Automatic Detection of Cyber Security Events from Turkish Twitter Stream and Newspaper Data
Published in Proceedings of the 7th International Conference on Information Systems Security and Privacy (ICISSP), 2021
Cyber-security incidents surface publicly before they surface officially: someone posts that a service is unreachable long before a statement is issued. This paper builds a detector for that signal in Turkish, and the interesting difficulty is not the classifier. Co-authored with Prof. Cengiz Acartürk, my M.Sc. thesis advisor at Middle East Technical University.
Learning a vocabulary with no labelled corpus
There is no annotated Turkish security corpus to train on, so the keyword vector is learned from an incident whose answer is already known: the nic.tr denial-of-service attack of 14 December 2015. TF-IDF across three corpora, the quiet year before, the day itself, and the fortnight after, shows which terms actually separate an attack from ordinary Turkish. Each candidate keyword is then kept only if it finds more real events without flooding the queue with false ones.
The low-resource penalty
Turkish is agglutinative: meaning is built by stacking suffixes onto a stem, so a single root generates dozens of legal surface forms. To a bag-of-words model those look like unrelated tokens, the vocabulary inflates, and the evidence per column becomes too thin for TF-IDF to weigh. A larger classifier does not fix this. Normalising surface forms back onto their stems does, which is the part practitioners tend to under-report: in a morphologically rich language without a large annotated corpus, preprocessing decides more of the result than the model choice does.
Detection by anomaly, not by sentiment
The quantity counted is the named entity that can be attacked, such as institutions, government bodies, countries and companies, rather than the volume of security chatter. Each entity is judged against its own history, because a domain mentioned twice a day is normal while a country mentioned twice is not. On 14 December 2015 the count for nic.tr jumps from a background of two or three to twenty-eight, and no classifier has to be asked whether that constitutes an attack.
Results, stated rather than rounded
Over a sample of 437 documents the system produced 29 detections, 22 of them real: about a 76% success rate. The seven false positives are published alongside, including the case of an everyday message using the word hacklendi to ask whether an account had been compromised. Judging that automatically is genuinely hard, and the paper says so.
There is an animated explainer of this work in the Research Lab, and the underlying M.Sc. thesis is also available.
Recommended citation: Ural, O. and Acartürk, C. (2021). "Automatic Detection of Cyber Security Events from Turkish Twitter Stream and Newspaper Data." In Proceedings of the 7th International Conference on Information Systems Security and Privacy (ICISSP), pp. 66-76. DOI: 10.5220/0010201600660076.
Read paper