PaperlayerView exact revision on arXiv

Source-linked AI summary

Crowdsourcing Cybersecurity: Cyber Attack Detection using Social Media

Rupinder Paul Khandpur, Taoran Ji, Steve Jan, Gang Wang, Chang-Tien Lu, Naren Ramakrishnan

arXiv:1702.07745v1cs.CRcs.HCcs.IRcs.SI

TL;DR

Cyber-attacks evolve rapidly, while existing defenses can be static and prior weak-supervision approaches have limits in tracking attacks and encoding their characteristics. The paper uses social media and unsupervised query expansion from a small fixed seed set to detect and characterize attacks; it reports identifying and encoding three attack types while outperforming existing methods.

  • Problem

    The paper seeks to detect varied cyber-attacks early and determine their characteristics without the extensive labels that are impractical for noisy, high-volume social media.

    Source: §1 · pp. 1–2

  • Method

    The approach expands a limited, fixed set of general event triggers using social-media reports, dependency parses, and word embeddings.

    Source: §1 · p. 2

  • Results

    The approach consistently identifies and encodes DDOS, data-breach, and account-hijacking events, outperforming existing methods.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The authors conclude that social-media analysis can provide ongoing situational awareness of reported cyber-attacks.

    Source: §6 · p. 12

    Event matching is constrained by Twitter language, which may not be formal.

    Source: §4.1.3 · p. 8

Abstract

from arXiv · show

Social media is often viewed as a sensor into various societal events such as disease outbreaks, protests, and elections. We describe the use of social media as a crowdsourced sensor to gain insight into ongoing cyber-attacks. Our approach detects a broad range of cyber-attacks (e.g., distributed denial of service (DDOS) attacks, data breaches, and account hijacking) in an unsupervised manner using just a limited fixed set of seed event triggers. A new query expansion strategy based on convolutional kernels and dependency parses helps model reporting structure and aids in identifying key event characteristics. Through a large-scale analysis over Twitter, we demonstrate that our approach consistently identifies and encodes events, outperforming existing methods.

1 INTRODUCTION

The paper uses social media to detect cyber-attacks and characterize events without relying on extensive labeled data. Its approach expands a limited set of seed triggers, and evaluation reports that it identifies and encodes three attack types while outperforming existing methods.

  • Evolving attack mechanisms challenge static, unadaptable defenses and contribute to a detection deficit—the delay between an attack and its discovery.Source: §1 · p. 1
  • Social media can reveal breaches and account hijacking beyond internal telemetry, but cannot fully replace telemetry for some attacks.Source: §1 · p. 1
  • The goal is to detect varied attacks early and determine their characteristics, addressing prior weak-supervision methods’ limits in tracking change and encoding events.Source: §1 · pp. 1–2
  • DETE expands a limited, fixed set of general seed triggers into event-related queries without supervision.Source: §1 · p. 2
  • Dependency parses model how attacks are reported, while word embeddings capture similarities between triggers and candidate reports.Source: §1 · p. 2
  • The approach identifies and encodes DDOS, data-breach, and account-hijacking events, outperforming existing methods.Source: §1 · p. 2

2 PROBLEM SETUP

The problem setup represents time-ordered tweets and formalizes cyber-attack detection as a sequence of target-domain identification and query expansion tasks. It defines the query and event representations used to describe and retrieve events.

  • The input is a collection of tweets D organized across p time slots; each subcollection has a tweet space D, with target tweets D+ and other tweets D−.Source: §2 · p. 2
  • A typed dependency query is a semantically coherent tree of terms, mentions, or hashtags whose nodes share syntactic and semantic relations; seed queries are manually selected for an event type.Source: §2 · p. 2
  • An expanded query is automatically generated from seed queries and may describe the same subject more specifically; an event is represented by its query set, date, and attack type.Source: §2 · p. 2
  • Target-domain generation identifies attack-related tweets D+ within a tweet subcollection, providing information for mining expanded queries.Source: §2 · p. 3
  • Expanded query extraction generates queries representing the target domain’s generic concept for retrieving event-related information from other collections.Source: §2 · p. 3
  • Dynamic typed query expansion iteratively expands target tweets and queries from a small seed set until target-related messages are included.Source: §2 · p. 3

3 METHODOLOGY

The methodology mines event-query templates without requiring a manually annotated training set. It generates target tweets and expands queries using syntactic and semantic signals, then clusters and labels expanded queries to form event representations.

