AI-Driven Cyber Threat Intelligence: Leveraging Social Media Analytics and Machine Learning for Real-Time Cyberattack Detection

Abstract

The rising level and complexity of cyberattacks necessitate that intelligence sources go beyond internal network telemetry. The paper introduces AI-based Cyber Threat Intelligence (CTI) framework that combines social media analytics with machine learning (ML) to facilitate real-time detection of cyberattacks. Social media have become early warning systems where threat actors report on their exploits and social security communities post indicators of compromise, but this stream of unstructured data is still not fully exploited in operational security. The suggested framework continuously feeds on social media content and uses natural language processing to extract features and classifies posts with the help of trained ML models, including Naive Bayes, Support Vector Machines, Random Forest, Long Short-Memory (LSTM) networks, and a transformer-based classifier. The transformer-based model performed best, reaching 94.7% accuracy and an average detection time of around 18 seconds, which is significantly better than traditional signature-based and network-log-only methods, using a simulated dataset of 300 social media posts. The results indicate that, with the help of social media analytics and deep learning classifiers, the time interval between detection and response can be significantly reduced and the contextual awareness of security operations centers can be improved. The paper ends with implications of practice, limitations of the current study, and recommendations to a real-life validation in the future.