2018/04/12 by Joobin Gharibshah, Evangelos E. Papalexakis, Gharibshah, Joobin +3
Computer Science · #Authorship Attribution and Profiling #FOS: Computer and information sciences #Information Retrieval (cs.IR) #Machine Learning (cs.LG) #Network Security and Intrusion Detection #Spam and Phishing Detection
paper · pdf · doi:10.48550/arxiv.1804.04760
openalex publication_date 2018/04/12 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Is it possible to extract malicious IP addresses reported in security forums\nin an automatic way? This is the question at the heart of our work. We focus on\nsecurity forums, where security professionals and hackers share knowledge and\ninformation, and often report misbehaving IP addresses. So far, there have only\nbeen a few efforts to extract information from such security forums. We propose\nRIPEx, a systematic approach to identify and label IP addresses in security\nforums by utilizing a cross-forum learning method. In more detail, the\nchallenge is twofold: (a) identifying IP addresses from other numerical\nentities, such as software version numbers, and (b) classifying the IP address\nas benign or malicious. We propose an integrated solution that tackles both\nthese problems. A novelty of our approach is that it does not require training\ndata for each new forum. Our approach does knowledge transfer across forums: we\nuse a classifier from our source forums to identify seed information for\ntraining a classifier on the target forum. We evaluate our method using data\ncollected from five security forums with a total of 31K users and 542K posts.\nFirst, RIPEx can distinguish IP address from other numeric expressions with 95%\nprecision and above 93% recall on average. Second, RIPEx identifies malicious\nIP addresses with an average precision of 88% and over 78% recall, using our\ncross-forum learning. Our work is a first step towards harnessing the wealth of\nuseful information that can be found in security forums.\n