{ "cells": [ { "cell_type": "code", "execution_count": 1, "metadata": { "scrolled": true }, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
Unnamed: 0DISARM PhaseDISARM TacticDISARM TechniqueDISARM SubtechniqueDescriptionDISARM IDFeedback from EEASAction to DoAction TakenWhere did it come from?Where from more info
01PlanNaNNaNNaNEnvision the desired outcome. Lay out effectiv...P01NaNNaNNaNAMITTNaN
136PrepareNaNNaNNaNActivities conducted before execution to impro...P02NaNNaNNaNNaNNaN
2126ExecuteNaNNaNNaNRun the action, from initial exposure to wrap-...P03NaNNaNNaNNaNNaN
3263AssessNaNNaNNaNAssess effectiveness of action, for use in fut...P04NaNNaNNaNNaNNaN
47PlanPlan ObjectivesDismissDiscredit Credible SourcesPlan to delegitimize the media landscape and d...ST0001NaNNaNNaNAMITTT0067 Plan to Discredit Credible Sources
.......................................
272184ExecuteMaximize ExposureNaNNaNMaximize exposure of the target audience to in...TA12NaNNaNNaNNaNNaN
273204ExecuteDrive Online HarmsNaNNaNActions taken by an influence operation to har...TA13NaNNaNNaNNaNNaN
274221ExecuteDrive Offline ActivityNaNNaNMove incident/campaign from online to offline....TA14NaNNaNNaNNaNNaN
275235ExecutePersist in the Information SpaceNaNNaNPersist in the Information Space refers to tak...TA15NaNNaNNaNNaNNaN
276264AssessAssess EffectivenessNaNNaNNaNTA16NaNNaNNaNNaNNaN
\n", "

277 rows × 12 columns

\n", "
" ], "text/plain": [ " Unnamed: 0 DISARM Phase DISARM Tactic \\\n", "0 1 Plan NaN \n", "1 36 Prepare NaN \n", "2 126 Execute NaN \n", "3 263 Assess NaN \n", "4 7 Plan Plan Objectives \n", ".. ... ... ... \n", "272 184 Execute Maximize Exposure \n", "273 204 Execute Drive Online Harms \n", "274 221 Execute Drive Offline Activity \n", "275 235 Execute Persist in the Information Space \n", "276 264 Assess Assess Effectiveness \n", "\n", " DISARM Technique DISARM Subtechnique \\\n", "0 NaN NaN \n", "1 NaN NaN \n", "2 NaN NaN \n", "3 NaN NaN \n", "4 Dismiss Discredit Credible Sources \n", ".. ... ... \n", "272 NaN NaN \n", "273 NaN NaN \n", "274 NaN NaN \n", "275 NaN NaN \n", "276 NaN NaN \n", "\n", " Description DISARM ID \\\n", "0 Envision the desired outcome. Lay out effectiv... P01 \n", "1 Activities conducted before execution to impro... P02 \n", "2 Run the action, from initial exposure to wrap-... P03 \n", "3 Assess effectiveness of action, for use in fut... P04 \n", "4 Plan to delegitimize the media landscape and d... ST0001 \n", ".. ... ... \n", "272 Maximize exposure of the target audience to in... TA12 \n", "273 Actions taken by an influence operation to har... TA13 \n", "274 Move incident/campaign from online to offline.... TA14 \n", "275 Persist in the Information Space refers to tak... TA15 \n", "276 NaN TA16 \n", "\n", " Feedback from EEAS Action to Do Action Taken Where did it come from? \\\n", "0 NaN NaN NaN AMITT \n", "1 NaN NaN NaN NaN \n", "2 NaN NaN NaN NaN \n", "3 NaN NaN NaN NaN \n", "4 NaN NaN NaN AMITT \n", ".. ... ... ... ... \n", "272 NaN NaN NaN NaN \n", "273 NaN NaN NaN NaN \n", "274 NaN NaN NaN NaN \n", "275 NaN NaN NaN NaN \n", "276 NaN NaN NaN NaN \n", "\n", " Where from more info \n", "0 NaN \n", "1 NaN \n", "2 NaN \n", "3 NaN \n", "4 T0067 Plan to Discredit Credible Sources \n", ".. ... \n", "272 NaN \n", "273 NaN \n", "274 NaN \n", "275 NaN \n", "276 NaN \n", "\n", "[277 rows x 12 columns]" ] }, "execution_count": 1, "metadata": {}, "output_type": "execute_result" } ], "source": [ "import pandas as pd\n", "\n", "# make sure we didn't miss anything in mike's original sheet\n", "def check_diffs(col1, col2):\n", " xx = col1.value_counts().index\n", " yy = col2.value_counts().index\n", " print('lengths are: {} and {}'.format(len(xx), len(yy)))\n", " print('first list: {}'.format(xx))\n", " print('second list: {}'.format(yy))\n", " print('set difference: {}'.format(set(xx).difference(set(yy))))\n", "\n", "def check_ids(df, col='DISARM ID'):\n", " print('null ids: {}'.format(df[df[col].isnull()]))\n", " vc = df[col].value_counts().reset_index()\n", " print('repeated ids: {}'.format(vc[vc[col]>1]))\n", " return\n", "\n", "df = pd.read_csv('DISARM Merged (Internal) - DISARM Framework Merged.csv')\n", "df" ] }, { "cell_type": "code", "execution_count": 2, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
DISARM PhaseDISARM TacticDescriptionDISARM ID
0PlanNaNEnvision the desired outcome. Lay out effectiv...P01
