Leveraging Natural Language Processing for Automated Detection and Profiling Of Emerging Cyber Threats

Venkata Durga Prasad Sambrow; Kiranmai Doppalapudi; Boddu Venkataramakrishna

Author(s)

Venkata Durga Prasad Sambrow Department of CSE-Data Science Chalapathi institute of Engineering and Technology,,

Kiranmai Doppalapudi Department of CSE-Data Science Chalapathi institute of Engineering and Technology,,

Boddu Venkataramakrishna Department of CSE-IT Chalapathi institute of Engineering and Technology,,

Abstract

The evolving landscape of cyber threats demands swift detection and mitigation strategies, as highlighted by the Log4j vulnerability incident. This context emphasizes the critical need for cybersecurity defense strategies to adapt quickly to the narrowing window between the disclosure of a vulnerability and its exploitation. The urgency of early threat detection is paramount to thwarting cybercriminal activities effectively. However, security analysts face significant challenges due to the vast volume of da ta and diverse information sources. To tackle this issue, we propose a novel framework that utilizes Twitter messages as event indicators and employs the MITRE ATT&CK framework for detailed threat characterization. The proposed framework comprises three main stages: identifying cyber threats and their associated nomenclature, profiling the intentions or goals of identified threats through a twolayered machine learning approach for filtering and classifying tweets, and generating alerts based on a comprehensive threat risk assessment. A key contribution of our framework is its ability to provide in-depth insights into the intentions or goals of identified threats, thereby enriching threat context and enhancing mitigation strategies. In experimental evaluations, our profiling stage demonstrated a high F1 score of 77% in accurately characterizing detected threats. This framework represents a notable advancement in threat detection and mitigation, offering a sophisticated yet efficient approach to addressing emerging cyber threats in an increasingly unpredictable digital environment

Publication Details

Page(s) 717-726

DOI DOI not available

Published Journal: International Journal of Communication Networks and Information Security, Volume: 16, Issue: S1, Year: 2024

Request the full text from PASTIC

Keywords

Cyber Threat Detection, Log4j Vulnerability, Twitter Monitoring, Machine Learning Profiling, Vulnerability Exploitation, Threat Characterization, MITRE ATTCK Framework

References

Dionísio N.,Alves F.,Ferreira P. M.,Bessani A. .2020 ."Towards end-to-end cyberthreat detection from Twitter using multi-task learning,". in Proc. Int Joint Conf. Neural Netw. (IJCNN), : 1-8.

Le B. D.,Wang G.,Nasim M.,Babar A. .1907 ."Gathering cyber threat intelligence from Twitter using novelty classification,". , : .

Bose A.,Behzadan V.,Aguirre C.,Hsu W. H. .2019 ."A novel approach for detection and ranking of trendy and emerging cyber threat events in Twitter streams,". in Proc. IEEE/ACM Int. Conf. Adv. Social Netw. Anal. Mining (ASONAM), : 871-878.

Dionísio N.,Alves F.,Ferreira P. M.,Bessani A. .2019 ."Cyberthreat detection from Twitter using deep neural networks,". in Proc. Int. Joint Conf. Neural Netw. (IJCNN), : 1-8.

Sapienza A.,Ernala S. K.,Bessi A.,Lerman K.,Ferrara E. .2018 ."DISCOVER: Mining online chatter for emerging cyber threats,". in Proc. Companion Web Conf. Web Conf. (WWW), : 983-990.

Strom B. E.,Applebaum A.,Miller D. P.,Nickels K. C.,Pennington A. G.,C. B. Thomas A. G.,Mitre ATT,McLean VA .2018 .CK: Design and philosophy," MITRE Corp.. Tech. Rep. 19-01075-28, : .

Niakanlahiji A.,Wei J.,Chu B. .2018 ."A natural language processing-based trend analysis of advanced persistent threat techniques,". Dec, : 2995-3000.

Ayoade G.,Chandra S.,Khan L.,Hamlen K.,Thuraisingham B. .2018 ."Automated threat report classification over multi-source data,". in Proc. IEEE 4th Int. Conf. Collaboration Internet Comput. (CIC), : 236-245.

Sapienza A.,Bessi A.,Damodaran S.,Shakarian P.,Lerman K.,Ferrara E. .2017 ."Early warnings of cyber threats in online discussions,". in Proc. IEEE Int. Conf. Data Mining Workshops (ICDMW), : 667-674.

Attarwala A.,Dimitrov S.,Obeidi A. .2017 ."How efficient is Twitter: Predicting 2012 U.S. presidential elections using support vector machine via Twitter and comparing against Iowa electronic markets,". Sep, : 646-652.

Khandpur R. P.,Ji T.,Jan S.,Wang G.,Ramakrishnan N.,Nov N. .2017 ."Crowdsourcing cybersecurity: Cyber-attack detection using social media,". in Proc. ACM Conf. Inf. Knowl, : 1049-1057.

Le Sceller Q.,Karbab E. B.,Debbabi M.,Iqbal F.,Aug F. .2017 ."SONAR: Automatic detection of cyber security events over the Twitter stream,". in Proc. 12th Int. Conf. Availability, : 1-11.

K.-C. Lee C.-H.,Hsieh C.-H.,-J. Wei C.-H.,C.-H. Mao J.-H.,Dai J.-H. .2017 ."Sec-buzzer: Cyber security emerging topic mining with open threat intelligence retrieval and timeline event annotation,". Soft Comput., 21(11) : 2883-2896.

Queiroz A.,Keegan B.,Mtenzi F. .2017 ."Predicting software vulnerability using security discussion in social media,". in Proc. Eur. Conf. Cyber Warfare Secur., : 628-634.

Nunes E.,Diab A.,Gunn A.,Marin E.,Mishra V.,Paliath V.,Robertson J.,Shakarian J.,Thart A.,Shakarian P. .2016 ."Darknet and deepnet mining for proactive cybersecurity threat intelligence,". in Proc. IEEE Conf. Intell. Secur. Informat. (ISI), : 7-12.

Mittal S.,P. K. Das V.,Mulwad A.,Joshi T.,Finin T. .2016 ."CyberTwitter: Using Twitter to generate alerts for cybersecurity threats and vulnerabilities,". in Proc. IEEE/ACM Int. Conf. Adv. Social Netw. Anal. Mining (ASONAM), : 860-867.