Understanding Attack Trends from Security Blog Posts Using Guided-topic Model

Abstract

Organizations are plagued by sophisticated and diversified cyber attacks. In order to prevent such attacks, it is necessary to understand threat trends and to take measures to protect their assets. Security vendors publish reports which contain threat trends or analysis of malware. These reports are useful for help in responding to a cyber security incident. However, it is difficult to collect threat information from multiple sources such as security blog posts. In this paper, we propose a method to efficiently collect information from the relationship between words using SeededLDA. In our case studies, we visualize the relationship between the words from security blog posts which were published in 2017 by eight security vendors, and demonstrate how our method helps to understand threat trends in the IoT industry and financial institutions.

Integrating Human Insights Into Text Analysis: Semi-Supervised Topic Modeling of Emerging Food-Technology Businesses’ Brand Communication on Social Media

“… b The top 20 topic words associated with the highest coefficients are listed. Consistent with previous studies (e.g., Nagai et al, 2019; Ramesh et al, 2014; Toubia et al, 2019; Watanabe & Zhou, 2020), many words derived from guided LDA were the same as seed words, but relevant topic words were also identified. The percentage of each topic under product attributes was rounded, and the sum is based on the numbers before rounding up. c The “Other” category refers to unseeded topics in our model, to account for tweets that did not fall into any classified topic.…”

“…For example, by changing seed confidence, researchers can tune their guided LDA models to classify tweets based not only on the selected seed words, but also on words’ co-occurrence patterns. Following Nagai et al’s (2019) recommendations, we set our seed confidence at .7, but future studies could usefully explore the potential impact of other seed-confidence levels on model performance.…”

“…Following Nagai et al (2019), we set the parameters as .01 for α and .01 for η, which are respectively Dirichlet priors on the per-document-topic distribution and per-topic word distribution (Gangadharan & Gupta, 2020). Meanwhile, seed confidence, that is, the probability of biasing the selection of seed-word distribution, was set at .7 (Nagai et al, 2019). Researchers running guided LDA models have included topics in addition to the number of identified seeded topics (i.e., 12, in this case) to cover documents that did not fall under any of the latter (e.g., Li et al, 2019; Ramesh et al, 2014; Shanthakumar et al, 2020), and we followed this practice as well.…”

“…Step 4: Running the Guided LDA Model We used the GuidedLDA package in Python to run guided topic modeling. Following Nagai et al (2019), we set the parameters as .01 for α and .01 for η, which are respectively Dirichlet priors on the per-document-topic distribution and per-topic word distribution (Gangadharan & Gupta, 2020). Meanwhile, seed confidence, that is, the probability of biasing the selection of seed-word distribution, was set at .7 (Nagai et al, 2019).…”