# Cyberthreat Detection from Twitter using Deep Neural Networks

## TL;DR

This paper introduces a deep neural network-based pipeline that processes Twitter data to identify and extract cybersecurity threats, enhancing real-time cyber threat intelligence for organizations.

## Contribution

It presents a novel scalable tool combining CNN and LSTM models for cybersecurity-related tweet classification and named entity recognition, improving detection accuracy.

## Key findings

- 94% true positive rate in classification
- 92% F1-score in named entity recognition
- Effective across multiple case studies

## Abstract

To be prepared against cyberattacks, most organizations resort to security information and event management systems to monitor their infrastructures. These systems depend on the timeliness and relevance of the latest updates, patches and threats provided by cyberthreat intelligence feeds. Open source intelligence platforms, namely social media networks such as Twitter, are capable of aggregating a vast amount of cybersecurity-related sources. To process such information streams, we require scalable and efficient tools capable of identifying and summarizing relevant information for specified assets. This paper presents the processing pipeline of a novel tool that uses deep neural networks to process cybersecurity information received from Twitter. A convolutional neural network identifies tweets containing security-related information relevant to assets in an IT infrastructure. Then, a bidirectional long short-term memory network extracts named entities from these tweets to form a security alert or to fill an indicator of compromise. The proposed pipeline achieves an average 94% true positive rate and 91% true negative rate for the classification task and an average F1-score of 92% for the named entity recognition task, across three case study infrastructures.