# Crowdsourcing Cybersecurity: Cyber Attack Detection using Social Media

arXiv: https://arxiv.org/abs/1702.07745 · HTML: https://mlsanity.com/paper/1702.07745/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Feb 2017.

## Built on by (most cited first, 6 of 6)

- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [A Survey of Social Cybersecurity: Techniques for Attack Detection, Evaluations, Challenges, and Future Prospects](https://mlsanity.com/paper/2504.04311/) (2025)
- [EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions](https://mlsanity.com/paper/2507.09762/) (2025)
- [A Robust Cybersecurity Topic Classification Tool](https://mlsanity.com/paper/2109.02473/) (2021)
- [Detection of Dangerous Events on Social Media: A Perspective Review](https://mlsanity.com/paper/2204.01351/) (2022)
- [STRisk: A Socio-Technical Approach to Assess Hacking Breaches Risk](https://mlsanity.com/paper/2411.12435/) (2024)

## Abstract (arXiv)

Social media is often viewed as a sensor into various societal events such as disease outbreaks, protests, and elections. We describe the use of social media as a crowdsourced sensor to gain insight into ongoing cyber-attacks. Our approach detects a broad range of cyber-attacks (e.g., distributed denial of service (DDOS) attacks, data breaches, and account hijacking) in an unsupervised manner using just a limited fixed set of seed event triggers. A new query expansion strategy based on convolutional kernels and dependency parses helps model reporting structure and aids in identifying key event characteristics. Through a large-scale analysis over Twitter, we demonstrate that our approach consistently identifies and encodes events, outperforming existing methods.