Real-Time Threat Detection and Alerting in Social Streams Using a DualTarget Transformer Architecture

Abstract

The rapid growth of digital technologies and online communication platforms has significantly increased cybersecurity-related discussions across social media, online forums, and cyber incident reporting platforms. These platforms generate large volumes of unstructured textual data containing valuable information about cyber threats, vulnerabilities, and attack activities. Traditional cybersecurity monitoring methods mainly rely on manual analysis and rule-based filtering techniques, where predefined keywords and patternmatching approaches are used to identify potential threats. Although these methods are effective for basic monitoring, they become inefficient when handling large-scale datasets and often fail to capture the contextual meaning of textual information. One of the major challenges in cybersecurity intelligence is extracting meaningful insights from complex, noisy, and unstructured text. Conventional approaches struggle with inconsistent language, irrelevant content, and high data volume, reducing the accuracy of cyberattack classification. To address these challenges, this research proposes a machine learning-based framework for automated cyberattack detection using textual data. The framework begins with natural language preprocessing to clean and normalize the text, followed by semantic feature extraction using Sentence-Bidirectional Encoder Representations from Transformers (SBERT) embeddings trained with an Open Question Answering objective. To address class imbalance, the Synthetic Minority Oversampling Technique (SMOTE) is applied to generate balanced training data. The framework evaluates multiple classification models, including Stochastic Gradient Descent (SGD), Complement Naïve Bayes (CNB), and a hybrid model combining Dense Neural Networks (DNN) with Linear Discriminant Analysis (LDA). Experimental results demonstrate that the hybrid approach improves classification performance, enhancing the accuracy and efficiency of automated cybersecurity text analysis for large-scale cyberattack detection.