# Early Warnings of Cyber Threats in Online Discussions

arXiv: https://arxiv.org/abs/1801.09781 · HTML: https://mlsanity.com/paper/1801.09781/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Jan 2018.

## Built on by (most cited first, 8 of 8)

- [The Role of Machine Learning in Cybersecurity](https://mlsanity.com/paper/2206.09707/) (2022)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [Social Media Monitoring for IoT Cyber-Threats](https://mlsanity.com/paper/2109.04306/) (2021)
- [Psychological Profiling in Cybersecurity: A Look at LLMs and Psycholinguistic Features](https://mlsanity.com/paper/2406.18783/) (2024)
- [EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions](https://mlsanity.com/paper/2507.09762/) (2025)
- [OutCenTR: A novel semi-supervised framework for predicting exploits of vulnerabilities in high-dimensional datasets](https://mlsanity.com/paper/2304.10511/) (2023)
- [SPLAIN: Augmenting Cybersecurity Warnings with Reasons and Data](https://mlsanity.com/paper/2311.11215/) (2023)
- [Identification of Malicious Posts on the Dark Web Using Supervised Machine Learning](https://mlsanity.com/paper/2511.23183/) (2025)

## Abstract (arXiv)

We introduce a system for automatically generating warnings of imminent or current cyber-threats. Our system leverages the communication of malicious actors on the darkweb, as well as activity of cyber security experts on social media platforms like Twitter. In a time period between September, 2016 and January, 2017, our method generated 661 alerts of which about 84% were relevant to current or imminent cyber-threats. In the paper, we first illustrate the rationale and workflow of our system, then we measure its performance. Our analysis is enriched by two case studies: the first shows how the method could predict DDoS attacks, and how it would have allowed organizations to prepare for the Mirai attacks that caused widespread disruption in October 2016. Second, we discuss the method's timely identification of various instances of data breaches.