Real-time extraction of cognitive-semantic security indicators:a natural-language-processing pipeline for anomaly-driven adaptive governance

Abstract

Relevance. Adaptive governance of the security environment under hybrid aggression depends on converting large, noisy, natural-language information flows into machine-computable indicators fast enough to act before a threat materializes. Prior cognitive-semantic models parametrize the security graph manually from expert elicitation, which does not scale to real-time monitoring. Aim. To design and validate an end-to-end natural-language-processing pipeline that automatically extracts cognitive-semantic risk indicators from a text stream, detects semantic anomalies, and drives a downstream cognitive map to produce an integral state-security indicator in near real time. Methods. The pipeline comprises a sequence of stages: ingestion and Ukrainian-language preprocessing; concept mapping onto a defined set of security concepts using term frequency–inverse document frequency (TF-IDF) semantic anchors and cosine similarity; per-concept indicator scoring combining a destructive-polarity lexicon with document volume; anomaly detection using a one-sided sliding-window z-score corroborated by an Isolation Forest; and driving a weighted cognitive map whose adjacency structure is adopted from the authors’ prior model, with an anomaly-triggered adaptive-governance response. The pipeline is exercised end-to-end on a structured demonstration corpus of Ukrainian open-source intelligence (OSINT)-style records organized into daily buckets and containing an injected combined-escalation event. Results. Concept mapping reproduced the reference labelling with a high level of agreement. Anomaly detection raised the first flag ahead of the modelled escalation peak, providing an actionable early-warning window. Driven by the extracted indicators, the cognitive map reproduced the expected divergence: without an adaptive response the integral indicator collapsed to a critically low fraction of its normative level, whereas the anomaly-triggered adaptive branch arrested the decline and recovered the system to a stable plateau. Conclusions. Automating indicator extraction closes the gap between raw information flows and the cognitive model, turning a static expert-parametrized construct into a monitoring instrument that can be updated continuously. The pipeline is modular, reproducible, and portable to an operational stream; its main dependencies are the quality of Ukrainian-language linguistic resources and the calibration of the anomaly thresholds.