Detecting Cybersecurity Events from Noisy Short Text

Proceedings of NAACL-HLT 2019, pages 1366–1372 Minneapolis, Minnesota, June 2 - June 7, 2019. c⃝2019 Association for Computational Linguistics 1366 Detecting Cybersecurity Events from Noisy Short Text Semih Yagcioglu, Mehmet Saygin Seyfioglu∗, Begum Citamak, Batuhan Bardak Seren Guldamlasioglu, Azmi Yuksel, Emin Islam Tatli STM A.S¸., Ankara, Turkey {syagcioglu, msaygin.seyfioglu, begum.citamak, batuhan.bardak, sguldamlasioglu, azyuksel, emin.tatli} @stm.com.tr Abstract It is very critical to analyze messages shared over social networks for cyber threat intel- ligence and cyber-crime prevention. In this study, we propose a method that leverages both domain-specific word embeddings and task-specific features to detect cyber secu- rity events from tweets. Our model employs a convolutional neural network (CNN) and a long short-term memory (LSTM) recurrent neural network which takes word level meta- embeddings as inputs and incorporates contex- tual embeddings to classify noisy short text. We collected a new dataset of cyber security related tweets from Twitter and manually an- notated a subset of 2K of them. We exper- imented with this dataset and concluded that the proposed model outperforms both tradi- tional and neural baselines. The results sug- gest that our method works well for detecting cyber security events from noisy short text. 1 Introduction Twitter has become a medium where people can share and receive timely messages on about any- thing. People share facts, opinions, broadcast news and communicate with each other through these messages. Due to the low barrier to tweeting, and growth in mobile device usage, tweets might provide valuable information as people often share instantaneous updates such as the breaking news before even being broadcasted in the newswire c.f. Petrovi´c et al. (2010). People also share cyber se- curity events in their tweets such as zero day ex- ploits, ransomwares, data leaks, security breaches, vulnerabilities etc. Automatically detecting such events might have various practical applications such as taking the necessary precautions promptly as well as creating self-awareness as illustrated in Fig. 1. Recently, working with the cyber security ∗Corresponding author. Dear @AppleSupport, we noticed a *HUGE* se- curity issue at MacOS High Sierra. Anyone can login as “root” with empty password after click- ing on login button several times. Are you aware of it @Apple? Figure 1: A cyber security event. A recently discovered se- curity issue has been reported on Twitter which caught public attention. A security fix has been published right afterward. related text has garnered a lot of interest in both computer security and natural language process- ing (NLP) communities (c.f. Joshi et al. (2013); Ritter et al. (2015); Roy et al. (2017)). Neverthe- less, detecting cyber security events from tweets pose a great challenge, as tweets are noisy and of- ten lack sufficient context to discriminate cyber se- curity events due to length limits. Recently, deep learning methods have shown to be outperform- ing traditional approaches in several NLP tasks (Chen and Manning, 2014; Bahdanau et al., 2014; Kim, 2014; Hermann et al., 2015). Inspired by this progress, our goal is to detect cyber secu- rity events in tweets by learning domain-specific …

Content truncated to 500 words