Mining user interaction patterns in the darkweb to predict enterprise cyber incidents

Abstract

With rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real world organization cyber attacks of 3 different security events, suggest that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks.

Modeling and management of cyber risk: a cross-disciplinary review

“…Similarly, Sarkar et al (2019) predict cyber incidents by leveraging the reply network structure of user interactions on the dark web hacker forums. The authors use 280 incidents records from Armstrong Corporation with attributes of event type and date of occurrence, and data from 53 forums on the dark web over a similar time period.…”

Prompt-Based Learning for Thread Structure Prediction in Cybersecurity Forums

“…There are two network representations introduced [13] for building the social network in forums: Creator-oriented Network and Last Reply-oriented Network. The Last Reply-oriented Network is widely used for the social network analysis in the recent works [21,1,14,23,20,11]. Fig.…”

Extração e Análise de Indicadores de Comprometimento (IoCs) em Fóruns da Dark Web

“…Já [Sarkar et al 2019] usaram informac ¸ões de fóruns da Dark Web aproveitando a estrutura de rede de respostas das interac ¸ões do usuário com o objetivo de prever ataques cibernéticos corporativos. O sistema tenta prever se haverá um ataque cibernético em um determinado dia para uma organizac ¸ão, para isso aplica modelos de aprendizado supervisionado em um conjunto de recursos extraído dos fóruns.…”

“…Nos últimos anos, diversos estudos têm se concentrado na identificac ¸ão de ameac ¸as de seguranc ¸a a partir da análise de conteúdo presente em fóruns da Dark Web [Sapienza et al 2017], [Dong et al 2018] e [Sarkar et al 2019]. Com relac ¸ão à análise e extrac ¸ão de IoCs, [Niakanlahiji et al 2019] investigam a existência de IoCs no Twitter, enquanto que [Zhang et al 2019] extraem IoCs realizando buscas na Surface Web, usando como entrada indicadores como domínios e enderec ¸os IP que tenham sido considerados suspeitos de acordo com informac ¸ões de ameac ¸as de código aberto.…”