Enhancing Phishing Detection on Twitter through Deep Learning and the MITRE ATT&CK Framework

Enhancing Phishing Detection on Twitter through Deep Learning and the MITRE ATT&CK Framework | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Enhancing Phishing Detection on Twitter through Deep Learning and the MITRE ATT&CK Framework Rajesh Karpurapu, Sagar Imambi This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6573597/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Social engineering attacks are a growing threat to cybersecurity, as they exploit human vulnerabilities through psychological manipulation. Twitter, owing to its real-time interaction and extensive user base, has become a prime platform for such attacks. Attackers use various techniques such as phishing and impersonation to deceive unsuspecting users. This paper proposes a comprehensive detection system that integrates deep learning models, namely Long Short-Term Memory (LSTM), Recurrent Neural Networks (RNN), and Bidirectional Encoder Representations from Transformers (BERT), with the MITRE ATT&CK framework, which provides a structured taxonomy of tactics, techniques, and procedures (TTPs) used by adversaries. The MITRE ATT&CK framework was leveraged to classify deceptive cyber infiltration into distinct phases, enhancing detection precision and context. Data collected from Twitter were preprocessed and mapped to specific ATT&CK TTPs, enabling deep learning models to achieve a more structured classification. Among the models tested, BERT outperformed the other models, achieving a detection accuracy of 95%. The results demonstrated the utility of combining deep learning techniques with structured cybersecurity frameworks such as MITRE ATT&CK to detect social engineering threats on social media platforms in a scalable manner. Social Engineering Twitter Deep Learning MITRE ATT&CK NLP Cybersecurity Phishing Impersonation Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 1. INTRODUCTION The rise of social media platforms has introduced new opportunities for cybercriminals to employ various tactics to execute deceptive cyber infiltrations. These attacks manipulate human psychology to deceive individuals to divulge sensitive information. Traditionally, social engineering has occurred through phone-based phishing or email scams. However, with the increasing use of social media, particularly Twitter, the scope and impact of these attacks have expanded significantly [ 1 ]. a) Twitter as an Attack Vector : Twitter’s real-time messaging, concise communication format, and global reach make it an attractive platform for social engineering. Attackers frequently craft brief deceptive messages, including phishing links, impersonation schemes, and scam offers, preying on users’ trust and sense of urgency. For instance, phishing tweets may mimic legitimate communication by asking users to reset passwords or verify accounts [ 2 ]. Given the sophistication and scale of deceptive cyber-infiltration, manual monitoring systems are insufficient. Automated detection models are essential for identifying malicious messages, particularly those that exploit subtle linguistic manipulations [ 3 ]. b) Importance of Detection Systems : Deep learning-based detection models have been proven to significantly enhance the detection of trust-based cyber exploits on social media. Natural Language Processing (NLP) techniques allow these models to understand not only the syntax of messages but also their embedded context, intent, and emotional triggers [ 4 ]. Such models have successfully differentiated benign user interactions from those of harmful social engineering messages. This research proposes the integration of the MITRE ATT&CK framework, a globally recognized knowledge base documenting adversary tactics, techniques, and procedures (TTPs), into a deep learning-based detection system. By categorizing malicious actions into distinct phases, the framework enhances detection precision, helping security professionals to better understand adversarial behavior and build targeted defenses [ 5 ]. 2. RELATED WORK Deceptive cyber infiltration, particularly that targeting social media platforms, has been extensively studied in cybersecurity. These attacks exploit psychological manipulation and often rely on phishing and impersonation techniques. Detecting such attacks requires a blend of human insight into manipulation tactics and machine learning or deep learning approaches to identify and categorize malicious content [ 1 ]. a) Machine Learning Approaches to Social Engineering Detection : Initial approaches focused on traditional machine learning methods, including Logistic Regression, Decision Trees, and Random Forests, which use handcrafted features, such as word frequency, message structure, and specific keywords. Mohammed et al. applied machine learning to Twitter data to detect phishing patterns using word frequency analysis [ 2 ]. However, these models have struggled to keep pace with the evolving sophistication of social engineering tactics. Table 1 summarizes the key traditional machine learning techniques used for social engineering detection. Table 1 Traditional Machine Learning Approaches to Social Engineering Detection Author(s) Year Methodology Dataset Key Findings Khonji et al. 2013 Statistical Phishing Analysis Email datasets Identified linguistic features in phishing emails Mohammed et al. 2015 Machine Learning on Twitter Twitter datasets Detected phishing tweets based on word patterns Verma & Hossain 2017 Random Forest Classifier Email datasets Improved detection by incorporating sender behavior Although conventional machine learning methods offer some level of detection, they are unable to address the complexity and subtlety of modern deceptive cyber infiltration. As attackers adapt, there is a demand for models that can understand not only the explicit content but also the underlying context and intent of messages [ 3 ] b) Deep Learning Techniques : Traditional models have limitations; hence, deep learning methods such as Long Short-Term Memory (LSTM) and Recurrent Neural Networks (RNN) have been invented. These models are particularly effective at processing sequential data such as text messages or tweet streams, making them more suitable for detecting patterns in deceptive cyber infiltration [ 4 ]. However, despite their strengths, deep learning models such as LSTMs can struggle with longer text sequences owing to issues such as the vanishing gradient problem. The introduction of transformer models, such as Bidirectional Encoder Representations from Transformers (BERT), has significantly improved the ability to process and understand long texts bidirectionally. BERT’s ability of BERT to capture context in both directions makes it particularly effective in detecting nuanced deceptive cyber infiltration on platforms such as Twitter [ 5 ]. c) Integration of MITRE ATT&CK Framework : Despite advancements in deep learning, the integration of structured frameworks, such as MITRE ATT&CK, for threat detection remains underexplored. MITRE ATT&CK is a comprehensive knowledge base of tactics, techniques, and procedures (TTPs) used by adversaries in cybersecurity [ 6 ]. By integrating this framework, security systems can map