Cyberattacks are becoming more sophisticated, posing even greater challenges to traditional intrusion detections methods. Failure to prevent the intrusions could jeopardise security services' credibility, including data confidentiality, integrity, and availability. Anomaly-based Intrusion Detection Systems and Signature-based Intrusion Detection Systems are two types of systems that have been proposed in the literature to detect security threats. In the current work, a taxonomy of current IDSs is presented, a review of recent works is performed, and we discuss some of the most common datasets used for evaluation. Finally, the survey concludes with a discussion of future IDS research directions and broader observations.

Formulating effective queries for retrieving domain-specific content from the Web and social media is very important for practitioners in several fields, including law enforcement analysts involved in terrorism-related investigations. Query reformulation aims at transforming the original query in such a way, so as to increase the search effectiveness by addressing the vocabulary mismatch problem. This work presents a study comparing the performance of global versus local word embeddings models when applied for query expansion. Two query expansions methods are employed (i.e., CombSum and Centroid) for defining the most similar terms to each query term, based on Glove pre-trained global embeddings and local models trained on four large-scale benchmark and one terrorism-related datasets. We assessed the performance of the global and local models on the benchmark datasets based on commonly used evaluation metrics, and performed a qualitative evaluation of the respective models on the terrorism-related dataset. Our findings indicate that the local models yield promising results on all datasets.

Nowadays, there is an increasing need for cyber security professionals to make use of tools that automatically extract Cyber Threat Intelligence (CTI) relying on information collected from relevant blogs and news sources that are publicly available. When such sources are used, an important part of the CTI extraction process is content selection, in which pages that do not contain CTI-related information should be filtered out. For this task, we apply supervised machine learning-based text classification techniques, trained on a new dataset created for the purposes of this work. Furthermore, we show in practice the importance of a good content selection process in a commonly used CTI extraction pipeline, by inspecting the results of the named entity recognition (NER) process that normally follows.