1PrepareNaNActivities conducted before execution to impro...P02
2ExecuteNaNRun the action, from initial exposure to wrap-...P03
3AssessNaNAssess effectiveness of action, for use in fut...P04
\n", "
" ], "text/plain": [ " DISARM Phase DISARM Tactic \\\n", "0 Plan NaN \n", "1 Prepare NaN \n", "2 Execute NaN \n", "3 Assess NaN \n", "\n", " Description DISARM ID \n", "0 Envision the desired outcome. Lay out effectiv... P01 \n", "1 Activities conducted before execution to impro... P02 \n", "2 Run the action, from initial exposure to wrap-... P03 \n", "3 Assess effectiveness of action, for use in fut... P04 " ] }, "execution_count": 2, "metadata": {}, "output_type": "execute_result" } ], "source": [ "phases = df[['DISARM Phase', 'DISARM Tactic', 'Description', 'DISARM ID']]\n", "phases = phases[phases['DISARM Tactic'].isnull()]\n", "phases" ] }, { "cell_type": "code", "execution_count": 3, "metadata": {}, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 4 and 4\n", "first list: Index(['Prepare', 'Execute', 'Plan', 'Assess'], dtype='object')\n", "second list: Index(['Execute', 'Prepare', 'Plan', 'Assess'], dtype='object')\n", "set difference: set()\n", "null ids: Empty DataFrame\n", "Columns: [DISARM Phase, DISARM Tactic, Description, DISARM ID]\n", "Index: []\n", "repeated ids: Empty DataFrame\n", "Columns: [index, DISARM ID]\n", "Index: []\n" ] } ], "source": [ "check_diffs(phases['DISARM Phase'], df['DISARM Phase'])\n", "check_ids(phases)" ] }, { "cell_type": "code", "execution_count": 4, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
DISARM TacticDISARM TechniqueDescriptionDISARM ID
261Plan StrategyNaNDefine the desired end state, i.e. the set of ...TA01
262Plan ObjectivesNaNSet clearly defined, measurable, and achievabl...TA02
263Target Audience AnalysisNaNIdentifying and analyzing the target audience ...TA03
264Develop NarrativesNaNThe promotion of beneficial master narratives ...TA04
265Develop ContentNaNNaNTA05
266Establish Social AssetsNaNEstablishing information assets generates mess...TA06
267Establish LegitimacyNaNNaNTA07
268MicrotargetNaNTarget very specific populations of peopleTA08
269Select Channels and AffordancesNaNSelecting platforms and affordances assesses w...TA09
270Conduct Pump PrimingNaNRelease content on a targetted small scale, pr...TA10
271Deliver ContentNaNRelease content to general public or larger po...TA11
272Maximize ExposureNaNMaximize exposure of the target audience to in...TA12
273Drive Online HarmsNaNActions taken by an influence operation to har...TA13
274Drive Offline ActivityNaNMove incident/campaign from online to offline....TA14
275Persist in the Information SpaceNaNPersist in the Information Space refers to tak...TA15
276Assess EffectivenessNaNNaNTA16
\n", "
" ], "text/plain": [ " DISARM Tactic DISARM Technique \\\n", "261 Plan Strategy NaN \n", "262 Plan Objectives NaN \n", "263 Target Audience Analysis NaN \n", "264 Develop Narratives NaN \n", "265 Develop Content NaN \n", "266 Establish Social Assets NaN \n", "267 Establish Legitimacy NaN \n", "268 Microtarget NaN \n", "269 Select Channels and Affordances NaN \n", "270 Conduct Pump Priming NaN \n", "271 Deliver Content NaN \n", "272 Maximize Exposure NaN \n", "273 Drive Online Harms NaN \n", "274 Drive Offline Activity NaN \n", "275 Persist in the Information Space NaN \n", "276 Assess Effectiveness NaN \n", "\n", " Description DISARM ID \n", "261 Define the desired end state, i.e. the set of ... TA01 \n", "262 Set clearly defined, measurable, and achievabl... TA02 \n", "263 Identifying and analyzing the target audience ... TA03 \n", "264 The promotion of beneficial master narratives ... TA04 \n", "265 NaN TA05 \n", "266 Establishing information assets generates mess... TA06 \n", "267 NaN TA07 \n", "268 Target very specific populations of people TA08 \n", "269 Selecting platforms and affordances assesses w... TA09 \n", "270 Release content on a targetted small scale, pr... TA10 \n", "271 Release content to general public or larger po... TA11 \n", "272 Maximize exposure of the target audience to in... TA12 \n", "273 Actions taken by an influence operation to har... TA13 \n", "274 Move incident/campaign from online to offline.... TA14 \n", "275 Persist in the Information Space refers to tak... TA15 \n", "276 NaN TA16 " ] }, "execution_count": 4, "metadata": {}, "output_type": "execute_result" } ], "source": [ "tactics = df[['DISARM Tactic', 'DISARM