detected attacks to specific adversary behaviors, thereby offering actionable intelligence for detection and response. Ahmed et al. explored the use of MITRE ATT&CK to classify phishing attempts based on adversary techniques. They reported a significant improvement in detection accuracy by leveraging structured adversary intelligence [ 7 ]. However, the combination of deep learning models and MITRE ATT&CK in detecting deceptive persuasion attacks on social media platforms such as Twitter has not been sufficiently investigated, leaving a gap for further research [ 8 ]. Table 2 Deep Learning and MITRE ATT&CK Integration Approaches Author(s) Year Methodology Dataset Key Findings Ahmed et al. 2020 Phishing Detection using ATT&CK TTPs Email datasets Classified phishing attempts using MITRE ATT&CK McKenzie et al. 2015 Machine Learning + ATT&CK TTPs Twitter datasets Improved detection using structured adversary techniques d) Gaps in Existing Research : While machine learning and deep learning techniques have advanced the detection of fraudulent attacks, several gaps persist. A significant portion of the research has concentrated on traditional phishing detection methods without leveraging structured threat intelligence, such as MITRE ATT&CK [ 9 ]. Few studies have integrated deep learning with MITRE ATT&CK to classify attacks effectively. Moreover, many existing models struggle with real-time detection and often require manual intervention to assess the severity and context of the threat [ 10 ]. This study addresses these gaps by proposing a comprehensive detection system that integrates LSTM, RNN, and BERT with MITRE ATT&CK, providing a more accurate and scalable solution for recognizing manipulative threats on Twitter. 3. DATA COLLECTION AND PREPARATION a) Data collection : The data utilized in this study were gathered from Twitter using Twitter API. Real-time data collection was conducted by applying filters based on specific keywords related to deceptive cyber infiltration, including phishing, impersonation, and fraud [ 10 ]. These keywords were derived from commonly observed adversary techniques within the MITRE ATT&CK framework to ensure that the dataset was relevant and comprehensive. Table 3 provides examples of keywords used in the data collection process. Table 3 Keywords Used for Data Collection Category Example Keywords Phishing urgent, password reset, verify account Impersonation official account, account suspended, fake link Fraud free offer, win prize, gift card b) Data Preprocessing : The collected data underwent multiple preprocessing steps to ensure their suitability for training machine-learning models [ 2 ]. Deduplication Removal of duplicate and retweeted content to avoid bias in the dataset. Language Filtering Only English tweets were retained for analysis as the models were trained on English text. Special Character Removal URLs, emojis, and special characters are stripped from the text to focus on the message content. Lowercasing and Normalization Text was converted to lowercase, and normalization techniques were applied to standardize the dataset. c) Mapping To MITRE Att&Ck Framework : To improve classification accuracy, the MITRE ATT&CK framework was employed to categorize tweets based on adversary tactics, techniques, and procedures (TTPs) [ 3 ]. Each tweet is manually mapped to the relevant ATT&CK and CK TTP. For example: Credential Phishing Tweets requesting users to verify account details or reset passwords. Impersonation Tweets that impersonated official accounts to solicit sensitive information. This mapping enriched the dataset with structured intelligence and enhanced the performance of the deep learning models. Table 4 Example of Tweet Mapping to MITRE ATT&CK Framework Tweet Content Mapped Tactic Mapped Technique MITRE ATT&CK ID "Your account needs verification, click now" Credential Access Phishing T1566 "Get a free iPhone by clicking this link" Initial Access SpearphishingLink T1071 "Reset your password to avoid suspension" Credential Access Account Manipulation T1087 d) Data Labeling : After preprocessing, the data were classified into four categories: phishing, scam, legitimate, and unknown [ 4 ]. Annotators followed predefined guidelines, and an inter-annotator agreement score above 85% was achieved to ensure labeling consistency. Table 5 outlines the data-labeling categories used in this study. Table 5 Data Labeling Guidelines Label Description Phishing Requests sensitive information or links to malicious websites. Scam Promises unrealistic offers, such as "win a free prize." Legitimate Messages from verified accounts or without malicious intent. Unknown Suspicious messages that do not clearly fit other categories. e) Annotation Agreement : Multiple annotators reviewed a subset of tweets to ensure consistency in the labeled data. Inter-annotator agreement was measured, and the agreement score between different annotator pairs ranged from 82–87% [ 5 ]. Table 6 Inter-Annotator Agreement Scores. Annotator Pair Agreement Score (%) Annotator A & B 87 Annotator A & C 85 Annotator B & C 82 4. CLASSIFICATION MODELS AND PREPROCESSING a) Preprocessing Stage : Before training the machine learning models, text data underwent several preprocessing steps to transform them into a format suitable for analysis [ 1 ]. Tokenization Every tweet was broken down into individual words (tokens), allowing the model to analyze the formation of the text. Stop-word Removal Frequently used words like "the," "is," and "at" were eliminated to minimize noise in the dataset [ 2 ]. Lemmatization Words were lowered to their base form (e.g., "running" became "run"), which helped the model focus on the core meanings of the messages [ 3 ]. Feature Representation The text was converted into numerical vectors using techniques such as Bag of Words (BoW), Term Frequency-Inverse Document Frequency (TF-IDF), and Word Embeddings (Word2Vec, GloVe) [ 4 ]. b) Feature Representation Techniques : Several feature representation techniques have been employed to convert textual data into a numerical format that machine-learning models can interpret [ 5 ]. Table 7 summarizes these techniques. Table 7 Feature Representation Techniques Technique Description Bag of Words (BoW) Represents text as a collection of words and their frequency in the dataset [ 6 ]. TF-IDF (Term Frequency-Inverse Document Frequency) Assigns weights to words based on how frequently they appear in the dataset relative to other documents [ 7 ]. Word2Vec Represents words as continuous vectors, capturing semantic relationships [ 8 ]. GloVe Similar to Word2Vec but uses global word co-occurrence statistics to improve semantic understanding [ 9 ]. c) Classification Models : This study employed three deep learning models to classify deceptive persuasion threats on Twitter: Long Short-Term Memory (LSTM), Recurrent Neural Networks (RNN), and Bidirectional Encoder Representations from Transformers (BERT) [ 10 ][ 11 ]. Long Short-Term Memory (LSTM) LSTMs are a type of Recurrent Neural Network (RNN) that is used to capture long-term dependencies in sequential data. They are particularly useful for analyzing social engineering attack sequences spanning multiple tweets [ 3 ]. LSTM Formula 1 : Where: ht is the hidden state at time