More Like this

1. Cross-Lingual Cybersecurity Analytics in the International Dark Web with Adversarial Deep Representation Learning

   https://doi.org/10.25300/MISQ/2022/16618  

   Ebrahimi, M; Chai, Y; Samtani, S; and Chen, H. (June 2022, MIS quarterly)

   International dark web platforms operating within multiple geopolitical regions and languages host a myriad of hacker assets such as malware, hacking tools, hacking tutorials, and malicious source code. Cybersecurity analytics organizations employ machine learning models trained on human-labeled data to automatically detect these assets and bolster their situational awareness. However, the lack of human-labeled training data is prohibitive when analyzing foreign-language dark web content. In this research note, we adopt the computational design science paradigm to develop a novel IT artifact for cross-lingual hacker asset detection(CLHAD). CLHAD automatically leverages the knowledge learned from English content to detect hacker assets in non-English dark web platforms. CLHAD encompasses a novel Adversarial deep representation learning (ADREL) method, which generates multilingual text representations using generative adversarial networks (GANs). Drawing upon the state of the art in cross-lingual knowledge transfer, ADREL is a novel approach to automatically extract transferable text representations and facilitate the analysis of multilingual content. We evaluate CLHAD on Russian, French, and Italian dark web platforms and demonstrate its practical utility in hacker asset profiling, and conduct a proof-of-concept case study. Our analysis suggests that cybersecurity managers may benefit more from focusing on Russian to identify sophisticated hacking assets. In contrast, financial hacker assets are scattered among several dominant dark web languages. Managerial insights for security managers are discussed at operational and strategic levels. 

   more » « less
2. Cyber Threat Intelligence Discovery using Machine Learning from the Dark Web

   https://doi.org/10.58729/1941-6687.1436  

   Zenebe, Azene (January 2022, Communications of the IIMA)

   Cyber threat intelligence (CTI) is an actionable information or insight an organization uses to understand potential vulnerabilities it does have and threats it is facing. One important CTI for proactive cyber defense is exploit type with possible values system, web, network, website or Mobile. This study compares the performance of machine learning algorithms in predicating exploit types using form posts in the dark web, which is a semi- structured dataset collected from dark web. The study uses the CRISP data science approach. The results of the study show that machine learning algorithms which are function-based including support vector machine and deep-learning using artificial neural network are more accurate than those algorithms which are based on tree including Random Forest and Decision-Tree for CTI discovery from semi-structured dataset. Future research will include the use of high-performance computing and advanced deep-learning algorithms. 

   more » « less
3. Generating Fake Cyber Threat Intelligence Using Transformer-Based Models

   Ranade, P.; Piplai, A.; Mittal, S.; Joshi, A.; Finin, T (July 2021, International Joint Conference on Neural Networks 2021 (IJCNN 2021))

   Cyber-defense systems are being developed to automatically ingest Cyber Threat Intelligence (CTI) that contains semi-structured data and/or text to populate knowledge graphs. A potential risk is that fake CTI can be generated and spread through Open-Source Intelligence (OSINT) communities or on the Web to effect a data poisoning attack on these systems. Adversaries can use fake CTI examples as training input to subvert cyber defense systems, forcing the model to learn incorrect inputs to serve their malicious needs. In this paper, we automatically generate fake CTI text descriptions using transformers. We show that given an initial prompt sentence, a public language model like GPT-2 with fine-tuning, can generate plausible CTI text with the ability of corrupting cyber-defense systems. We utilize the generated fake CTI text to perform a data poisoning attack on a Cybersecurity Knowledge Graph (CKG) and a cybersecurity corpus. The poisoning attack introduced adverse impacts such as returning incorrect reasoning outputs, representation poisoning, and corruption of other dependent AI-based cyber defense systems. We evaluate with traditional approaches and conduct a human evaluation study with cybersecurity professionals and threat hunters. Based on the study, professional threat hunters were equally likely to consider our fake generated CTI as true. 

