CySecAlert: An Alert Generation System for Cyber Security Events Using Open Source Intelligence Data

Riebe, Thea; Wirth, Tristan; Bayer, Markus; Küehn, Philipp; Kaufhold, Marc–André; Knauthe, Volker; Guthe, Stefan; Reuter, Christian

doi:10.1007/978-3-030-86890-1_24

Cited by 15 publications

(12 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cyber threat detection is generally known as the process of automatic scraping of the webspace and Open Source Intelligence (OSINT) to detect possible cybersecurity vulnerabilities (Sabottke et al, 2015;Riebe et al, 2021b;Le Sceller et al, 2017). Social Media platforms, like Twitter, are part of OSINT and propose a great space to share and discuss possible cybersecurity vulnerabilities.…”

Section: Cyber Threat Detection and Intelligencementioning

confidence: 99%

“…There are some automated systems and research that already scrape Twitter and other OSINT sources to detect cyber threats. Some examples are the CySecAlert system from Riebe et al (2021b) or SONAR from Le Sceller et al (2017), which collect cyber threat relevant tweets from Twitter, filter them, and present them in a manageable dashboard.…”

Section: Cyber Threat Detection and Intelligencementioning

confidence: 99%

“…Most importantly, our research paves the way for fine-grained CTI. Current research addresses CTI from a very coarse perspective, by building classifiers, like Riebe et al (2021b), that are able to find general cyber threat information. As a result, only a small amount of data reduction can be achieved in these informationoverloaded situations.…”

Section: Research Gapmentioning

confidence: 99%

“…In our case, we first take a pre-trained BERT model (which can be seen as the 0th level of finetuning), train it with masked language modeling on cybersecurity data. We then tune the resulting model for classification on the CySecAlert dataset (Riebe et al, 2021b) in which Twitter posts are generally assigned to the cybersecurity domain. Finally, we train it on the few training examples of the specialized cyber threat dataset.…”

Section: Approachmentioning

confidence: 99%

“…However, since machine learning usually requires a large amount of data for normal training, this would result in having to label a dataset for each cyber threat, which is unrealistic considering the effort involved and the need for fast and up-to-date information. Against this background, the concept of active learning systems take a first step towards label reduction for supervised machine learning for cyber threats (Riebe et al, 2021b). Active learning supports the labeling process, so that only the instances with the highest learning value need to be labeled for machine learning.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Multi-Level Fine-Tuning, Data Augmentation, and Few-Shot Learning for Specialized Cyber Threat Intelligence

Bayer¹,

Frey²,

Reuter³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Gathering cyber threat intelligence from open sources is becoming increasingly important for maintaining and achieving a high level of security as systems become larger and more complex. However, these open sources are often subject to information overload. It is therefore useful to apply machine learning models that condense the amount of information to what is necessary. Yet, previous studies and applications have shown that existing classifiers are not able to extract specific information about emerging cybersecurity events due to their low generalization ability. Therefore, we propose a system to overcome this problem by training a new classifier for each new incident. Since this requires a lot of labelled data using standard training methods, we combine three different low-data regime techniques -transfer learning, data augmentation, and few-shot learning -to train a high-quality classifier from very few labelled instances. We evaluated our approach using a novel dataset derived from the Microsoft Exchange Server data breach of 2021 which was labelled by three experts. Our findings reveal an increase in F1 score of more than 21 points compared to standard training methods and more than 18 points compared to a state-of-the-art method in few-shot learning. Furthermore, the classifier trained with this method and 32 instances is only less than 5 F1 score points worse than a classifier trained with 1800 instances.

show abstract

Section: Cyber Threat Detection and Intelligencementioning

confidence: 99%

Section: Cyber Threat Detection and Intelligencementioning

confidence: 99%

Section: Research Gapmentioning

confidence: 99%

Section: Approachmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations