Detecting Cybersecurity Events from Noisy Short Text

Abstract

It is very critical to analyze messages shared over social networks for cyber threat intelligence and cyber-crime prevention. In this study, we propose a method that leverages both domain-specific word embeddings and task-specific features to detect cyber security events from tweets. Our model employs a convolutional neural network (CNN) and a long short-term memory (LSTM) recurrent neural network which takes word level metaembeddings as inputs and incorporates contextual embeddings to classify noisy short text. We collected a new dataset of cyber security related tweets from Twitter and manually annotated a subset of 2K of them. We experimented with this dataset and concluded that the proposed model outperforms both traditional and neural baselines. The results suggest that our method works well for detecting cyber security events from noisy short text.

Extracting Rich Semantic Information about Cybersecurity Events

“…They modeled the problem as a binary classification task and used a neural network approach. [38] also detected references to cybersecurity events from the Twitter data stream, but did not determine a specific type of cybersecurity attack. [11] proposed an analysis that annotated documents in a collection of "advanced persistent threat" (APT) reports with attribute labels from the Malware Attribute Enumeration (MAEC) vocabularies.…”

“…While [29] and [26] describe a schema and dataset similar to what we use here, their underlying schemas are not as semantically rich or detailed. [1], [6], [21], [30], [33], [38] used keyword searching on Twitter data stream to detect or predict cybersecurity events. They differ from our work, which focuses on extracting the comprehensive information about cybersecurity events.…”

Detecting Cyber Threat Event from Twitter Using IDCNN and BiLSTM

“…People also share cyber threat events in their tweets, such as zero-day exploits, ransomware, data leaks, security breaches, DDoS, vulnerabilities, etc. [4]. Twitter can thus help researchers measure the interest raised by specific topics and automatically detect some unexpected cyber threat events in real-time [5].…”