## 6 X Security: ML/DL Solutions
### Detection of Security Content
However, the solution is limited in its ability to detect new attack terms, as it relies on the knowledge of the experts who may not be aware of evolving security threats until they become public, or the attack does not have an unfamiliar name prior to occurrence. Figure 5 in the study provides a visual representation of the proposed algorithm. Ref. [147] introduced a real-time security event detection system that utilizes a taxonomy of cybersecurity events and corresponding seed keywords to identify security-related tweets. Over a nine-month period, the system collected 47.8 million tweets utilizing seed keywords ranging from unigrams to 6-g. To further refine the results, a blacklist of phrases was added to reduce false positives. SONAR groups similar tweets into clusters using cosine similarity and locates the geographic area of high discussion through the use of Google Map Geocoding API. Additionally, it includes a keyword finder that continuously updates the keyword list to remain relevant. The system utilizes GloVe embedding to find semantically related words, allowing for scalability while still relying on the analyst's final decision. The efficiency of SONAR was evaluated with  
Figure 4: Cyber-Twitter architecture, adapted from [145]. positive results, showing that approximately 25% of the detected security events were relevant. The architecture of SONAR is presented in Figure 6.  
The SYNAPSE system [148] is a real-time security event detection tool for IT infrastructure. SYNAPSE utilizes a dataset of over 195,000 tweets, retrieved from two sets of X accounts publishing security-related tweets, designated as S1 and S2. The tweets from the S1 accounts form the training set, while the validation and testing sets are comprised of tweets from both S1 and S2 X accounts, allowing for the possibility of adding more accounts in the future. The tweets are filtered based on security keywords representing  
Figure 5: Running example, adapted from [146]. Figure 6: SONAR architecture, adapted from [147]. three different infrastructures and are then processed using TF-IDF features, a supervised ML approach using MLP and SVM algorithms, and a dynamic stream clustering methodology to group similar tweets into events. The final output of the model is presented in the form of an indicator of compromise (IoC) for manual inspection or integration with threat intelligence tools. The evaluation results showed that SVM achieved a better balance between true positive and true negative classification rates, approximately 90%, and the IoC was evaluated for relevance and modernity, demonstrating the efficiency of the end-to-end model. Figure 7 illustrates the main steps of the SYNAPSE system. In the study conducted by titled DataFreq, the authors present a novel approach for tracking the sentiment score of a particular company in relation to the probability of a potential security breach as shown in Figure 8. To gather relevant information, 70,475 tweets from a set of security expert accounts were collected and filtered based on a security keyword list. A novel ML model was developed using the Logistic Regression algorithm with n-gram feature extraction technique to classify the sentiment of the tweets. The authors also aimed to update the keyword list regularly to ensure that the system can adapt to new security-related terms. Through their experiments, the model successfully identified three new words that indicated potential security breaches. The model's performance was evaluated over a four-week period, during which an increase in phishing attacks was observed during the third week (a holiday). The results indicate the effectiveness of the proposed method, with an 85% precision, 84% recall, and F1-score, reflecting the real-world scenario of an increased number of phishing attacks during holidays. The results are presented to the end user in an easily interpretable format in real time, allowing security analysts to easily monitor the average sentiment score of the company and the most frequently mentioned security issues. Ref.