Cyberthreat Detection from Twitter using Deep Neural Networks

Abstract

To be prepared against cyberattacks, most organizations resort to security information and event management systems to monitor their infrastructures. These systems depend on the timeliness and relevance of the latest updates, patches and threats provided by cyberthreat intelligence feeds. Open source intelligence platforms, namely social media networks such as Twitter, are capable of aggregating a vast amount of cybersecurity-related sources. To process such information streams, we require scalable and efficient tools capable of identifying and summarizing relevant information for specified assets. This paper presents the processing pipeline of a novel tool that uses deep neural networks to process cybersecurity information received from Twitter. A convolutional neural network identifies tweets containing security-related information relevant to assets in an IT infrastructure. Then, a bidirectional long short-term memory network extracts named entities from these tweets to form a security alert or to fill an indicator of compromise. The proposed pipeline achieves an average 94% true positive rate and 91% true negative rate for the classification task and an average F1-score of 92% for the named entity recognition task, across three case study infrastructures.

Gathering Cyber Threat Intelligence from Twitter Using Novelty Classification

“…In the last few years, research on using Cyber threat-relevant information available on Twitter for security purposes has gained significant attention. To automatically collect Cyber threat intelligence from Twitter, several methods have been used [7], [8], [10]- [14].…”

“…al. [10] use word embeddings such as GloVE [15] and Word2Vec [16] for feature extraction and use the binary classification model Convolutional Neural Network (CNN) [17] for classifying Cyber threat tweets. The collection method for Cyber threat tweets based on binary classification requires the classifiers to be trained with both positive and negative samples, or Cyber threat-relevant and Cyber threat-irrelevant tweets.…”

“…NOVELTY CLASSIFICATION As previously reported, our work focuses only on the collection method of Cyber threat tweets instead of a complete system with functional requirements such as scalability, realtime processing and security alert generation as in some previous work [10], [13], [14]. The key idea of our method is that we formulate the task of detecting Cyber threat tweets as a novelty classification task [18].…”

“…We also compared our classifier with other baselines including Support Vector Machine (SVM), Multilayer Perceptron (MLP) and Convolutional Neural Network (CNN) [10], [14]. These baselines are binary classification models which require to be trained with both positive and negative samples.…”

“…However, using our knowledge about Cyber security, we can associate these two tweets with the CVE identifiers 'CVE-2018-20714' 1 and 'CVE-2017-11882' 2 respectively. Collecting these tweets with the associated CVE identifiers is useful for Cyber threat-related applications such as exploit prediction [7] and Indicators of Compromise (IoCs) generation [10].…”