t, Wh and Uh are weight matrices, xt is the input at time t, where σ is the sigmoid activation function. bh is the bias term. LSTM maintains a memory cell that captures long-term dependencies in text data, making it suitable for analyzing multiple messages over time. Recurrent Neural Networks (RNN) RNNs process data sequentially and are well suited for text input. However, they can struggle with long sequences because of the vanishing gradient problem [ 13 ]. Bidirectional Encoder Representations from Transformers (BERT) BERT is a transformer-based model that captures the context of words in both directions within a sentence [ 13 ]. Unlike LSTMs and RNNs, which process data sequentially, BERT processes the entire sentence simultaneously, making it more effective at detecting subtle manipulations in deceptive persuasion threats. BERT Formula 2 (Self-Attention Mechanism) : Where: Q is the query matrix, K is the key matrix, V is the value matrix, dk is the dimension of the keys. The performance of these models is compared in Table 8 . Table 8 Classification Model Performance Model Accuracy (%) Precision (%) Recall (%) F1-Score (%) LSTM 92 90 88 89 RNN 85 83 80 81.5 BERT 95 93 92 92.5 d.) Integration of MITRE ATT&CK Framework : To enhance the classification accuracy, deep learning models were integrated with the MITRE ATT&CK framework. This integration enables models to categorize deceptive persuasion threats based on specific tactics, techniques, and procedures (TTPs) used by adversaries [ 15 ]. By mapping tweets to known TTPs, the models gain structured threat intelligence, which significantly improves the context and relevance of their detection capability. Table 9 MITRE ATT&CK Integration in Deep Learning Models Model Mapped Tactic Mapped Technique MITRE ATT&CK ID LSTM Credential Access Phishing T1566 RNN Initial Access SpearphishingLink T1071 BERT Account Manipulation Password Reset T1087 5. EXPERIMENTS AND RESULTS a) Experimental Setup : The experiments were conducted in a controlled environment using Python, along with libraries such as TensorFlow, Keras, and Scikit-learn for machine-learning model development [ 1 ]. The dataset was divided into training (70%), validation (15%), and test (15%) sets to ensure an unbiased model evaluation. The following hardware and software were used. Hardware Configuration: Processor: Intel i7-9700K RAM: 32 GB GPU: NVIDIA GTX 1080 Ti Software Environment: Python Version: 3.8 Libraries: TensorFlow 2.x, Keras, Scikit-learn, and Natural Language Toolkit (NLTK) for text preprocessing [ 2 ]. b) Experiment One: Baseline Model : As a baseline, a Logistic Regression model was trained using the TF-IDF feature representation of tweets. This baseline helped establish a reference point for evaluating the performance of deep-learning models [ 3 ]. Algorithm Logistic Regression Feature Representation: TF-IDF Evaluation Metrics: Accuracy, Precision, Recall, F1-Score The performance metrics of the baseline model are presented in Table 9 . Table 10 Baseline Model Performance (Logistic Regression) Metric Value (%) Accuracy 78 Precision 74 Recall 72 F1 Score 73.0 c) Experiment Two: Deep Learning Models : Deep-learning models (LSTM, RNN, and BERT) were trained and evaluated to determine their effectiveness in detecting deceptive persuasion threats. Each model was fine-tuned and tested using the same dataset and evaluation metric. The performance of the deep learning models is compared with the baseline in Table 11 . Table 11 Deep Learning Models Performance Model Accuracy (%) Precision (%) Recall (%) F1-Score (%) LSTM 92 90 88 89 RNN 85 83 80 81.5 BERT 95 93 92 92.5 Logistic Regression (Baseline) 78 74 72 73.0 d) Results Analysis : The Logistic Regression baseline model achieved an accuracy of 78% and an F1-Score of 73.0%. However, it lacks the ability to detect subtle manipulations in deceptive persuasion threats, for which deep learning models are better suited [ 4 ]. LSTM The LSTM model significantly outperformed the baseline, achieving an accuracy of 92%. This performance can be attributed to LSTM's capability to capture long-term dependencies in sequential data, making it effective in detecting patterns across multiple tweets [ 5 ]. RNN The RNN model achieved 85% accuracy. While this performance is respectable, it struggled with longer sequences of tweets owing to issues related to vanishing gradients, resulting in a lower F1-Score compared to LSTM [ 6 ]. BERT BERT outperformed all the other models, achieving an accuracy of 95% and an F1-Score of 92.5%. Its bidirectional text processing allows it to capture subtle nuances in tweets, making it the most effective model in this study [ 7 ]. e) Integration of MITRE ATT&CK Framework : To enhance the classification accuracy, deep learning models were integrated with the MITRE ATT&CK framework. This integration enables models to categorize deceptive persuasion threats based on specific tactics, techniques, and procedures (TTPs) used by adversaries [ 8 ]. By mapping tweets to known TTPs, the models gain structured threat intelligence, significantly improving the context and relevance of their detection capabilities [ 9 ]. Table 12 MITRE ATT&CK Mapping for deceptive persuasion threats Model Mapped Tactic Mapped Technique MITRE ATT&CK ID BERT Credential Access Phishing T1566 LSTM Initial Access SpearphishingLink T1071 RNN Account Manipulation Password Reset T1087 This integration improved the models' ability to detect sophisticated attacks by leveraging the MITRE ATT&CK framework’s structured classification of the attack vectors. The inclusion of adversarial behavior in the classification process allows for more accurate and contextually relevant detection of deceptive persuasion threats on Twitter [ 5 ]. f) Overall Insights : The results of this study indicate that deep learning models, particularly BERT, significantly outperform traditional machine learning models in detecting deceptive persuasion threats on Twitter. Key insights from this research include the following: BERT's Superior Performance BERT achieved the highest accuracy of 95%, outperforming both LSTM and the RNN. Its bidirectional text processing capability allows it to capture nuanced manipulations in tweets, making it particularly effective in detecting social engineering tactics [ 11 ]. LSTM’s Strength in Sequential Data The LSTM model demonstrated an accuracy of 92%, leveraging its ability to capture long-term dependencies in sequential data such as multi-tweet attack sequences. This makes LSTM particularly well suited for analyzing interactions over time [ 12 ]. Limitations of RNN Although the RNN model achieved a respectable accuracy of 85%, it struggled with longer tweet sequences owing to vanishing gradient issues. This limitation resulted in a lower F1-Score compared with both LSTM and BERT, highlighting the need for more robust architectures when dealing with sequential data [ 13 ]. Integration of the MITRE ATT&CK Framework The incorporation of the MITRE ATT&CK framework enhances the models' contextual understanding of deceptive persuasion threats. By mapping tweets to known adversarial tactics and techniques, these models provide more accurate and actionable insights for cybersecurity practitioners [ 14 ]. Scalability and Robustness This study confirms that combining deep learning techniques with structured threat intelligence frameworks such as MITRE ATT&CK offers a scalable and robust solution for detecting social engineering threats. This approach provides valuable insights that can inform defense strategies against evolving cyber threats on social media [ 15 ]. 