Technique', 'Description', 'DISARM ID']]#['DISARM Tactic'].notnull()\n", "tactics = tactics[(tactics['DISARM Tactic'].notnull()) & (tactics['DISARM Technique'].isnull())]\n", "tactics" ] }, { "cell_type": "code", "execution_count": 5, "metadata": { "scrolled": true }, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 16 and 16\n", "first list: Index(['Drive Offline Activity', 'Plan Objectives', 'Conduct Pump Priming',\n", " 'Maximize Exposure', 'Target Audience Analysis', 'Microtarget',\n", " 'Establish Social Assets', 'Establish Legitimacy', 'Deliver Content',\n", " 'Select Channels and Affordances', 'Plan Strategy', 'Develop Content',\n", " 'Drive Online Harms', 'Persist in the Information Space',\n", " 'Develop Narratives', 'Assess Effectiveness'],\n", " dtype='object')\n", "second list: Index(['Develop Content', 'Establish Social Assets',\n", " 'Select Channels and Affordances', 'Persist in the Information Space',\n", " 'Target Audience Analysis', 'Maximize Exposure', 'Drive Online Harms',\n", " 'Establish Legitimacy', 'Drive Offline Activity',\n", " 'Assess Effectiveness', 'Deliver Content', 'Develop Narratives',\n", " 'Plan Objectives', 'Microtarget', 'Conduct Pump Priming',\n", " 'Plan Strategy'],\n", " dtype='object')\n", "set difference: set()\n", "null ids: Empty DataFrame\n", "Columns: [DISARM Tactic, DISARM Technique, Description, DISARM ID]\n", "Index: []\n", "repeated ids: Empty DataFrame\n", "Columns: [index, DISARM ID]\n", "Index: []\n" ] } ], "source": [ "check_diffs(tactics['DISARM Tactic'], df['DISARM Tactic'])\n", "check_ids(tactics)" ] }, { "cell_type": "code", "execution_count": 6, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
DISARM TechniqueDISARM SubtechniqueDescriptionDISARM ID
164Determine Target AudiencesNaNNaNT0001
165Determine Strategic EndsNaNNaNT0002
166DismissNaNPush back against criticism by dismissing your...T0003
167DistortNaNTwist the narrative. Take information, or arti...T0004
168DistractNaNShift attention to a different narrative or ac...T0005
...............
256Exploit TOS/Content ModerationNaNNaNT0093
257Play the long gameNaNPlay the long game refers to two phenomena: 1....T0094
258Measure PerformanceNaNNaNT0095
259Measure EffectivenessNaNNaNT0096
260Measure Effectiveness Indicators (or KPIs)NaNNaNT0097
\n", "

97 rows × 4 columns

\n", "
" ], "text/plain": [ " DISARM Technique DISARM Subtechnique \\\n", "164 Determine Target Audiences NaN \n", "165 Determine Strategic Ends NaN \n", "166 Dismiss NaN \n", "167 Distort NaN \n", "168 Distract NaN \n", ".. ... ... \n", "256 Exploit TOS/Content Moderation NaN \n", "257 Play the long game NaN \n", "258 Measure Performance NaN \n", "259 Measure Effectiveness NaN \n", "260 Measure Effectiveness Indicators (or KPIs) NaN \n", "\n", " Description DISARM ID \n", "164 NaN T0001 \n", "165 NaN T0002 \n", "166 Push back against criticism by dismissing your... T0003 \n", "167 Twist the narrative. Take information, or arti... T0004 \n", "168 Shift attention to a different narrative or ac... T0005 \n", ".. ... ... \n", "256 NaN T0093 \n", "257 Play the long game refers to two phenomena: 1.... T0094 \n", "258 NaN T0095 \n", "259 NaN T0096 \n", "260 NaN T0097 \n", "\n", "[97 rows x 4 columns]" ] }, "execution_count": 6, "metadata": {}, "output_type": "execute_result" } ], "source": [ "techs = df[['DISARM Technique', 'DISARM Subtechnique', 'Description', 'DISARM ID']]\n", "techs = techs[(techs['DISARM Technique'].notnull()) & (techs['DISARM Subtechnique'].isnull())]\n", "techs" ] }, { "cell_type": "code", "execution_count": 7, "metadata": { "scrolled": true }, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 97 and 97\n", "first list: Index(['Formal Diplomatic Channels', 'Develop Video-based Content',\n", " 'Determine Strategic Ends',\n", " 'Identify Social and Technical Vulnerabilities',\n", " 'Measure Effectiveness Indicators (or KPIs)',\n", " 'Leverage Existing Narratives', 'Cultivate ignorant agents',\n", " 'Traditional Media', 'Create Inauthentic Accounts',\n", " 'Merchandising/ Advertising', 'Develop Text-based Content', 'Distract',\n", " 'Purchase Targeted Advertisements', 'Reuse Existing Content',\n", " 'Co-opt Trusted Sources', 'Exploit TOS/Content Moderation',\n", " 'Degrade Adversary', 'Create hashtags and search artifacts',\n", " 'Develop Competing Narratives', 'Leverage Echo Chambers/Filter Bubbles',\n", " 'Create personas', 'Create