## 6 X Security: ML/DL Solutions
### Detection of Security Content  
X is a popular social media platform used by millions of users worldwide to share information. However, there is a concern about the spread of false information or propaganda by malicious actors with security implications. To address this, researchers have proposed various methods for detecting security-related content on X, including natural language processing, ML algorithms, and human expert judgment. These proposals aim to provide a means for detecting malicious content and ensuring the security and reliability of information disseminated on X. In this section, we will examine a body of literature that has put forth proposals aimed at detecting security-related content that is disseminated on X. In their study [143]. Introduced a novel framework for detecting localized events by analyzing the presence of bursty keywords and the spatial distribution of documents. The authors emphasized the importance of incorporating both temporal and spatial aspects in event detection. The framework they presented is based on the assumption that the occurrence of bursty keywords and their spatial distribution can provide useful clues in identifying localized events. This framework is designed to identify localized events in real time and can provide valuable information to decision makers in various domains. The authors' innovative approach to event detection has the potential to revolutionize the way we analyze and understand events, providing a more comprehensive and accurate picture of what is happening on the ground. The Cyber X framework by [144] is a profile-based system that utilizes X's API to retrieve tweets that pertain to security-related topics and system profiles. The Security Vulnerability Concept Extractor (SVCE) is then employed to extract terms that are related to security vulnerabilities, with only tweets that contain two or more terms being retained for further analysis. These terms are tagged with technical descriptors, such as means of attack, consequences, affected software and hardware, and version numbers. The output from the SVCE is mapped to real-world concepts using DBpedia and YAGO ontologies, as well as the Unified Cybersecurity Ontology (UCO) to provide context-specific knowledge. The resulting data are stored as triples in a local Cybersecurity Knowledge Base (KB) and a set of Semantic Web Rule Language (SWRL) rules are added to the system to reason over the KB and generate alerts based on potential threats and vulnerabilities. As shown in Figure 4, the rules interpret the relationships between elements in the KB and update the system's state when new tweets arrive, triggering alerts when threats are detected. These alerts are reviewed by cybersecurity experts and used to inform their security policies as necessary. In a ten-day experimental evaluation, it was found that 13 out of 15 alerts were considered useful by assessors. However, the framework is limited in its ability to detect the context of tweets, which is crucial in differentiating tweets that discuss emerging attacks from those that discuss security-related topics in general. In the study by [146], a real-time text-mining approach was utilized to detect unfamiliar security terms from tweets posted by a predetermined set of 69 security experts. The process involved retrieving tweets every 60 min, filtering unique words and excluding words that appeared in dictionaries of English, stop-words, technical terms, and Italian terms. The remaining words were considered new security threats if they were mentioned in the same tweet with terms contained in a threat dictionary. The generated information included the new term, its volume of mentions in the past 60 min, the contents of the posts, and related words. The entire process from retrieving tweets to generating warnings took approximately 0.6 s, resulting in an accuracy rate of 84%. One notable example was the detection of the Mirai term 49 days prior to the actual attack in October 2016.