Early Warnings of Cyber Threats in Online Discussions

TL;DR

This paper presents a system that automatically detects and issues early warnings for cyber-threats by analyzing darkweb communications and social media activity, demonstrating high relevance and potential for proactive cybersecurity.

Contribution

The paper introduces a novel system that combines darkweb and social media data to generate timely cyber-threat alerts, with demonstrated effectiveness in case studies.

Findings

84% of alerts were relevant to actual threats

Predicted DDoS attacks and data breaches effectively

Enabled organizations to prepare for Mirai attacks

Abstract

We introduce a system for automatically generating warnings of imminent or current cyber-threats. Our system leverages the communication of malicious actors on the darkweb, as well as activity of cyber security experts on social media platforms like Twitter. In a time period between September, 2016 and January, 2017, our method generated 661 alerts of which about 84% were relevant to current or imminent cyber-threats. In the paper, we first illustrate the rationale and workflow of our system, then we measure its performance. Our analysis is enriched by two case studies: the first shows how the method could predict DDoS attacks, and how it would have allowed organizations to prepare for the Mirai attacks that caused widespread disruption in October 2016. Second, we discuss the method's timely identification of various instances of data breaches.