fake experts', 'Online polls',\n", " 'Facilitate State Propaganda', 'Comment or Reply on Content', 'Email',\n", " 'Media Sharing Networks', 'Post Content',\n", " 'Encourage Attendance at Events', 'Blogging and Publishing Networks',\n", " 'Seed distortions', 'Create inauthentic websites',\n", " 'Control Information Environment through Offensive Cyberspace Operations',\n", " 'Infiltrate Existing Networks', 'Dismay',\n", " 'Employ Commercial Analytic Firms', ' Social Networks',\n", " 'Physical Violence', 'Measure Performance', 'Develop New Narratives',\n", " 'Amplify Existing Narrative', 'Flooding the Information Space',\n", " 'Deliver Ads', 'Generate information pollution', 'Organize Events',\n", " 'Prepare Assets Impersonating Legitimate Entities',\n", " 'Conceal Operational Activity',\n", " 'Map Target Audience Information Environment',\n", " 'Attract Traditional Media', 'Use Search Engine Optimization',\n", " 'Seed Kernel of truth', 'Conduct fundraising',\n", " 'Consumer Review Networks', 'Chat apps',\n", " 'Bookmarking and Content Curation', 'Prepare fundraising campaigns',\n", " 'Suppress Opposition', 'Obtain Private Documents',\n", " 'Compromise legitimate accounts',\n", " 'Direct Users to Alternative Platforms', 'Conceal Infrastructure',\n", " 'Acquire/ recruit Network', 'Leverage Content Farm', 'Distort facts',\n", " 'Harass', 'Integrate Target Audience Vulnerabilities into Narrative',\n", " 'Bait legitimate influencers', 'Discussion Forums',\n", " 'Create Inauthentic Social Media Pages and Groups', 'Cross-Posting',\n", " 'Segment Audiences', 'Create Clickbait', 'Develop Owned Media Assets',\n", " 'Develop Image-based Content', 'Dismiss',\n", " 'Respond to Breaking News Event or Active Crisis',\n", " 'Determine Target Audiences',\n", " 'Censor social media as a political force', 'Platform Filtering',\n", " 'Conceal People', 'Livestream', 'Play the long game',\n", " 'Use fake experts', 'Prepare Physical Broadcast Capabilities',\n", " 'Manipulate Platform Algorithm', 'Incentivize Sharing',\n", " 'Create Localized Content', 'Establish Inauthentic News Sites',\n", " 'Demand insurmountable proof', 'Trial content', 'Divide',\n", " 'Measure Effectiveness', 'Develop Audio-based Content',\n", " 'Leverage Conspiracy Theory Narratives', 'Distort',\n", " 'Recruit bad actors', 'Build Network'],\n", " dtype='object')\n", "second list: Index(['Conceal Operational Activity',\n", " 'Identify Social and Technical Vulnerabilities',\n", " 'Flooding the Information Space', ' Social Networks',\n", " 'Conceal Infrastructure', 'Segment Audiences', 'Conceal People',\n", " 'Map Target Audience Information Environment', 'Measure Effectiveness',\n", " 'Create Inauthentic Accounts', 'Develop Image-based Content',\n", " 'Control Information Environment through Offensive Cyberspace Operations',\n", " 'Harass', 'Reuse Existing Content', 'Suppress Opposition',\n", " 'Post Content', 'Media Sharing Networks', 'Develop Text-based Content',\n", " 'Recruit bad actors', 'Measure Performance',\n", " 'Leverage Echo Chambers/Filter Bubbles', 'Build Network',\n", " 'Co-opt Trusted Sources', 'Obtain Private Documents', 'Cross-Posting',\n", " 'Traditional Media', 'Physical Violence',\n", " 'Establish Inauthentic News Sites', 'Organize Events',\n", " 'Generate information pollution', 'Incentivize Sharing', 'Deliver Ads',\n", " 'Livestream', 'Prepare Assets Impersonating Legitimate Entities',\n", " 'Measure Effectiveness Indicators (or KPIs)',\n", " 'Develop Video-based Content', 'Acquire/ recruit Network',\n", " 'Prepare fundraising campaigns', 'Chat apps',\n", " 'Develop Audio-based Content', 'Infiltrate Existing Networks',\n", " 'Encourage Attendance at Events',\n", " 'Leverage Conspiracy Theory Narratives', 'Distort facts',\n", " 'Leverage Content Farm', 'Exploit TOS/Content Moderation',\n", " 'Conduct fundraising', 'Create personas', 'Create fake experts',\n", " 'Manipulate Platform Algorithm', 'Discussion Forums',\n", " 'Merchandising/ Advertising', 'Dismiss', 'Comment or Reply on Content',\n", " 'Determine Strategic Ends', 'Create inauthentic websites',\n", " 'Seed distortions', 'Cultivate ignorant agents',\n", " 'Facilitate State Propaganda', 'Dismay', 'Platform Filtering',\n", " 'Trial content', 'Amplify Existing Narrative', 'Degrade Adversary',\n", " 'Direct Users to Alternative Platforms', 'Develop New Narratives',\n", " 'Formal Diplomatic Channels', 'Leverage