Processing Tweets for Cybersecurity Threat Awareness

Abstract

Receiving timely and relevant security information is crucial for maintaining a high-security level on an IT infrastructure. This information can be extracted from Open Source Intelligence published daily by users, security organisations, and researchers. In particular, Twitter has become an information hub for obtaining cutting-edge information about many subjects, including cybersecurity. This work proposes SYNAPSE, a Twitter-based streaming threat monitor that generates a continuously updated summary of the threat landscape related to a monitored infrastructure. Its tweet-processing pipeline is composed of filtering, feature extraction, binary classification, an innovative clustering strategy, and generation of Indicators of Compromise (IoCs). A quantitative evaluation considering all tweets from 80 accounts over more than 8 months (over 195.000 tweets), shows that our approach timely and successfully finds the majority of security-related tweets concerning an example IT infrastructure (true positive rate above 90%), incorrectly selects a small number of tweets as relevant (false positive rate under 10%), and summarises the results to very few IoCs per day. A qualitative evaluation of the IoCs generated by SYNAPSE demonstrates their relevance (based on the CVSS score and the availability of patches or exploits), and timeliness (based on threat disclosure dates from NVD).

Gathering Cyber Threat Intelligence from Twitter Using Novelty Classification

“…In the last few years, research on using Cyber threat-relevant information available on Twitter for security purposes has gained significant attention. To automatically collect Cyber threat intelligence from Twitter, several methods have been used [7], [8], [10]- [14].…”

“…al. [14] focus on designing a completed online monitoring system for Cyber threat tweets on Twitter. Their monitoring system includes a Cyber threat tweet classification module that uses supervised machine learning approach to classify Cyber threat tweets.…”

“…NOVELTY CLASSIFICATION As previously reported, our work focuses only on the collection method of Cyber threat tweets instead of a complete system with functional requirements such as scalability, realtime processing and security alert generation as in some previous work [10], [13], [14]. The key idea of our method is that we formulate the task of detecting Cyber threat tweets as a novelty classification task [18].…”

“…We also compared our classifier with other baselines including Support Vector Machine (SVM), Multilayer Perceptron (MLP) and Convolutional Neural Network (CNN) [10], [14]. These baselines are binary classification models which require to be trained with both positive and negative samples.…”

“…Out of the 120 correctly labeled Cyber threat-relevant tweets, 39 tweets contained the CVE identifier and 81 tweets did not. Since the recent research has well analyzed Cyber threat-relevant tweets with CVE identifier [7], [10], [14], we focus our analysis on only Cyber threat-relevant tweets without CVE identifier.…”