Descoberta de exploits usando dados da rede social Twitter

Abstract

One crucial aspect of information systems security is the deployment of security patches. The growing number of software vulnerabilities, together with the need for impact analysis in each update, can cause administrators to postpone software patching and leave their systems vulnerable for a long time. Furthermore, studies have shown that many software vulnerabilities have only proof-of-concept exploits, making the identification of real threads even harder. In this scenario, knowledge of which vulnerabilities were exploited in the wild is a powerful tool to help systems administrators prioritize patches. Social media analysis for this specific application can enhance the results and bring more agility by collecting data from online discussions and applying machine learning techniques to detect real-world exploits. In this dissertation, we use a technique that combines Twitter data with public database information to classify vulnerabilities as exploited or not-exploited. We analyze the behavior of different classifying algorithms, investigate the influence of different antivirus data as ground truth, and experiment with various time window sizes. Our findings suggest that using a Light Gradient Boosting Machine (LightGBM) can benefit the results, and for most cases, the statistics related to a tweet and the users who tweeted are more meaningful than the text tweeted. We also demonstrate the importance of using ground-truth data from security companies not mentioned in previous works.