Detecting Cyber-Security Events in a Low-Resource Language, animated

No labelled corpus, so the incident becomes the training set. There is no annotated Turkish cyber-security dataset to learn from. The way around it is to pick an incident whose answer is already known: the nic.tr denial-of-service attack of 14 December 2015, and pull three corpora around it: 2,310 tweets from the quiet year before, 28 from the attack day itself, and roughly 400 from the fortnight after. TF-IDF across those tells you which terms genuinely separate an attack from ordinary Turkish.

Every candidate keyword is then A/B tested on false positives. A term enters the vector only if it raises detections without flooding the analyst's queue. That is the correct thing to optimise here: in a rare-event problem the false-positive term is multiplied by an enormous negative class, so it, not recall, is what decides whether anyone keeps using the tool.

The vector is squeezed from both sides. Too many keywords and the system ingests more documents than it can process while false positives climb, so certainty falls. Too few and events are missed, or noticed days late instead of on the attack day, so sensitivity falls. No setting maximises both, which is why the paper pins both down as acceptance criteria in advance: detect nic.tr on the day, and stay under 30% false positives over the following two weeks. Both were met.

Turkish decides how much evidence survives preprocessing. The language is agglutinative: meaning is built by stacking suffixes, so one stem yields a combinatorial family of surface forms that keyword matching sees as unrelated tokens. Every document is normalised through the ITU NLP web service before detection. In a low-resource setting this step moves the result more than the choice of model does.

Detection is an anomaly, not a verdict. A named-entity vector lists what can be attacked (institutions, government organisations, countries) and each entity's daily mention count is compared against a threshold derived from its own history. On 14 December 2015 mentions of nic.tr jumped from a background of two or three to 28. No classifier is asked whether that constitutes an attack; the deviation is the signal.

And the scoreboard is published, not rounded away. A sample run over 437 documents (186 tweets and 251 Hürriyet articles) produced 29 detections: 22 real and 7 false, about 76% success. The paper prints its failure mode too: the keyword "hacklendi" firing on an everyday message asking whether someone's account was compromised, which describes no event at all. Reporting the false positives alongside the hits is what makes the number worth anything.