Existing Narratives',\n", " 'Distract', 'Create Inauthentic Social Media Pages and Groups',\n", " 'Bait legitimate influencers',\n", " 'Integrate Target Audience Vulnerabilities into Narrative',\n", " 'Employ Commercial Analytic Firms', 'Create Clickbait', 'Email',\n", " 'Compromise legitimate accounts', 'Bookmarking and Content Curation',\n", " 'Consumer Review Networks', 'Create Localized Content',\n", " 'Blogging and Publishing Networks', 'Divide',\n", " 'Demand insurmountable proof',\n", " 'Respond to Breaking News Event or Active Crisis',\n", " 'Prepare Physical Broadcast Capabilities', 'Use fake experts',\n", " 'Play the long game', 'Purchase Targeted Advertisements',\n", " 'Develop Owned Media Assets',\n", " 'Censor social media as a political force',\n", " 'Determine Target Audiences', 'Seed Kernel of truth',\n", " 'Use Search Engine Optimization', 'Online polls',\n", " 'Develop Competing Narratives', 'Create hashtags and search artifacts',\n", " 'Distort', 'Attract Traditional Media'],\n", " dtype='object')\n", "set difference: set()\n", "null ids: Empty DataFrame\n", "Columns: [DISARM Technique, DISARM Subtechnique, Description, DISARM ID]\n", "Index: []\n", "repeated ids: Empty DataFrame\n", "Columns: [index, DISARM ID]\n", "Index: []\n" ] } ], "source": [ "check_diffs(techs['DISARM Technique'], df['DISARM Technique'])\n", "check_ids(techs)\n", "#techs.to_csv('temp_techs.csv', index=False)" ] }, { "cell_type": "code", "execution_count": 8, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
DISARM SubtechniqueDescriptionDISARM ID
4Discredit Credible SourcesPlan to delegitimize the media landscape and d...ST0001
5Monitor Social Media AnalyticsAn influence operation may use social media an...ST0002
6Evaluate Media SurveysAn influence operation may evaluate its own or...ST0003
7Identify Trending Topics/HashtagsAn influence operation may identify trending h...ST0004
8Conduct Web Traffic AnalysisAn influence operation may conduct web traffic...ST0005
............
159AwarenessNaNST0155
160KnowledgeNaNST0156
161Action/attitudeNaNST0157
162Message reachMonitor and evaluate message reach in misinfor...ST0158
163Social media engagementMonitor and evaluate social media engagement i...ST0159
\n", "

160 rows × 3 columns

\n", "
" ], "text/plain": [ " DISARM Subtechnique \\\n", "4 Discredit Credible Sources \n", "5 Monitor Social Media Analytics \n", "6 Evaluate Media Surveys \n", "7 Identify Trending Topics/Hashtags \n", "8 Conduct Web Traffic Analysis \n", ".. ... \n", "159 Awareness \n", "160 Knowledge \n", "161 Action/attitude \n", "162 Message reach \n", "163 Social media engagement \n", "\n", " Description DISARM ID \n", "4 Plan to delegitimize the media landscape and d... ST0001 \n", "5 An influence operation may use social media an... ST0002 \n", "6 An influence operation may evaluate its own or... ST0003 \n", "7 An influence operation may identify trending h... ST0004 \n", "8 An influence operation may conduct web traffic... ST0005 \n", ".. ... ... \n", "159 NaN ST0155 \n", "160 NaN ST0156 \n", "161 NaN ST0157 \n", "162 Monitor and evaluate message reach in misinfor... ST0158 \n", "163 Monitor and evaluate social media engagement i... ST0159 \n", "\n", "[160 rows x 3 columns]" ] }, "execution_count": 8, "metadata": {}, "output_type": "execute_result" } ], "source": [ "subs = df[['DISARM Subtechnique', 'Description', 'DISARM ID']]\n", "subs = subs[subs['DISARM Subtechnique'].notnull()]\n", "subs" ] }, { "cell_type": "code", "execution_count": 9, "metadata": { "scrolled": true }, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 159 and 159\n", "first list: Index(['Conceal Network Identity', 'Message reach', 'View Focused',\n", " 'Create dedicated hashtag', 'Create Echo Chambers/Filter Bubbles',\n", " 'Aggregate Information into Evidence Collages', 'Astroturfing',\n", " 'Leak Authentic Documents', 'Utilize Butterfly Attack', 'Awareness',\n", " ...\n", " 'Conceal Sponsorship', 'Evaluate Media Surveys', 'Utilize Spamoflauge',\n", " 'Traditional Media', 'Enlist Troll Accounts', 'Geographic Segmentation',\n", " 'Post Across Platform', 'Create Sockpuppet Accounts', 'Fund Proxies',\n", " 'Hijack existing hashtag'],\n", " dtype='object', length=159)\n", "second list: Index(['Conceal Network Identity', 'Message reach', 'View Focused',\n", " 'Create dedicated hashtag', 'Create Echo Chambers/Filter Bubbles',\n", " 'Aggregate Information into Evidence Collages', 'Astroturfing',\n", " 'Leak Authentic Documents', 'Utilize Butterfly Attack', 'Awareness',\n", " ...