# Generating Cyber Threat Intelligence to Discover Potential Security Threats Using Classification and Topic Modeling

**Authors:** Md Imran Hossen, Ashraful Islam, Farzana Anowar, Eshtiak Ahmed, Mohammad Masudur Rahman,  Xiali,  Hei  
**arXiv:** [2108.06862](https://arxiv.org/abs/2108.06862)  
**Date:** 2021-08-16  
**Summary page:** https://www.summarizepaper.com/en/paper/2108.06862v3/

## Key points

- Authors explore the use of Cyber Threat Intelligence (CTI) from hacker forums to detect security threats
- Two datasets constructed: binary dataset and multi-class dataset
- Supervised learning techniques used, including classification algorithms and deep neural network-based classifiers
- Unsupervised techniques employed, specifically topic modeling algorithms like Latent Dirichlet Allocation (LDA) and Non-negative Matrix Factorization (NMF)
- LDA and NMF algorithms used for topic modeling with frequency weights for LDA and TF-IDF weights for NMF
- Data processed using regular expressions and lemmatization with spaCy library
- Open-source Python libraries utilized, including scikit-learn, Keras, gensim, and Word2Vec
- Feature engineering techniques discussed, including bag-of-words (BOW), TF-IDF-based weights, Word2Vec, and Doc2Vec
- Classification tasks performed to separate cybersecurity-relevant posts from non-security posts
- Comparison of different classifiers' performances on datasets, including deep neural network-based classifiers
- Focus on utilizing CTI from hacker forums for threat detection through supervised learning (classification) and unsupervised learning (topic modeling)
- Experimental results provide insights into effectiveness of different techniques in analyzing and predicting cyber threats.

## Summary

In this paper, the authors explore the use of Cyber Threat Intelligence (CTI) from hacker forums to detect potential security threats. They collect data from a real hacker forum and construct two datasets: a binary dataset and a multi-class dataset. To analyze the data, they employ supervised learning techniques such as classification algorithms and deep neural network-based classifiers. They also utilize unsupervised techniques, specifically topic modeling algorithms like Latent Dirichlet Allocation (LDA) and Non-negative Matrix Factorization (NMF), to further explore the datasets. Topic modeling is an unsupervised learning approach that helps identify and determine topics in a set of documents. It can be a powerful tool for finding latent topics in large unlabeled datasets. The authors use LDA and NMF algorithms for topic modeling in this study. They apply frequency weights as features to LDA, while TF-IDF weights are used for the NMF algorithm. The experimental setup involves processing the data using regular expressions and lemmatization with the spaCy library. Open-source Python libraries such as scikit-learn, Keras, gensim, and Word2Vec are utilized for various tasks including classification development, training models, and topic modeling. The authors also discuss feature engineering techniques used in their study. They employ standard techniques like bag-of-words (BOW) and term frequency-inverse document frequency (TF-IDF)-based weights. Additionally, they experiment with more advanced feature engineering techniques based on deep learning models like Word2Vec and Doc2Vec. In terms of supervised methods, the authors perform classification tasks to accurately separate cybersecurity-relevant posts from non-security posts. They compare the performances of different classifiers on their datasets, including deep neural network-based classifiers. Overall, this paper focuses on utilizing CTI from hacker forums to detect potential security threats through both supervised learning (classification) and unsupervised learning (topic modeling) approaches. The experimental results and methodologies provide insights into the effectiveness of different techniques in analyzing and predicting cyber threats.