Artificial Intelligence Gives Clues About Cyberattack Targets


We recently announced that peer-reviewed studies of our new DarkMention technology show how the technology can predict and prevent cyberattacks against the enterprise as well as counter cryptocurrency threats.  Yes, you read that correctly. DarkMention can predict and prevent cyberattacks. We wanted to share a little more with our readers about how we are using information mined from the darkweb differently to improve the application of artificial intelligence in cybersecurity and why our application of artificial intelligence is unique, patented and award-winning.

DarkMention uses a cutting-edge, artificial intelligence (AI) technology known as logic programming. We combine enterprise-level attack events (i.e. obtained from an SIEM) with patterns mined from the darkweb to predict what hackers will target. DarkMention is designed to provide warnings of impending attacks based on patterns identified in hacker conversations. Hackers are people too…and they need to prepare and plan for a cyberattack.  The key is finding what patterns precede the attacks – that’s where AI comes into play.

While hackers typically do not discuss specific targets, there are definite patterns in conversations that can be uncovered prior to an attack. Finding these patterns is no small task – darkweb hacker discussions are inherently “messy” data to deal with.  Simple keyword searches alone do not provide very predictive attack indicators – and often lead to a flood of false-positives. This is where the application of artificial intelligence becomes most valuable - we use artificial intelligence to filter out false positives and improve predictions. By identifying conversation topics and frequency, along with a few other factors, DarkMention is able to predict likely attack targets based on conversation patterns in the dark web.

Another critical difference between the CYR3CON approach versus the some of the legacy “darkweb” solutions on the market is that we do not rely on brand mentions – which is prone to false positives. Our focus on patterns and the application of artificial intelligence are what allow DarkMention to accurately predict threat actor targets – which enable for a review of a wider array of potential conversation patterns that a human does not have time to look at. At the end of the day, DarkMention is providing predictions on what actually comes before attacks.

The next questions that we hear are, “Does it really work?” And, “How accurate is it?” Government-funded tests confirmed the prediction of cyber events against an enterprise in a given time period with single digit false positives on attack prediction. Single digit false positives are something we’re incredibly proud of – and we’ve made the results of the study available here (see the links below).  

Lastly, we take a transparent approach to the alerts DarkMention provides. Alerts include the provenance information so the reason for the alert is clear and our clients will understand why the system made the decision it did.

CYR3CON is leading the industry developing patented technologies, publishing award-winning papers that are peer-reviewed to further support our unique approach and solving the real problems facing cyber security teams today. The pair of studies and associated provisional patents describe DarkMention and highlight several use cases including the prevention of attacks against various cryptocurrencies and their exchanges.

View the recent press release

Read our ebook on DarkMention.

View the Scientific Papers:

DARKMENTION: A Deployed System to Predict Enterprise-Targeted External Cyberattacks

Finding Cryptocurrency Attack Indicators Using Temporal Logic and Darkweb Data