\n", " 'Conceal Sponsorship', 'Evaluate Media Surveys', 'Utilize Spamoflauge',\n", " 'Traditional Media', 'Enlist Troll Accounts', 'Geographic Segmentation',\n", " 'Post Across Platform', 'Create Sockpuppet Accounts', 'Fund Proxies',\n", " 'Hijack existing hashtag'],\n", " dtype='object', length=159)\n", "set difference: set()\n", "null ids: Empty DataFrame\n", "Columns: [DISARM Subtechnique, Description, DISARM ID]\n", "Index: []\n", "repeated ids: index DISARM ID\n", "0 ST0040 2\n" ] } ], "source": [ "check_diffs(subs['DISARM Subtechnique'], df['DISARM Subtechnique'])\n", "check_ids(subs)" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "# check against originals" ] }, { "cell_type": "code", "execution_count": 10, "metadata": {}, "outputs": [ { "data": { "text/plain": [ "dict_keys(['ADMIN_README', 'ADMIN CODES', 'phases', 'tactics', 'techniques', 'countermeasures', 'frameworks', 'tasks', 'detections', 'playbooks', 'responsetypes', 'metatechniques', 'actortypes', 'actortype_framework', 'actortype_sector', 'sectors', 'resources', 'MOE', 'MOP'])" ] }, "execution_count": 10, "metadata": {}, "output_type": "execute_result" } ], "source": [ "MASTERDATA_DIR = '../DISARM_MASTER_DATA/'\n", "frameworkfile = MASTERDATA_DIR + 'DISARM_FRAMEWORKS_MASTER.xlsx'\n", " \n", "metadata = {}\n", "xlsx = pd.ExcelFile(frameworkfile)\n", "for sheetname in xlsx.sheet_names:\n", " metadata[sheetname] = xlsx.parse(sheetname)\n", " metadata[sheetname].fillna('', inplace=True)\n", "metadata.keys()" ] }, { "cell_type": "code", "execution_count": 11, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
disarm_idnamename_DEranksummarysummary_DElongname
0P01PlanPlanung1Envision the desired outcome. Lay out effectiv...P01 - Plan
1P02PrepareVorbereitung2Activities conducted before execution to impro...P02 - Prepare
2P03ExecuteDurchführung3Run the action, from initial exposure to wrap-...P03 - Execute
3P04AssessAuswertung4Evaluate effectiveness of action, for use in f...P04 - Assess
\n", "
" ], "text/plain": [ " disarm_id name name_DE rank \\\n", "0 P01 Plan Planung 1 \n", "1 P02 Prepare Vorbereitung 2 \n", "2 P03 Execute Durchführung 3 \n", "3 P04 Assess Auswertung 4 \n", "\n", " summary summary_DE longname \n", "0 Envision the desired outcome. Lay out effectiv... P01 - Plan \n", "1 Activities conducted before execution to impro... P02 - Prepare \n", "2 Run the action, from initial exposure to wrap-... P03 - Execute \n", "3 Evaluate effectiveness of action, for use in f... P04 - Assess " ] }, "execution_count": 11, "metadata": {}, "output_type": "execute_result" } ], "source": [ "metadata['phases']" ] }, { "cell_type": "code", "execution_count": 12, "metadata": {}, "outputs": [ { "data": { "text/html": [ "
\n", "\n", "\n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", " \n", "
DISARM PhaseDISARM TacticDescriptionDISARM ID
0PlanNaNEnvision the desired outcome. Lay out effectiv...P01
1PrepareNaNActivities conducted before execution to impro...P02
2ExecuteNaNRun the action, from initial exposure to wrap-...P03
3AssessNaNAssess effectiveness of action, for use in fut...P04
\n", "
" ], "text/plain": [ " DISARM Phase DISARM Tactic \\\n", "0 Plan NaN \n", "1 Prepare NaN \n", "2 Execute NaN \n", "3 Assess NaN \n", "\n", " Description DISARM ID \n", "0 Envision the desired outcome. Lay out effectiv... P01 \n", "1 Activities conducted before execution to impro... P02 \n", "2 Run the action, from initial exposure to wrap-... P03 \n", "3 Assess effectiveness of action, for use in fut... P04 " ] }, "execution_count": 12, "metadata": {}, "output_type": "execute_result" } ], "source": [ "phases" ] }, { "cell_type": "code", "execution_count": 13, "metadata": {}, "outputs": [], "source": [ "# do union of both tables, to get new spreadsheet table\n" ] }, { "cell_type": "code", "execution_count": 14, "metadata": {}, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 4 and 4\n", "first list: Index(['Prepare', 'Execute', 'Plan', 'Assess'], dtype='object')\n", "second list: Index(['Prepare', 'Execute', 'Plan', 'Assess'], dtype='object')\n", "set difference: set()\n" ] } ], "source": [ "check_diffs(metadata['phases']['name'], phases['DISARM Phase'])" ] }, { "cell_type": "code", "execution_count": 15, "metadata": { "scrolled": true }, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 13 and 16\n", "first list: Index(['Drive Offline Activity', 'Objective Planning',\n", " 'Conduct Center of Gravity Analysis', 'Persistence', 'Develop Networks',\n", " 'Microtargeting', 'Channel Selection', 'Develop People', 'Pump Priming',\n", " 'Exposure', 'Strategic Planning', 'Develop Content',\n", " 'Measure Effectiveness'],\n", " dtype='object')\n", "second list: Index(['Drive Offline Activity', 'Plan Objectives', 'Conduct Pump Priming',\n", " 'Maximize Exposure', 'Target Audience Analysis', 'Microtarget',\n", " 'Establish Social Assets', 'Establish Legitimacy', 'Deliver Content',\n", " 'Select Channels and Affordances', 'Plan Strategy', 'Develop Content',\n", " 'Drive Online Harms', 'Persist in the Information Space',\n", " 'Develop Narratives', 'Assess Effectiveness'],\n", " dtype='object')\n", "set difference: {'Measure Effectiveness', 'Channel Selection', 'Strategic Planning', 'Pump Priming', 'Develop People', 'Microtargeting', 'Exposure', 'Develop Networks', 'Persistence', 'Conduct Center of Gravity Analysis', 'Objective Planning'}\n" ] } ], "source": [ "check_diffs(metadata['tactics']['name'], tactics['DISARM Tactic'])" ] }, { "cell_type": "code", "execution_count": 16, "metadata": { "scrolled": true }, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "lengths are: 71 and 97\n", "first list: Index(['Twitter bots amplify', 'Create fake experts', 'Twitter',\n", " 'Degrade adversary', 'Use concealment',\n", " 'Muzzle social media as a political force',\n", " 'Fabricate social media comment', 'Social media engagement',\n", " 'Analyze existing communities', 'Cultivate ignorant agents',\n", " 'Create fake videos and images', 'Distort facts',\n", " 'Respond to active crisis', 'Kernel of Truth', 'Deny involvement',\n", " 'Create hashtags', 'Tertiary sites amplify news',\n", " 'Use SMS/ WhatsApp/ Chat apps', 'LinkedIn', 'Continue to amplify',\n", " 'Backstop personas', 'Leverage Existing Narratives',\n", " 'Legacy web content', 'YouTube', 'Use physical broadcast capabilities',\n", " 'Create fake Social Media Profiles / Pages / Groups',\n", " 'Adapt existing narratives', 'Use hashtag', 'Play the long game',\n", " 'Generate information pollution', 'Develop Narrative Concepts',\n", " 'Segment audiences', 'Facilitate State Propaganda',\n", " 'Dedicated channels disseminate information pollution',\n", " 'Leak altered documents', 'Demand unsurmountable proof',\n", " 'Cow online opinion leaders', 'Plan to discredit credible sources',\n", " 'Create fake or imposter news sites', 'Create competing narratives',\n", " 'Devise Competing Narratives', 'Manipulate online polls',\n", " 'Behaviour changes', 'Reddit', 'Flooding',\n", " 'Prepare fundraising campaigns', 'Search Engine Optimization',\n", " 'Respond to breaking news event', 'Bait legitimate influencers',\n", " 'Cheerleading domestic social media ops',\n", " 'Create pseudoscientific or disingenuous research',\n", " 'Purchase advertisements', 'Conspiracy narratives', 'Use fake experts',\n", " 'Pinterest', 'Create fake websites', 'Clickbait', 'Trial content',\n", " '5Ds (dismiss, distort, distract, dismay, divide)', 'Facebook',\n", " 'Conduct Fundraising Campaigns', 'WhatsApp', 'Memes', 'Instagram',\n", " 'Find echo chambers', 'Twitter trolls amplify and manipulate',\n", " 'Seed distortions', 'Organise remote rallies and events',\n", " 'Sell merchandising', 'Message reach', 'Compromise legitimate account'],\n", " dtype='object')\n", "second list: Index(['Formal Diplomatic Channels', 'Develop Video-based Content',\n", " 'Determine Strategic Ends',\n", " 'Identify Social and Technical Vulnerabilities',\n", " 'Measure Effectiveness Indicators (or KPIs)',\n", " 'Leverage Existing Narratives', 'Cultivate ignorant agents',\n", " 'Traditional Media', 'Create Inauthentic Accounts',\n", " 'Merchandising/ Advertising', 'Develop Text-based Content', 'Distract',\n", " 'Purchase Targeted Advertisements', 'Reuse Existing Content',\n", " 'Co-opt Trusted Sources', 'Exploit TOS/Content Moderation',\n", " 'Degrade Adversary', 'Create hashtags and search artifacts',\n", " 'Develop Competing Narratives', 'Leverage Echo Chambers/Filter Bubbles',\n", " 'Create personas', 'Create fake experts', 'Online polls',\n", " 'Facilitate State Propaganda', 'Comment or Reply on Content', 'Email',\n", " 'Media Sharing Networks', 'Post Content',\n", " 'Encourage Attendance at