From Local Reports to Security Alerts
A service becomes unreachable. Local users start posting about it, and a news report adds context. Which reports should a security analyst investigate? This workflow turns a stream of Turkish posts and news into a queue of possible incidents, with source reports to check.
From my M.Sc. research at METU with Prof. Cengiz Acartürk, published at ICISSP 2021. The contribution is a working path from language-specific text processing to alerts for analyst review.
Where this workflow could help
Local incident monitoring. Follow reports naming an organisation or service and flag unusual attention for investigation. An analyst can check whether people are describing an outage, an attack or an ordinary conversation.
Threat-intelligence triage. Bring local-language news and user reports into the same review queue, including warnings about vulnerable applications. The source text gives an analyst evidence to follow up.
Building a research corpus. Collect candidate security reports for later review and labelling. The vocabulary and target list can be adjusted to the investigation.
These are potential uses of the workflow. The published study evaluated a Turkish-language research prototype.
How the method works
Start from a known incident. The study began without an annotated Turkish cyber-security corpus. It compared text from before, during and after the nic.tr denial-of-service attack. TF-IDF helped identify candidate terms; keyword tests checked whether adding a term found useful reports without introducing excessive false alarms.
Make the language matchable. Turkish builds many word forms through suffixes. Normalising the text through the ITU NLP service lets the detector match forms that would otherwise appear unrelated.
Look for a change around a target. In the filtered text, count daily mentions of a predefined organisation, institution or country. Compare each target with a threshold derived from its own history. This makes the alert traceable to the target, the time period and the reports behind it.
Keep the analyst in the loop. A message asking whether an account was hacked can contain a security keyword without reporting an incident. An alert starts an investigation; source checking determines what happened.
Study scope, limitations and sources
The study used historical Turkish Twitter and Hürriyet newspaper data. Its evaluation included confirmed incidents and false alerts, but did not establish how many events were missed. Applying the workflow to another language, source or time period requires fresh evaluation of vocabulary, normalisation and alert thresholds.
The film illustrates the workflow and reports the original experiment. It is not a comparison against current language models or evidence of a deployed monitoring service. The paper contains the full experimental counts and evaluation criteria.
Read the ICISSP paper by Ural and Acartürk, extending the METU M.Sc. thesis. The text processing uses the ITU NLP service (Eryiğit, 2014).
Explore the original technical animation for the diagrams and formulas behind the workflow.