Presented at the 45th International Systemic Functional Congress (ISFC 2018), Boston, MA (July 2018).

In sociolinguistics, it is desirable to understand not only social-functional aspects of language, but also the broader social and behavioral landscape. In psychology, script theory posits that human behavior follows discernable patterns, or “scripts,” that represent expected procedures for social actions (Tomkins, 1978). Currently, identifying social behavior from language, i.e., recognizing the relevant script, relies on plan-based computational mechanisms that fill in rigid templates (Schank & Abelson, 1975, 2013). However, these methods are unable to represent complex interactions between linguistic features or their contextual and behavioral implications. In this paper, we present a new approach to script recognition using systemic functional grammar (SFG) (Halliday, 2003), leveraging the hierarchical structure of SFG to more accurately represent behavioral scripts and using the contextual stratum to enable reasoning about subtly different scripts. Additionally, SFG enables modeling the interactions between different aspects of a script, such as the function of linguistic observations as well as contextual knowledge regarding the reliability of that data. We apply these script recognition techniques in the complex domain of cyberattack attribution to infer the social and behavioral aspects of pending cyberattacks from diverse text sources, such as social media (e.g., Twitter), news articles, or blog posts. We will describe a unique grammar where the grammatical stratum represents cyberattack activities, and the contextual stratum describes social and behavioral aspects of an attack, such as motivation or goals, and source reliability. Using this grammar, we can infer likely characteristics of an attack, aiding cyber defenders in understanding which adversary script best describes the observations.