Events', 'Blogging and Publishing Networks',\n", " 'Seed distortions', 'Create inauthentic websites',\n", " 'Control Information Environment through Offensive Cyberspace Operations',\n", " 'Infiltrate Existing Networks', 'Dismay',\n", " 'Employ Commercial Analytic Firms', ' Social Networks',\n", " 'Physical Violence', 'Measure Performance', 'Develop New Narratives',\n", " 'Amplify Existing Narrative', 'Flooding the Information Space',\n", " 'Deliver Ads', 'Generate information pollution', 'Organize Events',\n", " 'Prepare Assets Impersonating Legitimate Entities',\n", " 'Conceal Operational Activity',\n", " 'Map Target Audience Information Environment',\n", " 'Attract Traditional Media', 'Use Search Engine Optimization',\n", " 'Seed Kernel of truth', 'Conduct fundraising',\n", " 'Consumer Review Networks', 'Chat apps',\n", " 'Bookmarking and Content Curation', 'Prepare fundraising campaigns',\n", " 'Suppress Opposition', 'Obtain Private Documents',\n", " 'Compromise legitimate accounts',\n", " 'Direct Users to Alternative Platforms', 'Conceal Infrastructure',\n", " 'Acquire/ recruit Network', 'Leverage Content Farm', 'Distort facts',\n", " 'Harass', 'Integrate Target Audience Vulnerabilities into Narrative',\n", " 'Bait legitimate influencers', 'Discussion Forums',\n", " 'Create Inauthentic Social Media Pages and Groups', 'Cross-Posting',\n", " 'Segment Audiences', 'Create Clickbait', 'Develop Owned Media Assets',\n", " 'Develop Image-based Content', 'Dismiss',\n", " 'Respond to Breaking News Event or Active Crisis',\n", " 'Determine Target Audiences',\n", " 'Censor social media as a political force', 'Platform Filtering',\n", " 'Conceal People', 'Livestream', 'Play the long game',\n", " 'Use fake experts', 'Prepare Physical Broadcast Capabilities',\n", " 'Manipulate Platform Algorithm', 'Incentivize Sharing',\n", " 'Create Localized Content', 'Establish Inauthentic News Sites',\n", " 'Demand insurmountable proof', 'Trial content', 'Divide',\n", " 'Measure Effectiveness', 'Develop Audio-based Content',\n", " 'Leverage Conspiracy Theory Narratives', 'Distort',\n", " 'Recruit bad actors', 'Build Network'],\n", " dtype='object')\n", "set difference: {'Backstop personas', 'YouTube', 'Create fake Social Media Profiles / Pages / Groups', 'Use physical broadcast capabilities', 'Social media engagement', 'Continue to amplify', 'Develop Narrative Concepts', 'Segment audiences', 'Conspiracy narratives', 'Dedicated channels disseminate information pollution', 'Use SMS/ WhatsApp/ Chat apps', 'Tertiary sites amplify news', 'Twitter', 'Degrade adversary', 'Use concealment', 'Muzzle social media as a political force', 'Use hashtag', 'Fabricate social media comment', 'Create fake videos and images', 'Find echo chambers', 'Respond to active crisis', 'Kernel of Truth', 'Deny involvement', 'Create hashtags', 'Legacy web content', 'Leak altered documents', 'LinkedIn', 'Demand unsurmountable proof', 'Search Engine Optimization', 'Pinterest', 'Respond to breaking news event', '5Ds (dismiss, distort, distract, dismay, divide)', 'Clickbait', 'Create pseudoscientific or disingenuous research', 'Facebook', 'Conduct Fundraising Campaigns', 'WhatsApp', 'Sell merchandising', 'Organise remote rallies and events', 'Analyze existing communities', 'Message reach', 'Plan to discredit credible sources', 'Instagram', 'Compromise legitimate account', 'Cow online opinion leaders', 'Create fake or imposter news sites', 'Flooding', 'Create competing narratives', 'Behaviour changes', 'Devise Competing Narratives', 'Twitter bots amplify', 'Manipulate online polls', 'Reddit', 'Twitter trolls amplify and manipulate', 'Adapt existing narratives', 'Cheerleading domestic social media ops', 'Create fake websites', 'Purchase advertisements', 'Memes'}\n" ] } ], "source": [ "check_diffs(metadata['techniques']['name'], techs['DISARM Technique'])" ] }, { "cell_type": "code", "execution_count": null, "metadata": {}, "outputs": [], "source": [] }, { "cell_type": "code", "execution_count": null, "metadata": {}, "outputs": [], "source": [] } ], "metadata": { "kernelspec": { "display_name": "Python 3", "language": "python", "name": "python3" }, "language_info": { "codemirror_mode": { "name": "ipython", "version": 3 }, "file_extension": ".py", "mimetype": "text/x-python", "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", "version": "3.8.3" } }, "nbformat": 4, "nbformat_minor": 4 }