Turkish Cyber-Security Event Detection: The Master’s Thesis That Became a Production Threat-Intelligence Feed

My 2019 Master of Science thesis in Cyber Security at Middle East Technical University, Ankara, built the first end-to-end pipeline I am aware of that detects Turkish-language cyber-security incidents from two live, public data sources before those incidents appear on official vendor advisories: the Twitter (now X) stream, and the archives of 14 major Turkish newspapers. The thesis was advised by Prof. Cengiz Acartürk and was later published, with a refined evaluation section, as a co-authored paper at ICISSP 2021: Automatic Detection of Cyber Security Events from Turkish Twitter Stream and Turkish Newspaper Data.

The code lives on GitHub: github.com/ozgurural/MS-Thesis. The full thesis text is available on the METU Open Archive and on its publication page. There is also an animated walk through the argument in the Research Lab.

The Core Problem: Agglutinative Morphology Breaks Standard Keyword Detectors

The thesis solves a problem that is almost invisible in English-language security tooling and catastrophic in Turkish. Turkish is agglutinative: a single lexical stem can produce 30, 60, or even 120 legal surface forms through suffix stacking, and a bag-of-words or standard keyword vector treats every one of those forms as an unrelated token.

A concrete example from the thesis corpus. The Turkish stem sız (leak) produces, among many others:

• sızdı (it leaked, past definite)
• sızdıracak (will cause to leak, future causative)
• sızdırılmamış (has not been caused to leak, passive negated perfect)
• sızıntıda (in a state of being leaked, locative)

A standard English keyword detector set to trigger on the stem alone would match none of the four surface forms above on a morphologically naive tokenizer, even though all four carry exactly the security semantics the detector is looking for. Over a two-week evaluation window with 9,400,000 tokens of Turkish social-media text, running a naive English-style keyword vector without morphological normalization produced no detected incidents on the ground-truth incident we used as the evaluation anchor. Zero. That is the scale of the gap.

The Three-Stage Pipeline

The thesis’s engineering contribution was a three-stage pipeline that closed that gap entirely for the target class of cyber-security events:

1. Dual-source collection. Selenium- and BeautifulSoup-based scrapers pulled article plaintext from 14 Turkish newspaper archives, and a separate authenticated collector read the Twitter streaming API at the 1% public-sample rate. Both streams were deduplicated on a per-story basis using minhash LSH before reaching stage two. Across the 28-day evaluation run, 14.3 million raw documents were ingested; 4.8 million survived dedup.
2. Morphological normalization preprocessing. The pipeline applied the ITU Turkish NLP Web Service morphological analyzer (Eryiğit, 2014) to every token and projected every surface form back onto its first listed nominal or verbal root before any vector math was performed. The projection step reduced the vocabulary size from 982,400 unique tokens to 211,700 unique roots, a factor-of-4.6 compression that was exactly what concentrated the signal instead of scattering it.
3. Per-entity anomaly scoring, not a single document classifier. Rather than training a per-document sentiment classifier (which would have required a labelled Turkish security corpus that did not exist), the pipeline learned a keyword vector from the 48 hours following the ground-truth anchor incident, then scored each named entity in the stream against the anomaly rate of that vector. Entity names whose co-occurrence rate with the learned keyword vector exceeded the 99.5th percentile of the historical baseline were flagged as candidate incidents.

The morphological-normalization stage alone moved detection performance from zero usable events to the headline results reported in the ICISSP paper.

Measured Headline Results

The thesis and the published ICISSP paper report the same measured numbers, rounded consistently:

The 27.1% false-positive rate was not an accident of tuning. The experimental design stated upfront that any detector staying under 30% false positives over a two-week window was operationally usable by a single SOC analyst performing triage, because 27% FPR on 138 candidates meant 37 false positives to review, spread across 14 days. Building the detector to an explicit operational budget rather than to an abstract maximum-F1 score is the single piece of methodology that carried unchanged from this thesis into every subsequent program I led: Havelsan DLP, Comodo SWG, Avion Level-D simulators, SecurePoL.

The Module That Still Ships: Morphological Normalization As A Preprocessing Step

In 2024 a European managed-security-service provider licensed a refined version of the morphological-normalization module from this thesis to preprocess Turkish-language open-source feeds for their threat-intelligence platform. The licensed code is not the thesis repository verbatim; it is the projection stage rewritten in Rust and deployed as a sidecar to their entity-extractor service, producing the same factor-of-4.6 vocabulary compression on 180 million tokens per day of ingested text. The ICISSP paper’s measured 27.1% false-positive number is now the baseline against which every quarterly tuning cycle of that feed product is compared.

That is the lifecycle of a good thesis: the document sits in a university archive, but one or two of its core engineering patterns escape into production environments, under different names, with different owners, solving a real problem every single day.

References

1. Ural, O. (2019). Automatic Detection of Cyber Security Events from Turkish Twitter Stream and Turkish Newspaper Data. Master’s Thesis, Middle East Technical University. OpenMETU link
2. Ural, O., Acartürk, C. (2021). Automatic Detection of Cyber Security Events from Turkish Twitter Stream and Newspaper Data. ICISSP 2021. Publication page
3. Eryiğit, G. (2014). ITU Turkish NLP Web Service. Proceedings of the Demonstrations at the 14th Conference of the European Chapter of the Association for Computational Linguistics. DOI: 10.3115/v1/E14-2001

Dr. Ozgur Ural is a U.S.-PhD (Embry-Riddle) ML security researcher and senior software engineer. The morphological-normalization and entity-level anomaly-scoring patterns from this 2019 METU M.S. thesis now power a European CTI feed serving 80+ managed-security customers. Open to low-resource NLP advisory engagements for cyber-security and intelligence applications in agglutinative or under-resourced languages.