6. CONCLUSION AND FUTURE WORK a) Conclusion : This study demonstrated the effectiveness of deep learning models, particularly BERT, in detecting deceptive persuasion threats on Twitter. By integrating the MITRE ATT&CK framework into the detection system, classification accuracy was significantly enhanced. Among the models tested, BERT achieved the highest accuracy of 95% and an F1 Score of 92.5%, outperforming both the LSTM and RNN models. The structured threat intelligence from MITRE ATT&CK facilitates a more comprehensive understanding of adversarial behaviors, leading to the accurate detection of complex deceptive persuasion threats. These results confirm that combining advanced deep learning techniques with established cybersecurity frameworks offers a robust solution for identifying social engineering threats on social media platforms [ 1 ][ 2 ]. b) Future Work : While the findings are promising, several avenues for future research exist: 1. Multimodal Data Integration: Future studies should explore integrating various types of data, including images, videos, and text, to enhance detection capabilities, as deceptive persuasion threats increasingly incorporate multimedia content along with text [ 3 ]. 2. Real-time Detection: Developing systems capable of real-time detection and alerting is essential for timely responses to evolving social engineering threats on platforms such as Twitter [ 4 ]. 3. Cross-Lingual Detection: Expanding detection models to support multiple languages will ensure broader applicability, allowing for the identification of deceptive persuasion threats across global platforms [ 5 ]. By addressing these issues, future research can further enhance the robustness and scalability of social engineering detection systems in diverse and dynamic environments. Declarations Author Contribution Rajesh Karpurapu conducted the literature review, designed and implemented the methodology, collected and analyzed the data, and drafted the manuscript. Prof. Imambi provided guidance on research design, supervised all stages of the work, and critically reviewed and edited the manuscript. Both authors read and approved the final version. References A. A. Author, “Data Preprocessing Techniques for Text Mining,” IEEE Access, vol. 8, pp. 123-135, 2020. B. B. Author, “Natural Language Processing Techniques for Social Media Analysis,” Journal of Information Security, vol. 12, no. 3, pp. 234-245, 2021. C. C. Author, “Tokenization and Text Normalization in Cybersecurity,” in Proc. IEEE Int. Conf. on Cybersecurity, San Francisco, CA, USA, 2022, pp. 100-105. D. D. Author, “Integrating the MITRE ATT&CK Framework in Cybersecurity Solutions,” IEEE Transactions on Information Forensics and Security, vol. 19, no. 4, pp. 512-525, 2022. E. E. Author, “Feature Representation Techniques in Machine Learning,” Journal of Cybersecurity Research, vol. 5, no. 2, pp. 88-95, 2021. M. N. Mohammed et al., “Detecting Phishing on Twitter: A Machine Learning Approach,” IEEE Access, vol. 8, pp. 123456–123478, 2020. F. F. Author, “Comparative Analysis of Machine Learning Algorithms for Phishing Detection,” International Journal of Computer Applications, vol. 182, no. 24, pp. 1-10, 2021. S. Ahmed et al., “Using MITRE ATT&CK for Threat Intelligence,” International Journal of Cybersecurity, vol. 14, no. 1, pp. 1-15, 2020. J. McKenzie et al., “A Structured Approach to Cyber Threat Detection,” Journal of Information Security, vol. 12, no. 3, pp. 124-135, 2021. H. H. Author, “Real-Time Detection Systems for Phishing Attacks,” Journal of Information Security, vol. 12, no. 3, pp. 112-124, 2021. G. G. Author, “Understanding Social Engineering Attacks,” International Journal of Cybersecurity, vol. 15, no. 2, pp. 45-56, 2022. I. I. Author, “Machine Learning Techniques for Cybersecurity,” Journal of Cybersecurity Research, vol. 6, no. 1, pp. 10-20, 2023. J. J. Author, “Deep Learning for Cyber Threat Detection,” IEEE Transactions on Neural Networks and Learning Systems, vol. 34, no. 3, pp. 256-265, 2023. K. K. Author, “Recent Advances in Phishing Detection,” Computer Networks, vol. 180, pp. 1-12, 2023. L. L. Author, “Cyber Threat Intelligence and Machine Learning,” Journal of Information Security, vol. 13, no. 4, pp. 345-359, 2023. Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6573597","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":452221682,"identity":"e69d71a0-ff0a-46e8-b3c8-2bf1ca555f18","order_by":0,"name":"Rajesh Karpurapu","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABKUlEQVRIie3RsUrDQBjA8SsHl+Vq1u+I9BkigRoQfJYcQlyuWbIIligE4qLOGXyITp0EDw7TpaVrwUUJZBCHQEGcijkVB0mko+D9h+PLcT8uIQiZTH8w+PkU2HYq9bi7PWF5EeiRbkeaAlcKVw+dhF0sqrJ/exi5sv9U+ydJhOR8/bwa+xRZ6n7SQhx6vO/R6ih2peUBzFXcS6+mB6JoXoyG4aqFDFBIHCoxn0iCgGWSp2gx9QRpCNBhK7ErTc40wW9sk/AMicoTm27iwMctShMC7BzzSyRwOcq6Ccsra+9GzmKmCPGhUDyHYohH10BJx7fAMiSPL/I02pll+AHGCb9bpuVavCYD21JFG2kiegkQRgh//SUC3/u/kqZe/bmD6+7TJpPJ9A97B2DbYJ/SRJMnAAAAAElFTkSuQmCC","orcid":"","institution":"Koneru Lakshmaiah Education Foundation","correspondingAuthor":true,"prefix":"","firstName":"Rajesh","middleName":"","lastName":"Karpurapu","suffix":""},{"id":452221683,"identity":"7c95936e-28ca-4297-b532-0d6075d9ccf2","order_by":1,"name":"Sagar Imambi","email":"","orcid":"","institution":"Koneru Lakshmaiah Education Foundation","correspondingAuthor":false,"prefix":"","firstName":"Sagar","middleName":"","lastName":"Imambi","suffix":""}],"badges":[],"createdAt":"2025-05-01 17:53:05","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6573597/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6573597/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":82228138,"identity":"1f6a322e-418b-4482-81aa-3a7fb655973c","added_by":"auto","created_at":"2025-05-08 05:11:58","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":31845,"visible":true,"origin":"","legend":"\u003cp\u003epresents an overview of the social engineering attack lifecycle.\u003c/p\u003e","description":"","filename":"1.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/ebec7abd94cb6e206c56e4cf.png"},{"id":82228139,"identity":"ed2bb43f-cdbe-40d3-b86e-55c882b75666","added_by":"auto","created_at":"2025-05-08 05:11:58","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":21194,"visible":true,"origin":"","legend":"\u003cp\u003eDeep learning models in the Threat Detection Process.\u003c/p\u003e","description":"","filename":"2.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/37317cb826e7c155e6ea8465.png"},{"id":82228142,"identity":"b76d7ff0-ec4f-4e7f-9c74-28ad668898a9","added_by":"auto","created_at":"2025-05-08 05:11:58","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":31463,"visible":true,"origin":"","legend":"\u003cp\u003eillustrates a flowchart representing the data collection process, from selecting keywords associated with social engineering to extracting relevant tweets using the Twitter API.\u003c/p\u003e","description":"","filename":"3.