3 METHODOLOGY

  • The method avoids traditional event-trigger extractors that require large annotated corpora, which are impractical for noisy, high-volume social media.It instead automatically mines query templates for event tracking.Source: §3 · p. 3

3.1 Target Domain Generation

  • Target-domain generation selects tweets that are both syntactically and semantically similar to a seed query, using dependency-tree convolution kernels over shared paths.The method also uses word-embedding cosine similarity and avoids coincidental word chains and long-range dependencies.Source: §3.1 · pp. 3–4

3.2 Dynamic Typed Qery Expansion

  • Dynamic typed query expansion iteratively mines candidate dependency-tree queries from relevant tweets and ranks them by how well their terms distinguish the target domain from the full collection.High-ranked candidates become expanded queries for the next iteration until convergence.Source: §3.2 · pp. 4–5

3.3 Event Extraction

  • Event representations combine clustered expanded queries with a date and cyber-attack type, assigned by the exemplar query’s highest-similarity seed.The date comes from the time interval used for query expansion; experiments used daily tweet collections.Source: §3.3 · p. 6

4 EVALUATION

The evaluation uses a large Twitter stream and curated incident reports to assess detection across three cyber-attack types. The approach achieves around 80% precision for data-breach and DDoS events, while case studies illustrate event-specific query expansions.

4.1.1 Dataset and Gold Standard Report.

  • The evaluation uses a 27-month, 5,146,666,178-tweet Twitter stream and gold standard reports for data breaches, DDoS, and account hijacking.The reports draw on Hackmageddon and PrivacyRights; after filtering and date matching, the GSR contains 85 data-breach, 80 DDoS, and 55 account-hijacking events.Source: §4.1.1 · pp. 6–7

4.1.2 Baseline and Comparison Method.

  • The baseline applies Kleinberg’s burstiness algorithm to static keywords and extracts events when the bursty-keyword set exceeds a threshold.Using 1,000 keywords and a manually tuned threshold of 36, it detects 81 events from August 2014 through October 2016.Source: §4.1.2 · pp. 7–8

4.1.3 Matching Detected Events with GSR.

  • Detected events are matched to GSR entries by description, a three-day date window, and event type, with manual review when entity matching fails.For the baseline, bursty keywords replace named entities in the matching process.Source: §4.1.3 · p. 8

4.2 Measuring Performance

  • Using a small set of seed query templates, the approach achieved around 80% precision for data-breach and DDoS events and 66% precision for account-hijacking events.Manual analysis indicated that new account-hijacking events were detected that were not covered by the GSR.Source: §4.2 · p. 8

4.3 Case Studies

  • The case studies include 12 detected DDoS events and illustrate attacks against Sony Pictures and the Dyn DNS provider.The Sony-related examples include attacks beginning in August 2014 and later attacks on the PlayStation network.Source: §4.3 · pp. 8–9
  • The Ashley Madison, Dyn, and U.S. Central Command cases show expansions capturing breach-related terms, botnet activity, and both hijacking victim and actor.For Ashley Madison, expansions evolve through iteration 3; the Dyn expansions characterize attacks involving internet-connected devices turned into botnets.Source: §4.3 · pp. 9–11, Figure 3 · p. 10, Figure 4 · p. 10

5 RELATED WORK

Prior cyberattack detection work spans network-traffic analysis, prediction, and security intelligence from online media. This paper differs by analyzing tweets from broader user populations and using typed query expansion to focus results and extract attack indicators.

5 RELATED WORK

  • Cyberattack detection research ranges from network-flow classification and graph anomaly detection to prediction using organizational network signals,,.Soska et al. also use supervised network-traffic classifiers to assess vulnerable websites and predict future maliciousness.Source: §5 · p. 11
  • Security-intelligence work often mines technology blogs and security-professional tweets, whereas this paper uses crowdsourced data from broader user populations likely to be attack victims,.The related weakly supervised approach is described as unable to capture attacks’ dynamic evolution or encode event characteristics.Source: §5 · p. 11
  • Twitter event research covers trending news, disasters, criminal incidents, and migration,,,.Source: §5 · p. 11
  • Unlike keyword matching, clustering, and topic modeling, this work uses typed query expansion to focus results and extract cyberattack indicators.Source: §5 · p. 12

6 CONCLUSION

The paper presents unsupervised extraction and encoding of cyberattacks discussed on social media, using template-driven query expansion supported by dependency parses and word embeddings. It identifies ongoing situational awareness as the motivation and proposes broader attack coverage and sequential modeling as future work.

6 CONCLUSION

  • Template-driven query expansion, dependency parse trees, and word embeddings support unsupervised extraction and encoding of cyberattacks reported on social media.Source: §6 · p. 12
  • The authors describe such tools as crucial to ongoing situational awareness given cyberattacks’ widespread prevalence.Source: §6 · p. 12
  • Future work would broaden the attack classes covered and model sequential dependencies to capture changing attack prevalence across institutions or countries over time.Source: §6 · p. 12
Loading 1702.07745v1…