{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,20]],"date-time":"2026-10-20T02:54:01Z","timestamp":1792464841561,"version":"4.5.0"},"reference-count":34,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2018,11,15]],"date-time":"2018-11-15T00:00:00Z","timestamp":1542240000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100006602","name":"Air Force Research Laboratory","doi-asserted-by":"publisher","award":["FA8750-16-C-0112"],"award-info":[{"award-number":["FA8750-16-C-0112"]}],"id":[{"id":"10.13039\/100006602","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Recent high-profile cyber-attacks exemplify why organizations need better cyber-defenses. Cyber-threats are hard to accurately predict because attackers usually try to mask their traces. However, they often discuss exploits and techniques on hacking forums. The community behavior of the hackers may provide insights into the groups\u2019 collective malicious activity. We propose a novel approach to predict cyber-events using sentiment analysis. We test our approach using cyber-attack data from two major business organizations. We consider three types of events: malicious software installation, malicious-destination visits, and malicious emails that surmounted the target organizations\u2019 defenses. We construct predictive signals by applying sentiment analysis to hacker forum posts to better understand hacker behavior. We analyze over 400 K posts written between January 2016 and January 2018 on over 100 hacking forums both on the surface and dark web. We find that some forums have significantly more predictive power than others. Sentiment-based models that leverage specific forums can complement state-of-the-art time-series models on forecasting cyber-attacks weeks ahead of the events.<\/jats:p>","DOI":"10.3390\/info9110280","type":"journal-article","created":{"date-parts":[[2018,11,15]],"date-time":"2018-11-15T11:32:47Z","timestamp":1542281567000},"page":"280","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":42,"title":["Predicting Cyber-Events by Leveraging Hacker Sentiment"],"prefix":"10.3390","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9745-2262","authenticated-orcid":false,"given":"Ashok","family":"Deb","sequence":"first","affiliation":[{"name":"Information Sciences Institute, University of Southern California, Marina del Rey, CA 90292, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5071-0575","authenticated-orcid":false,"given":"Kristina","family":"Lerman","sequence":"additional","affiliation":[{"name":"Information Sciences Institute, University of Southern California, Marina del Rey, CA 90292, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Emilio","family":"Ferrara","sequence":"additional","affiliation":[{"name":"Information Sciences Institute, University of Southern California, Marina del Rey, CA 90292, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2018,11,15]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"605","DOI":"10.1177\/0018720812464045","article-title":"Cyber situation awareness: Modeling detection of cyber attacks with instance-based learning theory","volume":"55","author":"Dutt","year":"2013","journal-title":"Hum. Factors"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Jajodia, S., Liu, P., Swarup, V., and Wang, C. (2009). Cyber Situational Awareness, Springer.","DOI":"10.1007\/978-1-4419-0140-8"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2014.06.008","article-title":"Cyber situational awareness\u2013a systematic review of the literature","volume":"46","author":"Franke","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_4","first-page":"1953","article-title":"The psychopathology of everyday life. The Standard Edition of the complete psychological works of Sigmund Freud","volume":"24","author":"Freud","year":"1901","journal-title":"Trans. James Strachey"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Pang, B., Lee, L., and Vaithyanathan, S. (2002, January 6\u20137). Thumbs up?: Sentiment classification using machine learning techniques. Proceedings of the ACL-02 conference on Empirical methods in natural language processing, Philadelphia, PA, USA.","DOI":"10.3115\/1118693.1118704"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"597","DOI":"10.1016\/j.cose.2011.12.010","article-title":"Leveraging behavioral science to mitigate cyber security risk","volume":"31","author":"Pfleeger","year":"2012","journal-title":"Comput. Secur."