Corpus and Deep Learning Classifier for Collection of Cyber Threat Indicators in Twitter Stream

Behzadan, Vahid; Aguirre, Carlos; Bose, Avishek Joey; Hsu, William H.

doi:10.1109/bigdata.2018.8622506

Cited by 42 publications

(32 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is problematic for cybercrime research, due to the constantly changing lexicon. Behzadan et al (2018) released a tool to assist annotators in exploring Twitter data, with an annotated dataset of 21,000 tweets on cyber threats. However, this still requires manual identification of new terms.…”

Section: Cybercrime Trending Topicsmentioning

confidence: 99%

Detecting Trending Terms in Cybersecurity Forum Discussions

Hughes

Aycock²,

Caines

et al. 2020

Proceedings of the Sixth Workshop on Noisy User-Generated Text (W-Nut 2020)

View full text Add to dashboard Cite

We present a lightweight method for identifying currently trending terms in relation to a known prior of terms, using a weighted logodds ratio with an informative prior. We apply this method to a dataset of posts from an English-language underground hacking forum, spanning over ten years of activity, with posts containing misspellings, orthographic variation, acronyms, and slang. Our statistical approach supports analysis of linguistic change and discussion topics over time, without a requirement to train a topic model for each time interval for analysis. We evaluate the approach by comparing the results to TF-IDF using the discounted cumulative gain metric with human annotations, finding our method outperforms TF-IDF on information retrieval.

show abstract

Section: Cybercrime Trending Topicsmentioning

confidence: 99%

Detecting Trending Terms in Cybersecurity Forum Discussions

Hughes

Aycock²,

Caines

et al. 2020

Proceedings of the Sixth Workshop on Noisy User-Generated Text (W-Nut 2020)

View full text Add to dashboard Cite

show abstract

“…Without applying security related keywords, the crawled Twitter data would be generalized to all domains and thus the result would be biased to detecting general kind of events. This datasets was manually annotated whether the tweets are relevant to cyber security or not by taking help from four annotators for our earlier work [25]. Although we used security related keywords for crawling the Twitter data, many of those tweets are irrelevant or promotional.…”

Section: A Tweet Collection and Early Annotationmentioning

confidence: 99%

“…Passive monitoring here refers to collecting intelligence and solutions of different cyber threats from different platforms using only text corpora and lists of named entities or keywords (e.g., gazetteers) rather than direct background knowledge of threats. Twitter is examined as a high-bandwidth platform where both actors from both sides of cyberdefense, such as attackers and security professionals, post cybersecurity-related messages [25]. The overall goal of this work is to analyze these messages collectively to attain actionable insights and collect intelligence on emergent cyber threat events.…”

Section: Introductionmentioning

confidence: 99%

A novel approach for detection and ranking of trendy and emerging cyber threat events in Twitter streams

Bose

Behzadan

Aguirre

et al. 2019

Proceedings of the 2019 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining

Self Cite

View full text Add to dashboard Cite

We present a new machine learning and text information extraction approach to detection of cyber threat events in Twitter that are novel (previously non-extant) and developing (marked by significance with respect to similarity with a previously detected event). While some existing approaches to event detection measure novelty and trendiness, typically as independent criteria and occasionally as a holistic measure, this work focuses on detecting both novel and developing events using an unsupervised machine learning approach. Furthermore, our proposed approach enables the ranking of cyber threat events based on an importance score by extracting the tweet terms that are characterized as named entities, keywords, or both. We also impute influence to users in order to assign a weighted score to noun phrases in proportion to user influence and the corresponding event scores for named entities and keywords. To evaluate the performance of our proposed approach, we measure the efficiency and detection error rate for events over a specified time interval, relative to human annotator ground truth.

show abstract

“…Among other malpractices, some users manipulate the Twitter platform to threaten other people and to promote violence by posting threatening content (i.e., content expressing an intent to cause harm to others). This has led to a growing body of research investigating the spread of threatening content in social media, among others by examining threatening language and by attempting to detect this type of content [8][9][10]. Given the distress this can cause in online users, furthering research in automatic threatening language identification is of utmost importance to tackle this problem at the scale of a large social media platform like Twitter.…”

Section: Introductionmentioning

confidence: 99%

Threatening Language Detection and Target Identification in Urdu Tweets

Amjad¹,

Ashraf²,

Zhila

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Automatic threatening language detection is an important task and most of the existing studies relied on English. However, threatening language detection in poor-resource language remains briefly addressed. In this paper, we introduce a new publicly available dataset for threatening language detection in Urdu tweets to fill the scientific gap, particularly, in the Urdu language. The proposed dataset contains 3,564 tweets manually annotated by human experts with two labels: threatening and non-threatening. The threatening tweets are further classified into two classes: threatening to an individual person or threatening to a group. This research follows a twostep approach: (i) classify a given tweet as threatening or non-threatening and (ii) classify whether a threatening tweet is used to threaten an individual or a group. We compare three forms of text representation: two count-based, where the text is represented using either character n-gram counts or word n-gram counts as feature vectors and the third text representation is based on fastText pre-trained word embeddings for Urdu. We perform several experiments using machine learning and deep learning classifiers and our study shows that MLP classifier with the combination of word n-gram features outperformed other classifiers in detecting threatening tweets. Whereas, SVM using fastText pre-trained word embedding obtained the best results for the target identification task.

show abstract

Corpus and Deep Learning Classifier for Collection of Cyber Threat Indicators in Twitter Stream

Cited by 42 publications

References 14 publications

Detecting Trending Terms in Cybersecurity Forum Discussions

Detecting Trending Terms in Cybersecurity Forum Discussions

A novel approach for detection and ranking of trendy and emerging cyber threat events in Twitter streams

Threatening Language Detection and Target Identification in Urdu Tweets

Contact Info

Product

Resources

About