Filtro adaptativo para remoção de falsos positivos em alertas de segurança obtidos do Twitter

Abstract

Social media is a modern and usual way to share information about several subjects. Among the most used social media are Facebook, Instagram, Whatsapp and Twitter. There are several studies in the sense of evaluating the use of Twitter as a source of security alerts, including systems that use it to obtain early warnings. Despite efforts to obtain alerts from this source, messages not related to security alerts still occur, considered false positives. The objective of this work is to develop an adaptive filter to reduce the number of messages considered false positives. As methodology, the Twitter API was used to capture tweets. Word, URL, user and similarity filters were developed to eliminate irrelevant tweets. For the similarity filter, the Jaccard index was used as a similarity metric together with the weight of the most recurrent words in discarded tweets. The tweets were also grouped using the Jaccard index as a similarity metric and selected via the web interface by the security analyst. As result, the filter removed 31.56% of irrelevant tweets and achieved a 1.76% error rate. It was found that the adaptive filter was able to reduce irrelevant messages in early warning systems using Twitter as a data source.