Cited by 126Network Security and Intrusion DetectionText and Document Classification TechnologiesTopic Modeling

Cyberthreat Detection from Twitter using Deep Neural Networks

Open access
Dionisio, Nuno, Alves, Fernando, Ferreira, Pedro M., Bessani, Alysson·2019·2019 International Joint Conference on Neural Networks (IJCNN)

Abstract

To be prepared against cyberattacks, most organizations resort to security information and event management systems to monitor their infrastructures. These systems depend on the timeliness and relevance of the latest updates, patches and threats provided by cyberthreat intelligence feeds. Open source intelligence platforms, namely social media networks such as Twitter, are capable of aggregating a vast amount of cybersecurity-related sources. To process such information streams, we require scalable and efficient tools capable of identifying and summarizing relevant information for specified assets. This paper presents the processing pipeline of a novel tool that uses deep neural networks to process cybersecurity information received from Twitter. A convolutional neural network identifies tweets containing security-related information relevant to assets in an IT infrastructure. Then, a bidirectional long short-term memory network extracts named entities from these tweets to form a security alert or to fill an indicator of compromise. The proposed pipeline achieves an average 94% true positive rate and 91% true negative rate for the classification task and an average F1-score of 92% for the named entity recognition task, across three case study infrastructures.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/ijcnn.2019.8852475

Cites

29 of 29 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Studies justify semantic and structural features per QA1 for capturing subtle behavioral cues that traditional metrics miss.

    “Studies justify these features per QA1 for capturing subtle behavioral cues, such as sentiment shifts or entity relationships, that traditional metrics miss [17,70].”

    From A systematic review on insider threat detection using natural language processing (2025) · cites this paper as [70]

    The Named entity recognition section (page unavailable) describes semantic word representations and extracting security-related entities from tweets, supporting the use of semantic features to identify entities. It does not show that these features capture behavioral cues such as sentiment shifts or relationships between entities, or compare them with traditional metrics on that point. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

2 of the 31 references couldn’t be matched to a known paper.

Research works printed but not linked: 2

  1. Q. Le Sceller, E. B. Karbab, M. Debbabi, and F. Iqbal, "SONAR: Automatic Detection of Cyber Security Events over the Twitter Stream," in Proc. of the 12th International Conference on Availability, Reliability and Security (ARES). Association for Computing Machinery, 2017.
  2. C. Wagner, A. Dulaunoy, G. Wagener, and A. Iklody, "MISP: The Design and Implementation of a Collaborative Threat Intelligence Sharing Plat- form," in Proc. of the 2016 ACM on Workshop on Information Sharing and Collaborative Security (WISCS). Association for Computing Machinery, 2016.

Cited by

Sorted by citations

Authors
Dionisio, N., Alves, F., Ferreira, P. M., & Bessani, A.
Affiliations
University of Lisbon (PT)
Venue
2019 International Joint Conference on Neural Networks (IJCNN)
Publisher
IEEE
Published
2019-07
Pages
1-8
ISSN
2161-4407 (ISSN-L)
OpenAlex
W2934951104
Cited by
126
References
31
Citations by year
2026: 6 · 2025: 23 · 2024: 17 · 2023: 28 · 2022: 18 · 2021: 17 · 2020: 13 · 2019: 4
FWCI
11.23
Type
conference paper
Language
en
Open access
Locations
  • International Joint Conference on Neural Networks (IJCNN) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
Horizon 2020 Framework Programme (700692)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Text and Document Classification Technologies
  • Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
Keywords
Twitter, open source intelligence, named entity recognition, bidirectional LSTM, convolutional neural networks, security alerts, indicators of compromise, IT infrastructure monitoring, deep neural network

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review