2025/12/24 by Mohammad Hammas Saeed, Saeed, Mohammad Hammas, Howie Huang +1
Computer Science · #Computers and Society (cs.CY) #Cybercrime and Law Enforcement Studies #FOS: Computer and information sciences #Hate Speech and Cyberbullying Detection #Social and Information Networks (cs.SI) #Spam and Phishing Detection
paper · doi:10.48550/arxiv.2512.21380
openalex publication_date 2025/12/24 · openalex created_date 2025/12/30 · openalex updated_date 2026/07/28
Cyberattacks pose a serious threat to modern sociotechnical systems, often resulting in severe technical and societal consequences. Attackers commonly target systems and infrastructure through methods such as malware, ransomware, or other forms of technical exploitation. Most traditional mechanisms to counter these threats rely on post-hoc detection and mitigation strategies, responding to cyber incidents only after they occur rather than preventing them proactively. Recent trends reveal social media discussions can serve as reliable indicators for detecting such threats. Malicious actors often exploit online platforms to distribute attack tools, share attack knowledge and coordinate. Experts too, often predict ongoing attacks and discuss potential breaches in online spaces. In this work, we present SENTINEL, a framework that leverages social media signals for early detection of cyber attacks. SENTINEL aligns cybersecurity discussions to realworld cyber attacks leveraging multi modal signals, i.e., combining language modeling through large language models and coordination markers through graph neural networks. We use data from 16 public channels on Telegram related to cybersecurity and open source intelligence (OSINT) that span 365k messages. We highlight that social media discussions involve active dialogue around cyber threats and leverage SENTINEL to align the signals to real-world threats with an F1 of 0.89. Our work highlights the importance of leveraging language and network signals in predicting online threats.