},{"key":"ref_7","unstructured":"Agarwal, S., and Sureka, A. (arXiv, 2015). Applying social media intelligence for predicting and identifying on-line radicalization and civil unrest oriented threats, arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Asur, S., and Huberman, B.A. (September, January 31). Predicting the future with social media. Proceedings of the 2010 IEEE\/WIC\/ ACM International Conference on Web Intelligence and Intelligent Agent Technology, Toronto, ON, Canada.","DOI":"10.1109\/WI-IAT.2010.63"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"544","DOI":"10.1108\/IntR-06-2012-0114","article-title":"Understanding the predictive power of social media","volume":"23","author":"Kalampokis","year":"2013","journal-title":"Internet Res."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Macdonald, M., Frank, R., Mei, J., and Monk, B. (2015, January 25\u201328). Identifying digital threats in a hacker web forum. Proceedings of the 2015 IEEE\/ACM International Conference on Advances in Social Networks Analysis and Mining, Paris, France.","DOI":"10.1145\/2808797.2808878"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1016\/j.diin.2015.07.006","article-title":"BiSAL\u2013A bilingual sentiment analysis lexicon to analyze Dark Web forums for cyber security","volume":"14","author":"Abulaish","year":"2015","journal-title":"Digit. Investig."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Chen, H. (2008, January 17\u201320). Sentiment and affect analysis of dark web forums: Measuring radicalization on the internet. Proceedings of the 2008 IEEE International Conference on Intelligence and Security Informatics, Taipei, Taiwan.","DOI":"10.1109\/ISI.2008.4565038"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Park, H., Jung, S.O.D., Lee, H., and In, H.P. (2012, January 4\u20136). Cyber weather forecasting: Forecasting unknown internet worms using randomness analysis. Proceedings of the IFIP International Information Security Conference, Heraklion, Greece.","DOI":"10.1007\/978-3-642-30436-1_31"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Pontes, E., Guelfi, A.E., Kofuji, S.T., and Silva, A.A. (2011, January 26\u201328). Applying multi-correlation for improving forecasting in cyber security. Proceedings of the Sixth International Conference on Digital Information Management, Melbourne, Australia.","DOI":"10.1109\/ICDIM.2011.6093323"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1177\/1548512917715342","article-title":"Statistical models for the number of successful cyber intrusions","volume":"15","author":"Leslie","year":"2018","journal-title":"J. Def. Model. Simul."},{"key":"ref_16","first-page":"194","article-title":"Predicting cyber risks through national vulnerability database","volume":"24","author":"Zhang","year":"2015","journal-title":"Inf. Secur. J."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Nahar, V., Unankard, S., Li, X., and Pang, C. (2012, January 11\u201313). Sentiment analysis for effective detection of cyber bullying. Proceedings of the Web Technologies and Applications\u201414th Asia-Pacific Web Conference, APWeb 2012, Kunming, China.","DOI":"10.1007\/978-3-642-29253-8_75"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Gandotra, E., Bansal, D., and Sofat, S. (2015). Computational techniques for predicting cyber threats. Intelligent Computing, Communication and Devices, Advance in Intelligent Systems and Computing, Springer.","DOI":"10.1007\/978-81-322-2012-1_26"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Dingledine, R., Mathewson, N., and Syverson, P. (2004). Tor: The Second-Generation Onion Router, Naval Research Lab. Technical report.","DOI":"10.21236\/ADA465464"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Nunes, E., Diab, A., Gunn, A., Marin, E., Mishra, V., Paliath, V., Robertson, J., Shakarian, J., Thart, A., and Shakarian, P. (2016, January 28\u201330). Darknet and deepnet mining for proactive cybersecurity threat intelligence. Proceedings of the 2016 IEEE Conference on Intelligence and Security Informatics (ISI), Tucson, AZ, USA.","DOI":"10.1109\/ISI.2016.7745435"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Lacey, D., and