# EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions

arXiv: https://arxiv.org/abs/2507.09762 · HTML: https://mlsanity.com/paper/2507.09762/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 61 references that are in the map.
- First posted on arXiv 13 Jul 2025.

## Builds on (most cited first, 18 of 18)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [SimCSE: Simple Contrastive Learning of Sentence Embeddings](https://mlsanity.com/paper/2104.08821/) (2021)
- [Zero-Shot Entity Linking by Reading Entity Descriptions](https://mlsanity.com/paper/1906.07348/) (2019)
- [SecureBERT: A Domain-Specific Language Model for Cybersecurity](https://mlsanity.com/paper/2204.02685/) (2022)
- [PromptNER: Prompting For Named Entity Recognition](https://mlsanity.com/paper/2305.15444/) (2023)
- [Real-time Event Detection on Social Data Streams](https://mlsanity.com/paper/1907.11229/) (2019)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [DarkBERT: A Language Model for the Dark Side of the Internet](https://mlsanity.com/paper/2305.08596/) (2023)
- [Event-Driven News Stream Clustering using Entity-Aware Contextual Embeddings](https://mlsanity.com/paper/2101.11059/) (2021)
- [Early Warnings of Cyber Threats in Online Discussions](https://mlsanity.com/paper/1801.09781/) (2018)
- [Event Detection from Social Media for Epidemic Prediction](https://mlsanity.com/paper/2404.01679/) (2024)
- [Crowdsourcing Cybersecurity: Cyber Attack Detection using Social Media](https://mlsanity.com/paper/1702.07745/) (2017)
- [A Novel Approach for Detection and Ranking of Trendy and Emerging Cyber Threat Events in Twitter Streams](https://mlsanity.com/paper/1907.07768/) (2019)
- [Detecting Cybersecurity Events from Noisy Short Text](https://mlsanity.com/paper/1904.05054/) (2019)
- [Cream Skimming the Underground: Identifying Relevant Information Points from Online Forums](https://mlsanity.com/paper/2308.02581/) (2023)
- [Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding](https://mlsanity.com/paper/2409.08221/) (2024)
- [EUREKHA: Enhancing User Representation for Key Hackers Identification in Underground Forums](https://mlsanity.com/paper/2411.05479/) (2024)

## Built on by (most cited first, 1 of 1)

- [OptiFLIDS: Optimized Federated Learning for Energy-Efficient Intrusion Detection in IoT](https://mlsanity.com/paper/2510.05180/) (2025)

## Abstract (arXiv)

Hacker forums provide critical early warning signals for emerging cybersecurity threats, but extracting actionable intelligence from their unstructured and noisy content remains a significant challenge. This paper presents an unsupervised framework that automatically detects, clusters, and prioritizes security events discussed across hacker forum posts. Our approach leverages Transformer-based embeddings fine-tuned with contrastive learning to group related discussions into distinct security event clusters, identifying incidents like zero-day disclosures or malware releases without relying on predefined keywords. The framework incorporates a daily ranking mechanism that prioritizes identified events using quantifiable metrics reflecting timeliness, source credibility, information completeness, and relevance. Experimental evaluation on real-world hacker forum data demonstrates that our method effectively reduces noise and surfaces high-priority threats, enabling security analysts to mount proactive responses. By transforming disparate hacker forum discussions into structured, actionable intelligence, our work addresses fundamental challenges in automated threat detection and analysis.