Extracting actionable information from Security Forums
The goal of this work is to systematically extract information from hacker forums, whose information would be in general described as unstructured: the text of a post is not necessarily following any writing rules. By contrast, many security initiatives and commercial entities are harnessing the readily public information, but they seem to focus on structured sources of information. Here, we focus on the problem of analyzing text content in security forums. A key novelty is that we use user profiles and contextual features along with transfer learning approach and also embedding space to help us identify and refine information that we could not get from security forum with trivial analysis. We collect a wealth of data from 5 different security forums. The contribution of our work is twofold; (a) we develop a method to automatically identify through the forums malicious IP addresses (b) we also propose a systematic method to identify and classify user-specified threads of interest into four categories. We further showcase how this information can inform knowledge extraction from the forums. As the cyber-wars are becoming more intense, having early accesses to useful information becomes more imperative to remove the hackers first-move advantage, and our work is a solid step towards this direction.
DarkEmbed: Exploit Prediction With Neural Language Models

 
 Software vulnerabilities can expose computer systems to attacks by malicious actors. With the number of vulnerabilities discovered in the recent years surging, creating timely patches for every vulnerability is not always feasible. At the same time, not every vulnerability will be exploited by attackers; hence, prioritizing vulnerabilities by assessing the likelihood they will be exploited has become an important research problem. Recent works used machine learning techniques to predict exploited vulnerabilities by analyzing discussions about vulnerabilities on social media. These methods relied on traditional text processing techniques, which represent statistical features of words, but fail to capture their context. To address this challenge, we propose DarkEmbed, a neural language modeling approach that learns low dimensional distributed representations, i.e., embeddings, of darkweb/deepweb discussions to predict whether vulnerabilities will be exploited. By capturing linguistic regularities of human language, such as syntactic, semantic similarity and logic analogy, the learned embeddings are better able to classify discussions about exploited vulnerabilities than traditional text analysis methods. Evaluations demonstrate the efficacy of learned embeddings on both structured text (such as security blog posts) and unstructured text (darkweb/deepweb posts). DarkEmbed outperforms state-of-the-art approaches on the exploit prediction task with an F1-score of 0.74.
 

Immune dysfunction following infection with chicken anemia agent and infectious bursal disease virus. II. Alterations of in vitro lymphoproliferation and in vivo immune responses.
To determine the functional impact of alterations in lymphocyte concentrations and ratios following infection with chicken anemia agent (CAA) alone or in combination with infectious bursal disease virus (IBDV) on the immune system of young chickens, in vitro lymphoproliferation assays and in vivo responses to vaccination with several common viral agents were assessed at various time intervals post-inoculation (PI). Concanavalin A (Con A), phytohemagglutinin (PHA) and pokeweed mitogen (PWM) stimulation of splenic lymphocytes (SPL) collected from control birds could not be detected until 10-14 days PI. Infection with CAA was characterized by significantly higher PWM stimulation of SPL at 17 days PI and significantly lower PWM stimulation of peripheral blood lymphocytes (PBL) at 14 days PI, compared with uninfected controls. Concanavalin A and PWM stimulation of SPL was significantly increased in birds inoculated with IBDV alone. Lymphocytes harvested from birds inoculated simultaneously with CAA and IBDV had significantly lower responses. Effects on humoral and cell-mediated immunity following CAA and/or IBDV were determined by evaluating vaccination responses to Newcastle disease virus (NDV), fowl pox virus (FPV) and infectious laryngotracheitis virus (ILTV) during the acute phase of CAA infection (2 weeks PI). Vaccination of birds 2 weeks following CAA infection at 1 day of age resulted in decreased protection against NDV (85.7%) and ILTV (7.1%) challenge compared with protection rates in control birds (100% and 53.3% respectively). Infectious bursal disease virus infection was associated with decreased protection against NDV (60%) only. Concomitant infection at 1 day of age resulted in a greater reduction in NDV challenge protection (33.3%), slightly decreased FPV protection (87.5%), increased numbers of persistent FPV vaccination lesions and increased protection against ILTV challenge (71.4%). Vaccination of birds 2 weeks following CAA infection at 2 weeks of age resulted in slightly decreased NDV humoral antibody, development of persistent FPV vaccination lesions (17%) and increased immunity to ILTV challenge compared with control birds (83.3% vs. 66.7%). Chickens inoculated with IBDV alone displayed a more severe depression in NDV antibody titers and only a slight decrease in ILTV protection. Vaccination following concomitant infection at 2 weeks of age resulted in a higher percentage of FPV persistent vaccination lesions (39%) and greatly enhanced immunity to ILTV challenge (100%).