## 6 X Security: ML/DL Solutions
### Detection of Security Content
[149] combined the moving threshold average algorithm with the Gaussian tweet sentiment signal detection algorithm and the top hashtag. Analysis algorithm to develop a new sentiment analysis model for X data. The proposed model was able to effectively identify the sentiment of tweets, and the hashtags associated with them. The results showed that the proposed model outperformed traditional sentiment analysis algorithms in terms of accuracy and efficiency. The study also showed that the combination of the moving threshold average algorithm and the Gaussian  
Figure 7: SYNAPSE’s architecture, adapted from [148]. tweet sentiment signal detection algorithm improved the accuracy of sentiment analysis by detecting the sentiment signal more effectively. The top hashtag analysis algorithm helped to identify the hashtags associated with the sentiment and provide a more comprehensive analysis of the sentiment expressed in the tweets. This study highlights the importance of combining multiple algorithms to improve the accuracy of sentiment analysis in social media data. Ref. [151] presented a X-based framework for detecting traffic incidents as a supplementary method for monitoring traffic conditions. This framework involved the collection of a large volume of tweets using X API endpoints, which were then labeled through a systematic and efficient process that incorporated shortcuts for speed without sacrificing data quality. The labeled data were used to develop a DL model for detecting traffic-related events from X streams. The tweets were transformed into numerical feature matrixes using word-embedding models, and CNN and RNN architectures were utilized to distinguish traffic-related tweets. The results of the experiments showed that the proposed model outperformed existing models in the field. However, to fully implement the framework, a geocoder must be developed to identify the location of traffic events and disseminate the relevant information to users in real-time. This system can provide benefits to travelers by helping them choose the most efficient routes, as well as assisting traffic management agencies in restoring smooth traffic flow by detecting unexpected changes in traffic flow characteristics. The study by [118] investigates the real-time detection of security information relevant to IT infrastructure, as shown in Figure 9. In this work, tweets from two sets of security-related accounts are collected and processed in three-time intervals. The tweets are filtered based on keywords and transformed into numerical representations using word2 vec word embedding. These embedded tweets are then input into three parallel CNN layers for classification. The output of this model is a binary classification of each tweet as security-related or not, followed by Named Entity Recognition (NER) to extract key entities such as company, asset, vulnerability, or IDs using a bidirectional Long Short-Term Memory Network (BiLSTM). The extracted entities are then utilized to generate  
Figure 8: Data mining situational awareness scheme, adapted from [150]. Indicator of Compromise (IoC) alerts. The classification performance was evaluated and achieved a true positive rate (TPR) of 94% and a true negative rate (TNR) of 91%, while the NER achieved a F1-score of 92% in specifying the correct labels. A comparison between the discovered IoCs and traditional security databases such as the National Vulnerability Database (NVD) revealed that the model was able to detect vulnerability information 1 to 149 days ahead of NVD. Ref. [14] proposed a multitask learning approach based on the iterated dilated convolutional neural network (IDCNN) and Bidirectional Long Short-Term Memory (BiLSTM) natural language processing technology. The ML algorithm was presented to set up a highly accurate network model. Ref. [152] used locality-sensitive hashing to roughly find related items and incremental clustering to implement a realistic, real-time event detection algorithm.