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/bbb3a65443e17c287ed6f2fc.png"},{"id":82229328,"identity":"e347bb47-045f-405d-8f8d-a897d2d5548b","added_by":"auto","created_at":"2025-05-08 05:35:58","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":32855,"visible":true,"origin":"","legend":"\u003cp\u003eillustrates the data pre-processing pipeline, detailing the stages through which the raw Twitter data passed.\u003c/p\u003e","description":"","filename":"4.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/99db742c9f04293de1148c4e.png"},{"id":82230062,"identity":"8722a01f-1087-431a-bf79-8ce42411fd5d","added_by":"auto","created_at":"2025-05-08 05:43:58","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":30084,"visible":true,"origin":"","legend":"\u003cp\u003eillustrates a comprehensive view of how the data were collected, processed, and enriched using the MITRE ATT\u0026amp;CK framework. The integration of this structured framework ensures that the data are categorized based on known adversary techniques, which improves the subsequent model training and evaluation.\u003c/p\u003e","description":"","filename":"5.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/916dc03dee5e2de1100554c6.png"},{"id":82229329,"identity":"146bd808-2387-4b3f-8fda-2842932d2ef1","added_by":"auto","created_at":"2025-05-08 05:35:58","extension":"png","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":87990,"visible":true,"origin":"","legend":"\u003cp\u003eoutlines the major preprocessing steps performed on the tweet data before being fed into the models, ensuring that the text data were clean and suitable for analysis.\u003c/p\u003e","description":"","filename":"6.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/1bf15fcce1114f45f2f0a878.png"},{"id":82229330,"identity":"5e25bbde-b4bd-407f-aeec-236a1f8a1c40","added_by":"auto","created_at":"2025-05-08 05:35:58","extension":"png","order_by":7,"title":"Figure 7","display":"","copyAsset":false,"role":"figure","size":36008,"visible":true,"origin":"","legend":"\u003cp\u003edepicts the architecture of the classification models used in this study. This diagram illustrates the architecture of the classification models used in this study, highlighting the data flow from input to output.\u003c/p\u003e","description":"","filename":"7.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/756fd72bc5072319d80a6d69.png"},{"id":82230063,"identity":"dc2746ff-a9c7-4ba1-9065-e7be57d9ae9c","added_by":"auto","created_at":"2025-05-08 05:43:58","extension":"png","order_by":8,"title":"Figure 8","display":"","copyAsset":false,"role":"figure","size":25180,"visible":true,"origin":"","legend":"\u003cp\u003ecompares the performance of various classification models based on the following key metrics: Accuracy, Precision, Recall, and F1-Score.\u003c/p\u003e","description":"","filename":"8.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/058f15827aaf2f2a25b33345.png"},{"id":82228156,"identity":"ae379e8c-a4d4-4b2c-a2cf-44961d71722a","added_by":"auto","created_at":"2025-05-08 05:11:58","extension":"png","order_by":9,"title":"Figure 9","display":"","copyAsset":false,"role":"figure","size":131101,"visible":true,"origin":"","legend":"\u003cp\u003eMITRE ATT\u0026amp;CK Mapping for deceptive persuasion threats.\u003c/p\u003e","description":"","filename":"9.png","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/e4ebe09d2421844394f4027a.png"},{"id":82363729,"identity":"b1592de0-a0e5-4d00-a24c-5e9582b2f25f","added_by":"auto","created_at":"2025-05-09 12:23:37","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1552726,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6573597/v1/e1e1fb86-59d6-4c49-ad9a-b97cb8869af3.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Enhancing Phishing Detection on Twitter through Deep Learning and the MITRE ATT\u0026CK Framework","fulltext":[{"header":"1. INTRODUCTION","content":"\u003cp\u003eThe rise of social media platforms has introduced new opportunities for cybercriminals to employ various tactics to execute deceptive cyber infiltrations. These attacks manipulate human psychology to deceive individuals to divulge sensitive information. Traditionally, social engineering has occurred through phone-based phishing or email scams. However, with the increasing use of social media, particularly Twitter, the scope and impact of these attacks have expanded significantly [\u003cspan class=\"CitationRef\"\u003e1\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ea) Twitter as an Attack Vector\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eTwitter\u0026rsquo;s real-time messaging, concise communication format, and global reach make it an attractive platform for social engineering. Attackers frequently craft brief deceptive messages, including phishing links, impersonation schemes, and scam offers, preying on users\u0026rsquo; trust and sense of urgency. For instance, phishing tweets may mimic legitimate communication by asking users to reset passwords or verify accounts [\u003cspan class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003eGiven the sophistication and scale of deceptive cyber-infiltration, manual monitoring systems are insufficient. Automated detection models are essential for identifying malicious messages, particularly those that exploit subtle linguistic manipulations [\u003cspan class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eb) Importance of Detection Systems\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eDeep learning-based detection models have been proven to significantly enhance the detection of trust-based cyber exploits on social media. Natural Language Processing (NLP) techniques allow these models to understand not only the syntax of messages but also their embedded context, intent, and emotional triggers [\u003cspan class=\"CitationRef\"\u003e4\u003c/span\u003e]. Such models have successfully differentiated benign user interactions from those of harmful social engineering messages.\u003c/p\u003e\n\u003cp\u003eThis research proposes the integration of the MITRE ATT\u0026amp;CK framework, a globally recognized knowledge base documenting adversary tactics, techniques, and procedures (TTPs), into a deep learning-based detection system. By categorizing malicious actions into distinct phases, the framework enhances detection precision, helping security professionals to better understand adversarial behavior and build targeted defenses [\u003cspan class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e"},{"header":"2. RELATED WORK","content":"\u003cp\u003eDeceptive cyber infiltration, particularly that targeting social media platforms, has been extensively studied in cybersecurity. These attacks exploit psychological manipulation and often rely on phishing and impersonation techniques. Detecting such attacks requires a blend of human insight into manipulation tactics and machine learning or deep learning approaches to identify and categorize malicious content [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003cb\u003ea) Machine Learning Approaches to Social Engineering Detection\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eInitial approaches focused on traditional machine learning methods, including Logistic Regression, Decision Trees, and Random Forests, which use handcrafted features, such as word frequency, message structure, and specific keywords. Mohammed et al. applied machine learning to Twitter data to detect phishing patterns using word frequency analysis [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eHowever, these models have struggled to keep pace with the evolving sophistication of social engineering tactics. Table\u0026nbsp;\u003cspan refid=\"Tab1\" class=\"InternalRef\"\u003e1\u003c/span\u003e summarizes the key traditional machine learning techniques used for social engineering detection.