors about liquidity issues that spread on Twitter. As a result, clients rushed to withdraw their money, creating an actual liquidity crisis. This is a great example of how coordination between people on one completely virtual platform can impact another platform to the point of collapse, even when the two platforms seemingly share no connections. Had we been able to detect that coordination ahead of time, perhaps the damage could have been mitigated."

Obfuscated coordination also plays a role in other areas of industrial engineering: it can help explain unexpected supply chain failures, improve production system scheduling and programming, and detect emerging malfunctions in complex systems. "Moreover, identifying obfuscated connections allows us to not only explain what happened in retrospect, but also to predict processes, detect hidden drivers, and build smarter, more resilient systems," adds Dr. Somin.

In the Network Intelligence and Coordination Lab (NICL) that she is currently establishing, Dr. Somin investigates connections from both theoretical and applied perspectives. "On the theoretical side, we’re developing models that explain how obfuscated coordination forms and spreads—whether it’s disease transmission, market behavior, or the spread of misinformation. On the practical side, we’re building systems that can detect coordinated group behavior in real-time, even when no direct connections are observable. This can help with cyber defense, financial risk management, and better decision-making in complex systems." Research at the lab combines machine learning, temporal analysis, dynamic graphs, and differential privacy as a means for tackling the challenge of fragmented data across platforms. Interested? Dr. Somin is currently recruiting master’s and PhD students. You can reach her at: Somin.shahar@gmail.com