Processing Tweets for Cybersecurity Threat Awareness
  Receiving timely and relevant security information is crucial for maintaining
a high-security level on an IT infrastructure. This information can be
extracted from Open Source Intelligence published daily by users, security
organisations, and researchers. In particular, Twitter has become an
information hub for obtaining cutting-edge information about many subjects,
including cybersecurity. This work proposes SYNAPSE, a Twitter-based streaming
threat monitor that generates a continuously updated summary of the threat
landscape related to a monitored infrastructure. Its tweet-processing pipeline
is composed of filtering, feature extraction, binary classification, an
innovative clustering strategy, and generation of Indicators of Compromise
(IoCs). A quantitative evaluation considering all tweets from 80 accounts over
more than 8 months (over 195.000 tweets), shows that our approach timely and
successfully finds the majority of security-related tweets concerning an
example IT infrastructure (true positive rate above 90%), incorrectly selects a
small number of tweets as relevant (false positive rate under 10%), and
summarises the results to very few IoCs per day. A qualitative evaluation of
the IoCs generated by SYNAPSE demonstrates their relevance (based on the CVSS
score and the availability of patches or exploits), and timeliness (based on
threat disclosure dates from NVD).
