Automated detection of vulnerability exploitation in underground hacking forums

Abstract

This work proposes a machine learning-based approach to identify and classify vulnerability exploitation, the scope, and the impact of malicious software through the monitoring of underground hacker forums. The growing volume of posts discussing vulnerability exploitation demands an automated approach to process topics and posts that may trigger alarms based on their content. To illustrate the proposed system, we used the CrimeBB dataset, which contains data extracted from various underground forums, and developed a supervised machine learning model capable of filtering topics that cite CVEs and labelingthem as proof of concept (PoC), weaponization, exploitation, among others. We applied machine learning and natural language processing techniques to preprocess the texts and then trained several linear and non-linear models. To evaluate the models’ effectiveness and accuracy and compare results, we used metrics such as accuracy, precision, and recall. Additionally, to gain a better understanding and explanation of why the model can differentiate between classes, we employed model explanation methods to determine the relevance of words in predictions. Overall, this work highlights the differences in the nature of the labeled posts and their importance in vulnerability analysis.