Salmon, P.M. (2015, January 2\u20137). It\u2019s dark in there: Using systems analysis to investigate trust and engagement in dark web forums. Proceedings of the International Conference on Engineering Psychology and Cognitive Ergonomics, Los Angeles, CA, USA.","DOI":"10.1007\/978-3-319-20373-7_12"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Sapienza, A., Bessi, A., Damodaran, S., Shakarian, P., Lerman, K., and Ferrara, E. (2017, January 18\u201321). Early warnings of cyber threats in online discussions. In Proceeding of the 2017 IEEE International Conference on Data Mining Workshops (ICDMW), New Orleans, LA, USA.","DOI":"10.1109\/ICDMW.2017.94"},{"key":"ref_23","unstructured":"Sabottke, C., Suciu, O., and Dumitras, T. (2015, January 12\u201314). Vulnerability disclosure in the age of social media: Exploiting twitter for predicting real-world exploits. Proceedings of the USENIX Security Symposium, Washington, DC, USA."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Tavabi, N., Goyal, P., Almukaynizi, M., Shakarian, P., and Lerman, K. (2018, January 2\u20137). DarkEmbed: Exploit prediction with neural language models. Proceedings of the Thirtieth Annual Conference on Innovative Applications of Artificial Intelligence, New Orleans, LA, USA.","DOI":"10.1609\/aaai.v32i1.11428"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"430","DOI":"10.1108\/13685201211266015","article-title":"Characterising and predicting cyber attacks using the Cyber Attacker Model Profile (CAMP)","volume":"15","author":"Watters","year":"2012","journal-title":"J. Money Laund. Control."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Robertson, J., Diab, A., Marin, E., Nunes, E., Paliath, V., Shakarian, J., and Shakarian, P. (2017). Darkweb Cyber Threat Intelligence Mining, Cambridge University Press.","DOI":"10.1017\/9781316888513"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1140\/epjds\/s13688-016-0085-1","article-title":"SentiBench\u2014A benchmark comparison of state-of-the-practice sentiment analysis methods","volume":"5","author":"Ribeiro","year":"2016","journal-title":"EPJ Data Sci."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Hutto, C., and Gilbert, E. (2014, January 1\u20134). VADER: A parsimonious rule-based model for sentiment analysis of social media text. Proceedings of the Eighth International AAAI Conference on Weblogs and Social Media, Ann Arbor, MI, USA.","DOI":"10.1609\/icwsm.v8i1.14550"},{"key":"ref_29","unstructured":"Pennebaker, J.W., Francis, M.E., and Booth, R.J. (2001). Linguistic Inquiry and Word Count: LIWC 2001, Lawrence Erlbaum Associates."},{"key":"ref_30","unstructured":"Thelwal, M. (2013). Heart and soul: Sentiment strength detection in the social web with SentiStrength. Cyberemotion, 1\u201314."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Shumway, R.H., and Stoffer, D.S. (2011). Time Series Analysis and Its Applications, Springer.","DOI":"10.1007\/978-1-4419-7865-3"},{"key":"ref_32","unstructured":"Seabold, S., and Perktold, J. (July, January 28). Statsmodels: Econometric and statistical modeling with python. Proceedings of the 9th Python in Science Conference, Austin, TX, USA."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1002\/nav.3800020109","article-title":"The Hungarian method for the assignment problem","volume":"2","author":"Kuhn","year":"1955","journal-title":"Nav. Res. Logist."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Almukaynizi, M., Nunes, E., Dharaiya, K., Senguttuvan, M., Shakarian, J., and Shakarian, P. (2017, January 7\u20138). Proactive identification of exploits in the wild through vulnerability mentions online. Proceedings of the 2017 International Conference on Cyber Conflict (CyCon U.S.), Washington, DC, USA.","DOI":"10.1109\/CYCONUS.2017.8167501"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/9\/11\/280\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T15:29:46Z","timestamp":1760196586000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/9\/11\/280"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,11,15]]},"references-count":34,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2018,11]]}},"alternative-id":["info9110280"],"URL":"https:\/\/doi.org\/10.3390\/info9110280","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,11,15]]}}}