# A Novel Approach for Detection and Ranking of Trendy and Emerging Cyber Threat Events in Twitter Streams

arXiv: https://arxiv.org/abs/1907.07768 · HTML: https://mlsanity.com/paper/1907.07768/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Jul 2019.

## Built on by (most cited first, 5 of 5)

- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [False Alarms, Real Damage: Adversarial Attacks Using LLM-based Models on Text-based Cyber Threat Intelligence Systems](https://mlsanity.com/paper/2507.06252/) (2025)
- [EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions](https://mlsanity.com/paper/2507.09762/) (2025)
- [Motion-Based Handwriting Recognition and Word Reconstruction](https://mlsanity.com/paper/2101.06025/) (2021)
- [Multi-Lingual Cyber Threat Detection in Tweets/X Using ML, DL, and LLM: A Comparative Analysis](https://mlsanity.com/paper/2502.04346/) (2025)

## Abstract (arXiv)

We present a new machine learning and text information extraction approach to detection of cyber threat events in Twitter that are novel (previously non-extant) and developing (marked by significance with respect to similarity with a previously detected event). While some existing approaches to event detection measure novelty and trendiness, typically as independent criteria and occasionally as a holistic measure, this work focuses on detecting both novel and developing events using an unsupervised machine learning approach. Furthermore, our proposed approach enables the ranking of cyber threat events based on an importance score by extracting the tweet terms that are characterized as named entities, keywords, or both. We also impute influence to users in order to assign a weighted score to noun phrases in proportion to user influence and the corresponding event scores for named entities and keywords. To evaluate the performance of our proposed approach, we measure the efficiency and detection error rate for events over a specified time interval, relative to human annotator ground truth.