AI-based Cyber Event OSINT via Twitter Data

Open-Source Intelligence (OSINT) is largely regarded as a necessary component for cybersecurity intelligence gathering to secure network systems. With the advancement of artificial intelligence (AI) and increasing usage of social media, like Twitter, we have a unique opportunity to obtain and aggregate information from social media. In this study, we propose an AI-based scheme capable of automatically pulling information from Twitter, filtering out security-irrelevant tweets, performing natural language analysis to correlate the tweets about each cybersecurity event (e.g., a malware campaign), and validating the information. This scheme has many applications, such as providing a means for security operators to gain insight into ongoing events and helping them prioritize vulnerabilities to deal with. To give examples of the possible uses, we present three case studies demonstrating the event discovery and investigation processes.

I. Introduction

Cyber attacks on network infrastructures are becoming more frequent and catastrophic. For example, Microsoft was a victim of a data breach discovered in January 2020 that caused over 250 million customer records leaked online [1]. In May 2021, Colonial Pipeline was hit with a ransomware attack [2] that caused gas supply to the east coast of the United States to be completely cut off for days. Cyber attacks are also constantly evolving. Sonicwall found 442,151 new malware variants in 2021, an increase of 65% over 2020 [3].