Detecting Denial-of-Service Attacks from Social Media Text: Applying NLP to Computer Security

Proceedings of NAACL-HLT 2018, pages 1626–1635 New Orleans, Louisiana, June 1 - 6, 2018. c⃝2018 Association for Computational Linguistics Detecting Denial-of-Service Attacks from Social Media Text: Applying NLP to Computer Security Nathanael Chambers and Ben Fry and James McMasters Department of Computer Science United States Naval Academy nchamber@usna.edu Abstract This paper describes a novel application of NLP models to detect denial of service attacks using only social media as evidence. Individ- ual networks are often slow in reporting at- tacks, so a detection system from public data could better assist a response to a broad at- tack across multiple services. We explore NLP methods to use social media as an indirect measure of network service status. We de- scribe two learning frameworks for this task: a feed-forward neural network and a partially labeled LDA model. Both models outperform previous work by significant margins (20% F1 score). We further show that the topic-based model enables the first fine-grained analysis of how the public reacts to ongoing network at- tacks, discovering multiple “stages” of obser- vation. This is the first model that both de- tects network attacks (with best performance) and provides an analysis of when and how the public interprets service outages. We describe the models, present experiments on the largest twitter DDoS corpus to date, and conclude with an analysis of public reactions based on the learned model’s output. 1 Introduction Distributed Denial of Service (DDoS) attacks have become more frequent and more severe in their impact. Coordinated attacks across several ser- vices are now common, yet there are fewer meth- ods to detect multi-network events. Research into detecting and preventing single attacks focuses on direct evidence based on characteristics of a net- work itself, such as monitoring abnormal traffic. This paper instead investigates an aytpical source for multiple attacks with indirect evidence: social media text. Do users of attacked systems post on social media? What can be learned from com- ments? Can NLP learning models extract enough information from user posts to detect attacks? Pre- vious work on attack detection with social media is sparse, and focused on detecting trending words. This paper is the first to learn models of language without ‘attack’ dictionaries and seed words. The goal is the real-time detection of attacks without network data. Our secondary goal is to illustrate NLP applications to computer security topics. Research on information extraction from social media has shown that many types of events in the world can be reliably detected from the language that users post. Several approaches have been shown effective in identifying events like earth- quakes (Sakaki et al., 2010), concerts and prod- uct releases (Ritter et al., 2012), and other natural disasters (Neubig et al., 2011). Detecting DDoS attacks is not too dissimilar from these goals. An attack is a real event in the world, and it takes a community by surprise. This paper thus adopts ideas from NLP, but applies them to the unique application of DDoS detection. Social media is obviously not the …

Content truncated to 500 words