Open Source Intelligence for Cybersecurity Events via Twitter Data
Open-Source Intelligence (OSINT) is largely regarded as a necessary component for cybersecurity intelligence gathering to secure network systems. With the advancement of artificial intelligence (AI) and increasing usage of social media, like Twitter, we have a unique opportunity to obtain and aggregate information from social media. In this study, we propose an AI-based scheme capable of automatically pulling information from Twitter, filtering out security-irrelevant tweets, performing natural language analysis to correlate the tweets about each cybersecurity event (e.g., a malware campaign), and validating the information. This scheme has many applications, such as providing a means for security operators to gain insight into ongoing events and helping them prioritize vulnerabilities to deal with. To give examples of the possible uses, we present three case studies demonstrating the event discovery and investigation processes. We also examine the potential of OSINT for identifying the network protocols associated with specific events, which can aid in the mitigation procedures by informing operators if the vulnerability is exploitable given their system’s network configurations.
- Research Organization:
- University of Arkansas
- Sponsoring Organization:
- Department of Energy; National Science Foundation
- DOE Contract Number:
- CR0000003
- OSTI ID:
- 2584222
- Country of Publication:
- United States
- Language:
- English
Similar Records
Geotagging one hundred million Twitter accounts with total variation minimization
Multiple social platforms reveal actionable signals for software vulnerability awareness: A study of GitHub, Twitter and Reddit