REST: A Thread Embedding Approach for Identifying and Classifying User-specified Information in Security Forums
This addresses the challenge for security professionals in efficiently analyzing unstructured forum data to detect threats and information, though it is incremental as it builds on existing embedding methods for a specific domain.
The paper tackles the problem of extracting useful information from security forums by identifying and classifying threads into four user-specified categories, such as alerts of attacks or malicious services, using a multi-step weighted embedding approach. It achieves an accuracy between 63.3-76.9% on real data from three forums with 164k posts and 21k threads.
How can we extract useful information from a security forum? We focus on identifying threads of interest to a security professional: (a) alerts of worrisome events, such as attacks, (b) offering of malicious services and products, (c) hacking information to perform malicious acts, and (d) useful security-related experiences. The analysis of security forums is in its infancy despite several promising recent works. Novel approaches are needed to address the challenges in this domain: (a) the difficulty in specifying the "topics" of interest efficiently, and (b) the unstructured and informal nature of the text. We propose, REST, a systematic methodology to: (a) identify threads of interest based on a, possibly incomplete, bag of words, and (b) classify them into one of the four classes above. The key novelty of the work is a multi-step weighted embedding approach: we project words, threads and classes in appropriate embedding spaces and establish relevance and similarity there. We evaluate our method with real data from three security forums with a total of 164k posts and 21K threads. First, REST robustness to initial keyword selection can extend the user-provided keyword set and thus, it can recover from missing keywords. Second, REST categorizes the threads into the classes of interest with superior accuracy compared to five other methods: REST exhibits an accuracy between 63.3-76.9%. We see our approach as a first step for harnessing the wealth of information of online forums in a user-friendly way, since the user can loosely specify her keywords of interest.