Detecting Denial-of-Service Attacks from Social Media Text: Applying NLP to Computer Security

Abstract

This paper describes a novel application of NLP models to detect denial of service attacks using only social media as evidence. Individual networks are often slow in reporting attacks, so a detection system from public data could better assist a response to a broad attack across multiple services. We explore NLP methods to use social media as an indirect measure of network service status. We describe two learning frameworks for this task: a feed-forward neural network and a partially labeled LDA model. Both models outperform previous work by significant margins (20% F1 score). We further show that the topic-based model enables the first fine-grained analysis of how the public reacts to ongoing network attacks, discovering multiple "stages" of observation. This is the first model that both detects network attacks (with best performance) and provides an analysis of when and how the public interprets service outages. We describe the models, present experiments on the largest twitter DDoS corpus to date, and conclude with an analysis of public reactions based on the learned model's output.

Comprehensive Review of Artificial Intelligence and Statistical Approaches in Distributed Denial of Service Attack and Defense Methods

“…• Neural networks classifier is used to (1) early detect and recognize DDoS attack of a traditional IDS as in [66] work that proposes rationale of time delay neural network for this purpose; (2) detect and defense against DDoS attack by a lightweight trainable method as in [67] and (3) automatically detect and classify DDoS attack and measure network service condition of social media servers as in [69].…”

“…Chambers et al [69], propose an innovative NLP neural network model application to detect DDoS attacks by only using social media as support. Private networks are generally slow in reporting attacks.…”

A New Text Classification Model Based on Contrastive Word Embedding for Detecting Cybersecurity Intelligence in Twitter

“…For the weakly supervised learning, they have annotated tweets containing the keyword "DDoS" out of the tweets written on the dates when the DDos attacks occurred as cybersecurity intelligence (CSI)-positive tweet data. Chambers et al have proposed a framework to analyze the DDoS attack using tweets according to the following steps: (1) collection of tweets written on the day when the DDoS attack occurred, (2) training them using the basic neural network, (3) detection of attack events from the trained model, and (4) extraction of the attack topics by analyzing the user's response to the attack using an LDA-based model [12]. Zong et al have collected tweets containing a keyword, "vulnerability", and have applied logistic regression to detect the existence of threats.…”

“…They have trained two anomaly detectors using centroid and one-class Support Vector Machine (SVM) [11]. Chambers et al have collected tweets containing the name of Distributed Denial of Service (DDoS) attacked organization and have performed time series analysis based on the frequency of tweets to forecast cyber threats [12]. Dionísio et al have collected the tweets containing cyber threat intelligence and have labeled them manually.…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…In [244] aims at the prediction of the likelihood of DDoS attacks by monitoring relevant text streams in social media, so that the level of security can be dynamic aimed at cost effectiveness. [245] aims at creating a novel application of NLP models to detect denial of service attacks using only social media as a source. It evaluates two learning algorithms for this task, both of which outperform the previous state-of-the-art techniquesa FFN and a partially labelled LDA model.…”