Open-Source Threat Intelligence Collection using Machine Learning and Social Network Analysis

People tend to share information on the social media platforms intending it to be for specific group of users. However, the shared information is often available publicly to anyone, and can be used in unexpected ways. One such social network is Twitter platform which is considered as a rich source of Open-Source Intelligence (OSINT). This medium serves as a Cyber Threat Intelligence (CTI) environment among cybersecurity practitioners both offensive and defensive. CTI includes information about indicators of vulnerabilities, attacks, malware, and other types of cyber events. Apart from its popularity among all age groups, Twitter has a bot-friendly API for data scraping to collect the data from its platform. One can scrap all of the hashtags, posts, statuses, timelines, followers and following data, bio and whatever is available on the platform.

Here, we are trying to solve two problems related to OSINT social network. In the current world, information related to cyber world is important to both organization and an individual. Access and availability of such information is crucial and a necessity to the cybersecurity communities and organizations. The problem we are addressing here is to identify the new sources of CTI information in the Twitter social network by applying community detection techniques of Social Network Analysis and also by applying the relevant metrics.

The credibility of the information available in social media is questionable now-a-days. The data from low credible sources may spread misinformation and tends to misguide the information user. To avoid this, the reputation of the Twitter sources of CTI or credibility of the information from them is measured based on Social Network Analysis metrics as well as its historical credit.

Current Team Members:

Shreya Gopal Sundari
PI: Vahid Behzadan

Tools and Datasets: N/A

Publications: N/A