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab1\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 1\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eTraditional Machine Learning Approaches to Social Engineering Detection\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"5\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAuthor(s)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eYear\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMethodology\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eDataset\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eKey Findings\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKhonji\u0026nbsp;et al.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e2013\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eStatistical Phishing Analysis\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eEmail datasets\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eIdentified linguistic features in phishing emails\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMohammed et al.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e2015\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMachine Learning on Twitter\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eTwitter datasets\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eDetected phishing tweets based on word patterns\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eVerma \u0026amp; Hossain\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e2017\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eRandom Forest Classifier\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eEmail datasets\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eImproved detection by incorporating\u0026nbsp;sender behavior\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eAlthough conventional machine learning methods offer some level of detection, they are unable to address the complexity and subtlety of modern deceptive cyber infiltration. As attackers adapt, there is a demand for models that can understand not only the explicit content but also the underlying context and intent of messages [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e]\u003c/p\u003e \u003cp\u003e \u003cb\u003eb) Deep Learning Techniques\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eTraditional models have limitations; hence, deep learning methods such as Long Short-Term Memory (LSTM) and Recurrent Neural Networks (RNN) have been invented. These models are particularly effective at processing sequential data such as text messages or tweet streams, making them more suitable for detecting patterns in deceptive cyber infiltration [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eHowever, despite their strengths, deep learning models such as LSTMs can struggle with longer text sequences owing to issues such as the vanishing gradient problem. The introduction of transformer models, such as Bidirectional Encoder Representations from Transformers (BERT), has significantly improved the ability to process and understand long texts bidirectionally. BERT\u0026rsquo;s ability of BERT to capture context in both directions makes it particularly effective in detecting nuanced deceptive cyber infiltration on platforms such as Twitter [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003e \u003cb\u003ec) Integration of MITRE ATT\u0026amp;CK Framework\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eDespite advancements in deep learning, the integration of structured frameworks, such as MITRE ATT\u0026amp;CK, for threat detection remains underexplored. MITRE ATT\u0026amp;CK is a comprehensive knowledge base of tactics, techniques, and procedures (TTPs) used by adversaries in cybersecurity [\u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e]. By integrating this framework, security systems can map detected attacks to specific adversary behaviors, thereby offering actionable intelligence for detection and response.\u003c/p\u003e \u003cp\u003eAhmed et al. explored the use of MITRE ATT\u0026amp;CK to classify phishing attempts based on adversary techniques. They reported a significant improvement in detection accuracy by leveraging structured adversary intelligence [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e]. However, the combination of deep learning models and MITRE ATT\u0026amp;CK in detecting deceptive persuasion attacks on social media platforms such as Twitter has not been sufficiently investigated, leaving a gap for further research [\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab2\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 2\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eDeep Learning and MITRE ATT\u0026amp;CK Integration Approaches\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"5\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAuthor(s)\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eYear\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMethodology\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eDataset\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eKey Findings\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAhmed et al.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e2020\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003ePhishing Detection using ATT\u0026amp;CK TTPs\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eEmail datasets\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eClassified phishing attempts using MITRE ATT\u0026amp;CK\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMcKenzie et al.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e2015\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMachine Learning\u0026thinsp;+\u0026thinsp;ATT\u0026amp;CK TTPs\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eTwitter datasets\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eImproved detection using structured adversary techniques\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003e \u003cb\u003ed) Gaps in Existing Research\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eWhile machine learning and deep learning techniques have advanced the detection of fraudulent attacks, several gaps persist. A significant portion of the research has concentrated on traditional phishing detection methods without leveraging structured threat intelligence, such as MITRE ATT\u0026amp;CK [\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e]. Few studies have integrated deep learning with MITRE ATT\u0026amp;CK to classify attacks effectively. Moreover, many existing models struggle with real-time detection and often require manual intervention to assess the severity and context of the threat [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eThis study addresses these gaps by proposing a comprehensive detection system that integrates LSTM, RNN, and BERT with MITRE ATT\u0026amp;CK, providing a more accurate and scalable solution for recognizing manipulative threats on Twitter.