Intelligent cyber attack detection using social media posts

Official URL: https://risc01.sabanciuniv.edu/record=b2708491_(Table of contents)

The number of cyber attacks increases every day, so the number of people affected by these attacks is also increasing. For this reason, companies and users need to be aware of the attacks as fast as possible to take precautions and to minimize the loss and effects caused by the attacks. In this thesis, a framework is proposed to detect cyber attacks from Twitter so that entities can act accordingly. The framework consists of two main tasks: tweet classification and information extraction. Two different deep learning based transformers, namely BERT and RoBERTa, are used for our tasks. Two new datasets, one is for binary classification named SUCyber, and the other is for named entity recognition named SUCyberNER, are created. Moreover, an additional dataset from another work is used to evaluate the approaches for the classification. The model that we propose for tweet classification yields average F1-score of 90.1% on two different datasets. Also, the NER model achieves F1-score of 92.29% for the selected tag. In addition, the proposed model has been incorporated into a website that collects and analyzes tweets in real-time to identify DDoS attacks. Finally, this study shows that tweets can be a good source of information to identify ongoing cyber attacks.