Processing Tweets for Cybersecurity Threat Awareness
This work addresses the need for timely cybersecurity threat awareness for IT infrastructure managers, though it is incremental as it builds on existing tweet-processing methods with a novel clustering strategy.
The authors tackled the problem of extracting cybersecurity threat information from Twitter by proposing SYNAPSE, a streaming monitor that processes tweets to generate Indicators of Compromise (IoCs), achieving a true positive rate above 90% and a false positive rate under 10% in evaluations over 195,000 tweets.
Receiving timely and relevant security information is crucial for maintaining a high-security level on an IT infrastructure. This information can be extracted from Open Source Intelligence published daily by users, security organisations, and researchers. In particular, Twitter has become an information hub for obtaining cutting-edge information about many subjects, including cybersecurity. This work proposes SYNAPSE, a Twitter-based streaming threat monitor that generates a continuously updated summary of the threat landscape related to a monitored infrastructure. Its tweet-processing pipeline is composed of filtering, feature extraction, binary classification, an innovative clustering strategy, and generation of Indicators of Compromise (IoCs). A quantitative evaluation considering all tweets from 80 accounts over more than 8 months (over 195.000 tweets), shows that our approach timely and successfully finds the majority of security-related tweets concerning an example IT infrastructure (true positive rate above 90%), incorrectly selects a small number of tweets as relevant (false positive rate under 10%), and summarises the results to very few IoCs per day. A qualitative evaluation of the IoCs generated by SYNAPSE demonstrates their relevance (based on the CVSS score and the availability of patches or exploits), and timeliness (based on threat disclosure dates from NVD).