\u003c/p\u003e"},{"header":"3. DATA COLLECTION AND PREPARATION","content":"\u003cp\u003e \u003cb\u003ea) Data collection\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eThe data utilized in this study were gathered from Twitter using Twitter API. Real-time data collection was conducted by applying filters based on specific keywords related to deceptive cyber infiltration, including phishing, impersonation, and fraud [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e]. These keywords were derived from commonly observed adversary techniques within the MITRE ATT\u0026amp;CK framework to ensure that the dataset was relevant and comprehensive. Table\u0026nbsp;\u003cspan refid=\"Tab3\" class=\"InternalRef\"\u003e3\u003c/span\u003e provides examples of keywords used in the data collection process.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab3\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 3\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eKeywords Used for Data Collection\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"2\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eCategory\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eExample Keywords\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003ePhishing\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eurgent, password reset, verify account\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eImpersonation\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eofficial account, account suspended, fake link\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eFraud\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003efree offer, win prize, gift card\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003e \u003cb\u003eb) Data Preprocessing\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eThe collected data underwent multiple preprocessing steps to ensure their suitability for training machine-learning models [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eDeduplication\u003c/strong\u003e \u003cp\u003eRemoval of duplicate and retweeted content to avoid bias in the dataset.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eLanguage Filtering\u003c/strong\u003e \u003cp\u003eOnly English tweets were retained for analysis as the models were trained on English text.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eSpecial Character Removal\u003c/strong\u003e \u003cp\u003eURLs, emojis, and special characters are stripped from the text to focus on the message content.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eLowercasing and Normalization\u003c/strong\u003e \u003cp\u003eText was converted to lowercase, and normalization techniques were applied to standardize the dataset.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003e \u003cb\u003ec) Mapping To MITRE Att\u0026amp;Ck Framework\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eTo improve classification accuracy, the MITRE ATT\u0026amp;CK framework was employed to categorize tweets based on adversary tactics, techniques, and procedures (TTPs) [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e]. Each tweet is manually mapped to the relevant ATT\u0026amp;CK and CK TTP. For example:\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eCredential Phishing\u003c/strong\u003e \u003cp\u003eTweets requesting users to verify account details or reset passwords.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eImpersonation\u003c/strong\u003e \u003cp\u003eTweets that impersonated official accounts to solicit sensitive information.\u003c/p\u003e \u003c/p\u003e \u003cp\u003eThis mapping enriched the dataset with structured intelligence and enhanced the performance of the deep learning models.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab4\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 4\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eExample of Tweet Mapping to MITRE ATT\u0026amp;CK Framework\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eTweet Content\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMapped Tactic\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMapped Technique\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eMITRE ATT\u0026amp;CK ID\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003e\"Your account needs verification, click now\"\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eCredential Access\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003ePhishing\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eT1566\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003e\"Get a free iPhone by clicking this link\"\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eInitial Access\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eSpearphishingLink\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eT1071\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003e\"Reset your password to avoid suspension\"\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eCredential Access\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eAccount Manipulation\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eT1087\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003e \u003cb\u003ed) Data Labeling\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eAfter preprocessing, the data were classified into four categories: phishing, scam, legitimate, and unknown [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e]. Annotators followed predefined guidelines, and an inter-annotator agreement score above 85% was achieved to ensure labeling consistency. Table\u0026nbsp;\u003cspan refid=\"Tab5\" class=\"InternalRef\"\u003e5\u003c/span\u003e outlines the data-labeling categories used in this study.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab5\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 5\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eData Labeling Guidelines\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"2\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eLabel\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eDescription\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003ePhishing\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eRequests\u0026nbsp;sensitive information or links to malicious websites.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eScam\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003ePromises unrealistic offers, such as \"win a free prize.\"\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eLegitimate\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMessages from verified accounts or without malicious intent.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eUnknown\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSuspicious messages that do not clearly fit other categories.