MUST Security Logo
MUSTSecurity

Overview

Collection

Casework

Analysis

Governance

SYSTEM STATUS
OPERATIONAL
SECURE CONN.
Privacy & Data Policy
THREAT LEVEL: LOW
2026-09-16 :: UTC

    Analysis · Agent 04

    Campaign Clustering

    Groups near-identical posts and comments so that the same message pushed by many accounts is visible as one coordinated push rather than as unrelated items.

    Simplified clustering — not a full ULTRA integration

    Items are compared one at a time against existing cluster centroids using multilingual sentence embeddings and cosine similarity. A campaign flag is a lead for an officer to verify, never a finding on its own.

    Clusters

    Distinct message groups found.

    Campaign flags

    Reached 3+ near-identical members.

    Largest cluster

    Members in the biggest group.

    Items grouped

    Total items assigned to a cluster.

    How a campaign is detected

    1. 01

      Embed

      Each flagged item is converted to a multilingual sentence vector (MiniLM), so wording differences don't hide a repeated message.

    2. 02

      Compare

      The vector is compared against every existing cluster centre. Above 0.8 cosine similarity it joins that cluster.

    3. 03

      Group

      If nothing is close enough, it starts a new cluster. The cluster centre is then re-averaged to include the new item.

    4. 04

      Flag

      Once a cluster reaches 3 members it is marked a possible campaign and surfaced to an officer.