# Processing Tweets for Cybersecurity Threat Awareness

arXiv: https://arxiv.org/abs/1904.02072 · HTML: https://mlsanity.com/paper/1904.02072/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Apr 2019.

## Built on by (most cited first, 10 of 10)

- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [Evaluation of LLM Chatbots for OSINT-based Cyber Threat Awareness](https://mlsanity.com/paper/2401.15127/) (2024)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [A Framework for Unsupervised Classificiation and Data Mining of Tweets about Cyber Vulnerabilities](https://mlsanity.com/paper/2104.11695/) (2021)
- [Social Media Monitoring for IoT Cyber-Threats](https://mlsanity.com/paper/2109.04306/) (2021)
- [Perspectives of Non-Expert Users on Cyber Security and Privacy: An Analysis of Online Discussions on Twitter](https://mlsanity.com/paper/2206.02156/) (2022)
- [A Risk Manager for Intrusion Tolerant Systems: Enhancing HAL 9000 with New Scoring and Data Sources](https://mlsanity.com/paper/2508.13364/) (2025)
- [CTI Dataset Construction from Telegram](https://mlsanity.com/paper/2509.20943/) (2025)
- [Large Language Models for Explainable Threat Intelligence](https://mlsanity.com/paper/2511.05406/) (2025)
- [Identification of Malicious Posts on the Dark Web Using Supervised Machine Learning](https://mlsanity.com/paper/2511.23183/) (2025)

## Abstract (arXiv)

Receiving timely and relevant security information is crucial for maintaining a high-security level on an IT infrastructure. This information can be extracted from Open Source Intelligence published daily by users, security organisations, and researchers. In particular, Twitter has become an information hub for obtaining cutting-edge information about many subjects, including cybersecurity. This work proposes SYNAPSE, a Twitter-based streaming threat monitor that generates a continuously updated summary of the threat landscape related to a monitored infrastructure. Its tweet-processing pipeline is composed of filtering, feature extraction, binary classification, an innovative clustering strategy, and generation of Indicators of Compromise (IoCs). A quantitative evaluation considering all tweets from 80 accounts over more than 8 months (over 195.000 tweets), shows that our approach timely and successfully finds the majority of security-related tweets concerning an example IT infrastructure (true positive rate above 90%), incorrectly selects a small number of tweets as relevant (false positive rate under 10%), and summarises the results to very few IoCs per day. A qualitative evaluation of the IoCs generated by SYNAPSE demonstrates their relevance (based on the CVSS score and the availability of patches or exploits), and timeliness (based on threat disclosure dates from NVD).