Social Media Monitoring
Brand Impersonation Detection
A production module inside a Security Command Center (SCC) platform that watches social media for accounts and posts impersonating the organization's brands — fake support handles, scam giveaways, lookalike profiles — scores each one with an AI reasoning agent, groups related activity into campaigns, and feeds confirmed impersonations straight into the takedown queue.
// Overview
What it does. Attackers routinely spin up fake social-media accounts that impersonate a company's brands to run scams, phishing, and fraudulent "official" promotions. The volume is huge and most flagged posts are harmless — a fan account, an unrelated mention, the brand's own official page. This module ingests social-media alerts, then for each one decides the question a human analyst would: is this our official account, a harmless mention, or a malicious impersonation / scam? It reads the post text and its images, consults a curated brand knowledge base, and returns a structured verdict (impersonation / scam / official / related / unrelated / suspicious) with probability scores, supporting keywords, and sentiment. Related malicious posts are clustered into campaigns so analysts see a coordinated operation as one case instead of a hundred loose rows, and confirmed impersonations flow into the takedown pipeline.
// Background
The challenge
Thousands of social-media alerts per day — genuine
impersonations buried, coordinated attacks invisible.
Volume buried the signal
Keyword feeds surfaced thousands of posts; genuine
impersonations got lost in fan accounts and brand content.
Real threats hidden in a sea of noise
The judgment is genuinely hard
Telling an official account from a convincing impersonation
needs brand context — handles, logos, tone — not keywords.
Text alone can't make this call
Images carried the scam
Much of the fraud lived in the picture — fake promo
banners, cloned logos; text-only triage missed it.
Visual fraud invisible to text-only filters
Coordinated campaigns looked like noise
A single actor running dozens of lookalike accounts
appeared as disconnected alerts; no operation view.
One campaign, a hundred unlinked alerts
Net effect
Analysts were hand-reviewing a keyword firehose
with no multimodal tools and no campaign view.
// Solution
Social media triage — multimodal agent + campaign clustering
Data sources
Brand-protection feed
commercial brand-mention alerts
ingest → raw landing
Brand knowledge base
handles · products · cases
Qdrant vector index
Pipeline
Ingest
Airflow · ingest
raw landing
Ingest
Classify
BERT
Ray Serve
Classify
Analyze
DSPy ReAct
text + vision
Analyze
Materialize
campaign cluster
atomic fact swap
Fact
Portal
Vue 3 + FastAPI
+ feedback
Serve
↳ other alert classes → routed to their own flows
Airflow · BERT precheck (Ray Serve) · multimodal agent (text + vision + RAG) · campaign clustering · feedback overlay
// Impact
Triage: manual → automated agent
Before · by hand
hand-review keyword firehose · text-onlyAfter · agent verdict
text + image + brand RAG → verdict6
verdict classes — explainable
Operational impact
Multimodal accuracy
image + text catches logo/banner fraud
Campaigns made visible
clusters lookalikes into one case
Grounded, explainable verdicts
brand-RAG: citable, auditable calls
Closed loop to remediation
confirmed cases → takedown queue
Non-destructive feedback
overrides kept, source data intact
Every run traced
agent steps replayable for audit
Results
Verdict classes
6
Coverage
100%
Reasoning steps
~5
Autonomous triage
24/7
Verdict · scores · keywords per
alert · campaign grouping.
// Tech Stack
| Layer | Technologies |
|---|---|
| Orchestration | Apache Airflow (ingest → precheck → analyze → fact stages), Papermill |
| Ingestion | Commercial brand-protection feed, Python requests, pandas |
| ML precheck | Fine-tuned BERT (Transformers), MLflow (champion), Ray Serve |
| Analysis agent | DSPy ReAct agent, LLM reasoning, vision LLM for image analysis, Qdrant brand-knowledge RAG tool, Laminar trace capture |
| Data store | PostgreSQL (raw landing + OLAP fact tables), psycopg / SQLAlchemy |
| Backend API | FastAPI, in-memory CacheStore, async workers |
| Frontend | Vue 3, Quasar, Vite, TypeScript, Pinia, TanStack Vue Query, ECharts |
// Architecture & Diagrams
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.