## 6 X Security: ML/DL Solutions
### Detection of Vulnerabilities and Exploits on X
The SMASH process involves conducting a search for security and vulnerability terminologies as well as software components from sources such as X and the National Vulnerability Database (NVD) and storing the information in a local database. Subsequently, tweets are grouped together through the utilization of a modified K-mean clustering algorithm, which takes into account the context of each tweet. The NVD serves as a reference point to differentiate between old and new information regarding vulnerabilities. Currently, this process is conducted manually. The results of this research showed that 100% of the NVD weaknesses were mentioned on X, with 41% of Common Vulnerabilities and Exposures (CVEs) being published on X prior to the official NVD release, with an average of 20 days in advance. Additionally, approximately 75% of Linux-Kernel zero-day vulnerabilities were disclosed on X before the official disclosure, with an average lead time of 19 days. Ref. [135] proposed a novel crowd-sourced vulnerability detection system that utilizes X as the main source of real-time information. The system employs the use of security-specific keywords to identify tweets that pertain to potential security incidents or anomalies in online services or accounts. Subsequently, the proposed model compares these tweets with the vulnerability descriptions present in the Common Vulnerabilities and Exposures database (CVE-DB) to determine whether the detected behavior constitutes a new vulnerability or a zero-day exploitation of a previously known vulnerability. Ref. [136] utilized a corpus of tweets posted by security experts to construct a Support Vector Machine (SVM) classifier with the objective of segregating tweets that contained security alerts and software patch/fix information from general security discussions. The classifier was developed utilizing three sets of word frequency features: unigram, bigram, and a combination of both. The study found that the proposed model had an accuracy rate of 94% when classifying tweets over a one-year time period [137]. However, the authors noted that the methodology, which is based solely on word appearance in tweets, can result in misclassification of tweets as false positive. This occurs when security-related words appear in both security-related and non-security-related tweet phrases, leading to the misclassification of general discussions as useful alerts, and vice versa. [PERSON]. [137] introduced a cascaded convolutional neural network (CNN) framework for identifying and categorizing cyber attack-related events on X. This approach involves two CNN models: a binary classifier to distinguish cyber-related from irrelevant tweets, followed by a multi-class classifier to assign specific threat labels (DDoS, zero-day vulnerabilities, ransomware, data leaks, or marketing/general) to the identified cyber tweets. The model was trained on a dataset of approximately 21,000 annotated tweets. The model achieved an average F1-score of 0.82 in classifying cyber threats. Ref. [138] developed a Random Forest model to automatically classify cyber threats using X data, achieving an accuracy of 80%. Ref. [139], the authors addressed the discrepancy between the CVE-DB and the findings of [134] by developing a method for identifying security-related tweets that contain information about vulnerabilities, even if the specific vulnerability ID is not mentioned. To do this, they propose a model that leverages the CVE-DB to learn the features of vulnerabilities through the use of a centroid classifier. The model is trained using descriptions of vulnerabilities as positive samples. The pipeline begins by collecting tweets from specialized security accounts and extracting TF-IDF features for each tweet. The tweets are then passed through the trained model and classified as normal or not based on their distance from the centroid and a specified threshold value.