Cyber Threat Intelligence Discovery using Machine Learning from the Dark Web

Aug 3, 2026

Upload by Logic

Cyber threat intelligence (CTI) provides actionable information an organization uses to understand potential vulnerabilities and threats. This study compares machine learning algorithms for predicting exploit types—using dark web form posts from a semi-structured dataset under the CRISP data science approach. Results show function-based models such as support vector machines and deep learning via artificial neural networks achieve higher accuracy than tree-based approaches including random forest and decision trees. Future work targets high-performance computing and advanced deep learning methods.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

AccessFree to download

Abstract

Introduction

Background

Threat Intelligence and Dark Web Forum Posts

Methodology and Data Approach

Results and Discussion

Conclusion

Manuscript 1436 Cyber Threat Intelligence Discovery using Machine Learning from the Dark Web Follow this and additional works at: [https://scholarworks.lib.csusb.edu/ciima](https://scholarworks.lib.csusb.edu/ciima) Part of the Management Information Systems Commons Cyber Threat Intelligence Discovery using Machine Learning from the Dark Web Azene Zenebe Bowie State University 1, Abubakar Tafawa Balewa University2 1Department of Information Science and System, Morgan State University, MD, USA 2Department of Management and Information Technology, Abubakar Tafawa Balewa University, Bauchi, Nigeria ABSTRACT Cyber threat intelligence (CTI) is an actionable information or insight an organization uses to understand potential vulnerabilities it does have and threatsit is facing. One important CTIfor proactive cyber defense is exploit type with possible values system, web, network, website or Mobile. This study compares the performance of machine learning algorithms in predicating exploit types using form posts in the dark web, which is a semi-structured dataset collected from dark web. The study uses the CRISP data science approach. The results of the study show that machine learning algorithms which are function-based including support vector machine and deep-learning using artificial neural network are more accurate than those algorithms which are based on tree including Random Forest and Decision-Tree for CTI discovery from semi-structured dataset. Future research will include the use of high-performance computing and advanced deeplearning algorithms. Keywords: Cyber Security, Cyber Threat Modeling, Machine Learning, Deep Learning, Dark Web ©International Information Management Association, Inc. 2022 1 Communications of the IIMA Cyber Threat Intelligence Discovery using Machine Learning from the Dark Web Zenebe INTRODUCTION The Web has three types: the Surface Web, the Deep Web and the Dark Web. The Surface Web contains all indexed web pages on the Internet and accessible to the public. The Deep Web is not indexed or searchable by common search engines and only users with access rights can login and access them. The Dark Web is a subset of the Deep Web and requires special software such as Tor and trusted connections. It allows user anonymity and is known for a place where malicious actors meet, communicate, and share unethical hacking techniques, tools and information for exploits or attacks. The amount of data and information on the dark web is big data and estimated to be about 5% of all content on the Web, which is about 100 of zettabytes, where a zettabyte is about a trillion gigabytes (Saleem, Islam, & Kabir, 2022) . Cyber threat intelligence (CTI) is an actionable information or insights on current and possible attacks that can be used to alert, protect, and counteract cyber threats. On the Dark Web, CTI discovery techniques include monitoring forums, marketplaces, websites, and traffic, as well as the use of honeypots (Saleem, Islam & Kabir, 2022). Machine learning is training machines using data and algorithm to build a model for prediction. Cyber threat intelligence discovery using big data and machine learning provides a proactive approach to identify cyber threats early before they become problems that bring high risks for cyber-attacks to organization. This paper focuses on Cyber Threat Intelligence Discovery using Big Data and Supervised Machine Learning from the Dark Web. The paper has five sections. Section 2 presents the background, followed by the methodology in Section 3. Section 4 presents the results and discussion, and Section 5 presents the conclusion. BACKGROUND As the popularity and adoption rate of big data and machine learning increases, its applications in various sectors of business and industry continues to expand beyond the scope it traditionally defined. One of its more extensive applications is in the field of cybersecurity. The cyber security industry has ev

FAQs

What problem does cyber threat intelligence (CTI) address in this study?

CTI delivers actionable insights to help organizations understand current and potential attacks, anticipate threats early, and improve proactive cyber defense.

How does the study discover CTI from the dark web?

It uses dark web form posts from a semi-structured dataset, analyzing exploit-related information and applying supervised machine learning to predict exploit types.

Which machine learning approaches performed best for exploit type prediction?

Support vector machine and deep learning using artificial neural networks were reported as more accurate than tree-based methods such as random forest and decision tree.

Aug 3, 2026

Upload by Logic