Automated Cyber Threat Identification and Natural Language Processing

Abstract

The time window between the disclosure of a new cyber vulnerability and its use by Cyber criminals has been getting smaller and smaller over time. Recent episodes, such asLog4j vulnerability, exemplifies this well. Within hours after the exploit being released, attackers started scanning the internet looking for vulnerable hosts to deploy threats like crypto currency miners and ransom ware on vulnerable systems.Thus,it becomes imperative for the cyber security defense strategy to detect threats and their capabilities as early as possible to maximize the success of prevention actions.Althoughcrucial, discovering new threatsisa challenging activity for security analysts due to the immense volume of data and information sources to be analyzed for signs that a threat is emerging. In this sense,wepresenta framework for automatic identification and profiling of emerging threats using Twitter messages as a source of events and MITRE ATT&CK as a source of knowledge for threat characterization.Theframeworkcomprises three main parts: identification of cyber threats and their names; profilingtheidentifiedthreatintermsofitsintentionsorgoalsbyemploying two machine learning layers to filter and classify tweets; and alarm generation based on the threat’srisk.Themaincontributionofourworkistheapproachtocharacterizeor profile the identified threats in terms of their intentions or goals, providing additional context on the threat and avenues for mitigation. In our experiments, theprofilingstagereachedanF1 score of 77% in correctly profiling discovered threats.