   more » « less
4. Knowledge Graph based Learning Guidance for Cybersecurity Hands-on Labs

   https://doi.org/10.1145/3300115.3309531  

   Deng, Yuli; Lu, Duo; Huang, Dijiang; Chung, Chun-Jen; Lin, Fanjie (May 2019, ACM Global Computing Education Conference (CompEd))

   Hands-on practice is a critical component of cybersecurity education. Most of the existing hands-on exercises or labs materials are usually managed in a problem-centric fashion, while it lacks a coherent way to manage existing labs and provide productive lab exercising plans for cybersecurity learners. With the advantages of big data and natural language processing (NLP) technologies, constructing a large knowledge graph and mining concepts from unstructured text becomes possible, which motivated us to construct a machine learning based lab exercising plan for cybersecurity education. In the research presented by this paper, we have constructed a knowledge graph in the cybersecurity domain using NLP technologies including machine learning based word embedding and hyperlink-based concept mining. We then utilized the knowledge graph during the regular learning process based on the following approaches: 1. We constructed a web-based front-end to visualize the knowledge graph, which allows students to browse and search cybersecurity-related concepts and the corresponding interdependence relations; 2. We created a personalized knowledge graph for each student based on their learning progress and status; 3.We built a personalized lab recommendation system by suggesting more relevant labs based on students’ past learning history to maximize their learning outcomes. To measure the effectiveness of the proposed solution, we have conducted a use case study and collected survey data from a graduate-level cybersecurity class. Our study shows that, by leveraging the knowledge graph for the cybersecurity area study, students tend to benefit more and show more interests in cybersecurity area. 

   more » « less
5. Leveraging Cross-Domain Transfer Learning for Enhanced Multi-Protocol Network Intrusion Detection

   https://doi.org/10.3390/computers15060376  

   Oladejo, Oluwaseyi; Ahmed, Ahmed Abdelmoamen (June 2026, Computers)

   The exponential growth of cyber threats in modern digital infrastructure demands advanced detection systems that adapt to evolving attack patterns. Traditional cybersecurity approaches struggle with dynamic threats, requiring extensive labeled datasets and retraining for each new category. This paper presents a comprehensive transfer learning framework for cybersecurity threat detection, leveraging the CICIoMT dataset as a benchmark to enhance detection capabilities across heterogeneous cybersecurity environments. We propose a machine learning (ML)-enabled framework that employs systematic feature alignment, hybrid class balancing, and multi-algorithm evaluation using machine learning models, including Multi-Layer Perceptron (MLP), Support Vector Machine (SVM), Random Forest (RF), Gradient Boosting, and XGBoost. The proposed approach addresses the critical challenges of data scarcity and domain heterogeneity in cybersecurity by enhancing feature engineering with cybersecurity-specific features, statistical aggregations, and PCA embeddings. Extensive experimental evaluation across two target datasets (CICIoT and IoT-23) demonstrates both the exceptional successes and critical limitations of cross-domain transfer learning in cybersecurity. The framework achieved outstanding performance on domain-compatible datasets, with RF reaching 99.0% accuracy on CICIoT, Gradient Boosting achieving 98.9%, and XGBoost delivering 98.4%, demonstrating exceptional knowledge transfer from medical IoT to smart home IoT environments. However, transfer learning to IoT-23 was unsuccessful (50% accuracy, equivalent to random guessing), revealing that feature domain difference, where identical attack labels encode fundamentally different behavioral patterns, prevents effective knowledge transfer despite nominal class overlap. This research makes significant advances in adaptive cybersecurity systems by providing a rigorous evaluation of both the successes and limitations of transfer learning. This work demonstrates that ensemble methods (RF, XGBoost, and Gradient Boosting) achieve superior cross-domain performance compared with neural networks on compatible domains, while also revealing fundamental challenges when the source and target domains differ in their feature spaces. 

   more » « less