Hacker Forum Exploit and Classification for Proactive Cyber Threat Intelligence

Gautam, Apurv Singh; Gahlot, Yamini; Kamat, Pooja

doi:10.1007/978-3-030-33846-6_32

Cited by 12 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…According to the testing findings, the model could more effectively and accurately identify organizations, HackerIds, software, tools along with other things in the conversations of dark web forums. Apurv Singh Gautam et al [23] proposed a model that uses deep learning and machine learning techniques to automatically categorized hacker forum information into predetermined groups and create dynamic illustrations that allow CTI professionals to explore gathered data for diligent and appropriate CTI. According to the study's findings, the deep learning model RNN GRU produces the best classification outcomes of all the models.…”

Section: International Journal On Recent and Innovation Trends In Com...mentioning

confidence: 99%

Snowball-Miner: Integration of Deep Learning for Extraction of Cyber Threat Intelligence from Dark Web

Abir Dutta

2023

IJRITCC

View full text Add to dashboard Cite

In Cyber threat intelligence is a crucial component in defending against cybersecurity threats. Cyber security dark web, security Blogs, Hackers’ community, news forums, Open-Source Intelligence (OSINT) are known as the harbor of illicit activities and serve as a breeding ground for cybercriminals. Extracting actionable intelligence from the dark web is challenging due to its anonymous and encrypted nature. State-of-art work proposed machine learning and deep learning approach to aggregate the dark web for cyber threat intelligence from data present in the dark web. This paper proposes, a novel approach utilizing Snowball-Miner for cyber threat intelligence discovery from the dark web. The model is trained on a diverse dataset consisting of dark web forums, hidden .onion based marketplaces and other underground platforms using Snowball-crawler. However, we have employed hybrid convolutional model CNN-LSTM and CNN-GRU adopting doc2vec word embedding to classify into four domains viz Energy Sector, Finance, Illicit Activities and illegal Services. From our experiment it emerged that, CNN-LSTM outperforms as 96.37% for classification of domain specific threat documents. Furthermore, after data preparation we implemented NLP technique and extracted the domain specific Indicator of Compromise (IoCs) using RegEx parser and Subject, Object and Verb (SOV) semantics dependency analysis. Finally, we have integrated IoCs and Threat keywords with respective domains to generate domain specific threat intelligence which enhance the quality of the domain specific CTI based on R-dimension (Relevance).

show abstract

Section: International Journal On Recent and Innovation Trends In Com...mentioning

confidence: 99%

Snowball-Miner: Integration of Deep Learning for Extraction of Cyber Threat Intelligence from Dark Web

Abir Dutta

2023

IJRITCC

View full text Add to dashboard Cite

show abstract

“…In [8], a classification of CTI data originating from hacker forums was performed using two different variants of Recurrent Neural Networks (RNNs). The data were classified, using specialised web crawlers, into relevant or irrelevant.…”

Section: Related Workmentioning

confidence: 99%

Towards Continuous Enrichment of Cyber Threat Intelligence: A Study on a Honeypot Dataset

Spyros

Papoutsis

Koritsas

et al. 2022

2022 IEEE International Conference on Cyber Security and Resilience (CSR)

View full text Add to dashboard Cite

Cyber Threat Intelligence helps organisations make the right decisions in their fight against cyber threats and strategically design their defences by continuously providing information regarding the cyber threat landscape. In this context, honeypots are a widespread solution for gathering intelligence about threat actors. However, honeypots do not inherently provide information about the origin of threat groups, their resources, capabilities and their impact. Thus, we propose an approach that classifies threats, as highly or less abusive, based on their behaviour characteristics using four ensemble machine learning algorithms applied on security incidents identified in a rule-based manner on a deployed honeypot. After prepossessing and hyper-tuning of the parameters, the four models, Adaptive Boosting Classifier (AdaBoost), Random Forest Classifier (RFC), Light Gradient Boosting Machine (LGBM) and Extreme Gradient Boosting (XGBoost), achieve good results, with RFC and LGBM achieving the best recall (84%, 83%) and LGBM and XGB the best AUC (91%, 90%).

show abstract

“…To best obscure one's communication, one would want to pipe communications and connections through a lot of different servers, to make it harder to trace. Alternative communication platforms that have had documented use are invite-only, private forums (P. Gautam, Gahlot, and Kamat 2019;J. Shakarian, Gunn, and Shakarian 2016;Ablon, Libicki, and Golay 2014) and Telegram, an encrypted communication platform (Check Point 2019).…”

Section: Botnet Deploymentmentioning

confidence: 99%

Evaluating Criminal Transactional Methods in Cyberspace as Understood in an International Context

et al. 2021

View full text Add to dashboard Cite

McMurdie 2016), due to the quickly-evolving and vast nature of these crimes (Holt 2018), which typically involve more effort and cross-border expense and access difficulties than do most offline crimes in the Pursue mode. Policing has been slow to adjust to the rise of digital crimes and fraud, not least because it often means giving up functions currently performed, which meet resistance (HMICFRS 2019a(HMICFRS , 2019b."Effectiveness" in policing cybercrime needs to be clearly defined and should be seen on a spectrum. The evolution of cybercrime and cyber offender strategies is fast paced, making studying and reporting on them a difficult task. In addition to this challenge, the vast majority of research is undertaken, produced, and disseminated in English and focuses on a minority of sites where actively publishing western academics are based (Cross 2018).Yet, the scope of cyber offenders, their involvement in a range of illegal activities, and the costs of policing cyber offenders, stemming from cross-jurisdictional offences, generate serious concerns for law enforcement agencies throughout the world (Carroll and Windle 2018; Gilmour 2014; Malby et al. 2013). However, little is known about the attitudes of law enforcement towards cyber offenders in those countries in which statesponsored and state-tolerated cyber offending occurs: it is simply assumed or inferred from unsuccessful pursuit that little is being done there, at least until they victimise their local populations, setting aside often well-informed and severe reactions to those deemed to be "political opponents" or acting without authorisation from those in power. Cyber offenders operate broadly across borders, creating mutual legal assistance problems, which arise from variation in legal definitions provided by different statutes (Harkin, Whelan, and Chang 2018; McMurdie 2016) as well as institutional problems of conflicting priorities even where the offenders are not statesponsored or state-tolerated/corruptors. Except where political pressure or comity can be applied from abroad, enforcement agencies generally prioritise their domestic cases over international ones. As a result, cyber offenders encounter police services that differ in their approaches for detecting, investigating, and disrupting incidents associated with cyber offenders and their collaborators/competitors. These discrepancies, in turn, lead to uncertainties about the use of disruption strategies and their effectiveness, particularly in cross-border contexts, in addition to any uncertainties for evaluations arising from uneven but generally poor data availability.With limited resources and expertise, especially in opportunity principle countries where discretion is formally allowed, 1 law enforcement must make explicit or implicit strategic decisions in its approach, focusing on what it believes will yield the largest impacts while working within the political and economic constraints of its local CrimRxiv Evaluating Criminal Transactional Methods in Cyberspace as Understood in...

show abstract

Hacker Forum Exploit and Classification for Proactive Cyber Threat Intelligence

Cited by 12 publications

References 10 publications

Snowball-Miner: Integration of Deep Learning for Extraction of Cyber Threat Intelligence from Dark Web

Snowball-Miner: Integration of Deep Learning for Extraction of Cyber Threat Intelligence from Dark Web

Towards Continuous Enrichment of Cyber Threat Intelligence: A Study on a Honeypot Dataset

Evaluating Criminal Transactional Methods in Cyberspace as Understood in an International Context

Contact Info

Product

Resources

About