Luiza Nacshon

Dark web posts are often lengthy and difficult to parse due to poor grammar and irrelevant and intentionally cryptic content. Many fintech threat actors are using dark web forums to discuss their attacks and sell fake software or stolen credentials. To address this, we developed an unsupervised ML model to classify posts as relevant or irrelevant and analyzed them using transformed pointwise mutual information (PMI) to identify correlations between frequently co-occurring words related to fintech attacks. We then use prompt engineering to send the results through Intuit GenAI and categorize the threat actors using LLM. We show that this methodology enables us to extract valuable insights from long and convoluted dark web posts and identify potential security threats for the fintech industry.

The evolving landscape of cyber threats demands robust and adaptive defense mechanisms. This paper presents a machine learning-driven system for the automated detection of both bot activity and sophisticated weaponization efforts. In addressing the challenge of automated bot traffic, we leverage session-level analysis and unsupervised clustering to accurately identify and categorize bot behavior, even in the presence of deceptive user-agent strings. Simultaneously, we tackle the rising threat of advanced threat actors by employing behavioral analytics and entropy analysis to uncover their stealthy weaponization activities. This approach enhances detection capabilities beyond traditional rule-based methods, enabling proactive defense against both high-volume bot attacks and targeted, sophisticated threats. By incorporating these two critical aspects of cybersecurity, we demonstrate the potential of machine learning to provide comprehensive protection against the multifaceted and dynamic threat landscape, enhancing the capabilities of traditional WAF-based defenses.