## 7 Analysis of X Cyber Threat Solutions  
Performance metrics such as the confusion matrix, accuracy, recall, precision, F1-score, and PR curve are utilized to evaluate the effectiveness of various deep learning (DL) algorithms. The confusion matrix serves as a tool to represent different metrics, balancing \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Study** & **Focus** & **Methodology** & **Datasets** \\ \hline
[137] & Cybersecurity events & Deep learning model; cascaded CNN architecture & Labelled 21,000 tweets collected using Tweepy \\ \hline
[162] & A novel application of NLP models to detect denial of service attacks using only social media as evidence & Basic neural network & Tweets written on attack day \\ \hline
[163] & Treat the event detection problem in a multimodal X hashtag network & Expectation-maximization (EM) algorithm & Tweets containing hashtag \\ \hline
[118] & A novel tool that uses deep neural networks to process cybersecurity information received from X & SVM, MLP, CNN, BiLSTM & Tweets filtered by keywords \\ \hline
[164] & Analyze the severity of cybersecurity threats based on the language that is used to describe them online & Supervised ML models & Tweets containing “DDoS” and “vulnerability” \\ \hline
[165] & Cybersecurity-related data & Three supervised ML models; SVM, MNB, and RF & Real-time cyber attack Data from HuffPost News Site \\ \hline
[138] & Cybersecurity threats relevant data & RF & Filtered tweets collected using X’s streaming API \\ \hline
[139] & Collection method of Cyber threat tweets & Centroid, One-class SVM, CNN, LSTM & Streaming Tweets \\ \hline
[16] & A multitask learning approach combining two Natural Language Processing tasks for cyberthreat intelligence & Multitask Learning (MTL) & Streaming Tweets \\ \hline
[113] & A novel word embedding model, called contrastive word embedding, that enables to maximize the difference between base embedding models & CNN, RNN and LSTM & Curated data, OSINT data, and background knowledge \\ \hline
[14] & - Detection of cyber threat events on tweets. - Named Entity Recognition (NER) for tweets & Multitask learning NLP, IDCNN, BiLSTM & Streaming Tweets \\ \hline
[140] & Cybersecurity-related discussions & Four supervised machine learning models; Decision Tree, Random Forests, SVM, Sampling API \\ \hline
[141] & Cybersecurity threats relevant data & Five ML models: SVM, Random Forest, Decision Tree, XGBoost and AdaBoost & Labelled 21,000 tweets were collected using a python package Tweepy \\ \hline
[142] & Cybersecurity-related data & Deep learning model; CNN architecture & Social network messages \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._selectivity and specificity, with the goal of minimizing the time spent on Type I and Type II errors. The output of machine learning (ML) and DL algorithms is assessed through the confusion matrix, which helps assign input data to distinct labels. Widely regarded for its simplicity and effectiveness, the confusion matrix compares expected and observed values, using four key elements: true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN). In this context, a true positive (TP) occurs when both observed and expected values are positive, such as in the detection of cyber threats. A true negative (TN) occurs when both observed and predicted values are negative, indicating the absence of cyber threats. A false positive (FP) occurs when the observed value is negative, but the expected value is positive. Conversely, a false negative (FN) is when the observed value is positive, but the predicted value is negative. Accuracy, which is the inverse of the error rate, is a commonly used performance metric in classification tasks. However, it may not be ideal for imbalanced datasets. Recall, on the other hand, measures the ability of a classifier to correctly identify true instances of a cyber threat.