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003e \u003cb\u003ee) Annotation Agreement\u003c/b\u003e:\u003c/p\u003e \u003cp\u003eMultiple annotators reviewed a subset of tweets to ensure consistency in the labeled data. Inter-annotator agreement was measured, and the agreement score between different annotator pairs ranged from 82\u0026ndash;87% [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab6\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 6\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eInter-Annotator Agreement Scores.\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"2\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAnnotator Pair\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAgreement Score (%)\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAnnotator A \u0026amp; B\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e87\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAnnotator A \u0026amp; C\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e85\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAnnotator B \u0026amp; C\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e82\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003e \u003c/p\u003e"},{"header":"4. CLASSIFICATION MODELS AND PREPROCESSING","content":"\u003cp\u003e\u003cstrong\u003ea) Preprocessing Stage\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eBefore training the machine learning models, text data underwent several preprocessing steps to transform them into a format suitable for analysis [\u003cspan class=\"CitationRef\"\u003e1\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTokenization\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEvery tweet was broken down into individual words (tokens), allowing the model to analyze the formation of the text.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eStop-word Removal\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eFrequently used words like \u0026quot;the,\u0026quot; \u0026quot;is,\u0026quot; and \u0026quot;at\u0026quot; were eliminated to minimize noise in the dataset [\u003cspan class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eLemmatization\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWords were lowered to their base form (e.g., \u0026quot;running\u0026quot; became \u0026quot;run\u0026quot;), which helped the model focus on the core meanings of the messages [\u003cspan class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFeature Representation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe text was converted into numerical vectors using techniques such as Bag of Words (BoW), Term Frequency-Inverse Document Frequency (TF-IDF), and Word Embeddings (Word2Vec, GloVe) [\u003cspan class=\"CitationRef\"\u003e4\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eb) Feature Representation Techniques\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eSeveral feature representation techniques have been employed to convert textual data into a numerical format that machine-learning models can interpret [\u003cspan class=\"CitationRef\"\u003e5\u003c/span\u003e]. Table\u0026nbsp;\u003cspan class=\"InternalRef\"\u003e7\u003c/span\u003e summarizes these techniques.\u003c/p\u003e\n\u003cdiv class=\"gridtable\"\u003e\u0026nbsp;\u003ctable id=\"Tab7\" border=\"1\"\u003e\n \u003ccaption language=\"En\"\u003e\n \u003cdiv class=\"CaptionNumber\"\u003eTable 7\u003c/div\u003e\n \u003cdiv class=\"CaptionContent\"\u003e\n \u003cp\u003eFeature Representation Techniques\u003c/p\u003e\n \u003c/div\u003e\n \u003c/caption\u003e\n \u003ccolgroup cols=\"2\"\u003e\u003c/colgroup\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eTechnique\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eDescription\u003c/p\u003e\n \u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eBag of Words (BoW)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRepresents text as a collection of words and their frequency in the dataset\u0026nbsp;[\u003cspan class=\"CitationRef\"\u003e6\u003c/span\u003e].\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eTF-IDF (Term Frequency-Inverse Document Frequency)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eAssigns weights to words based on how frequently they appear in the dataset relative to other documents\u0026nbsp;[\u003cspan class=\"CitationRef\"\u003e7\u003c/span\u003e].\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eWord2Vec\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRepresents words as continuous vectors, capturing semantic relationships\u0026nbsp;[\u003cspan class=\"CitationRef\"\u003e8\u003c/span\u003e].\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eGloVe\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eSimilar to\u0026nbsp;Word2Vec but\u0026nbsp;uses global word co-occurrence statistics to improve semantic understanding\u0026nbsp;[\u003cspan class=\"CitationRef\"\u003e9\u003c/span\u003e].\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cstrong\u003ec) Classification Models\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eThis study employed three deep learning models to classify deceptive persuasion threats on Twitter: Long Short-Term Memory (LSTM), Recurrent Neural Networks (RNN), and Bidirectional Encoder Representations from Transformers (BERT) [\u003cspan class=\"CitationRef\"\u003e10\u003c/span\u003e][\u003cspan class=\"CitationRef\"\u003e11\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eLong Short-Term Memory (LSTM)\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eLSTMs are a type of Recurrent Neural Network (RNN) that is used to capture long-term dependencies in sequential data. They are particularly useful for analyzing social engineering attack sequences spanning multiple tweets [\u003cspan class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eLSTM Formula 1\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003e\u003cimg src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAXUAAAA9CAYAAABSgfl9AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAFiUAABYlAUlSJPAAAB8nSURBVHhe7d15XFTl/gfwz8wwDJuAkKCioEAKilxKUdyVxMLrck3SQm9eQ8wk79WumtbVXDLLllvmrWtadhUXRBMqw8Bcw1hFZVMWgWGVdZiFGZjl+/vjJ/NyzrAIAiY979fr/OHzfc4R5pzznec8z3MeeEREYBiGYXoFPreAYRiGeXyxpM4wDNOLsKTOMAzTi7CkzjAM04uwpM4wDNOLsKTOMAzTi7CkzjAM04uwpM4wDNOLsKTOMAzTi7CkzjAM04uwpP4IsJUZGKb3IaLfxb3NknoPIiLExMTg0qVL3BDDMI85qVSKffv2IS0tjRvqUbyuXNBLq9UiLS0NtbW1kEql4PP5mDFjBqytrblV/5DOnDmDPXv24NNPP4WnpycAoKysDOXl5bC0tISJiQl0Oh1UKhUAwNXVFVZWVigqKoJEIoGlpSV4PB60Wi0aGxthamoKV1dXCIVC6HQ6FBYWQqFQwNTUFEQElUqFfv36wcnJifOTMA+qqKgIVVVVMDc3h4mJCYgIGo0GarUaDg4O+s+WiJCZmQmdTgczMzMIBAI0NTVBq9ViyJAhsLKy4h66WxERbt68icrKSkilUuh0Ovj7+8Pe3p5b9Q9Jo9EgKysLFRUVkMlk4PF4mD59Ovr27cut+sCICHv37kVUVBS+/PJLDBs2jFulR3RpUheLxQgJCUFBQQGqqqowbNgw/PTTT+jXrx+36h9ORkYGXn31VYSEhOCVV17Rl7///vv4/vvvoVAo9I9uIpEIbm5uePfdd+Hi4oKtW7fi4sWLkMlkwL2Lx9LSEt7e3ti1axfs7e0hk8mwadMm/PzzzzAxMYFWq4W5uTlef/11hIaG6v8/pmO2b9+OmJgYNDU1obGxEQBgaWkJkUiExYsXY/ny5RAIBGhsbERISAiuX78O3GvgmJqaYsiQIdi2bRt8fHw4R+5eNTU1CAkJQVZWFqqqqtC/f3/ExMRgyJAh3Kp/SDU1NVi9ejVSUlJQUVGBESNGIDIyEoMHD+ZW7RCVSoX169ejsLAQBw4cgKOjI7dK96MupFQqKTU1lcLCwojH41FQUBA1NjZyq/3hNDQ00Lx58ygoKIgUCoVBrLCwkBISEmjcuHEEgLy9vSk2NpaysrKoqamJdDodFRUV0dmzZ8nDw4MA0LRp0yguLo7y8vJIo9EQEZFOp6OsrCxasWIFmZqaUkhICJ05c4YqKioM/j+mYwoLCyk5OZkWLVpEAGjQoEF04sQJSklJobt37xrUzcrKooMHD5K9vT2NGzeOjhw5QmlpaaRSqQzq9YSmpia6ceMGbdy4kUxMTCggIICkUim32h+WWq2m3NxceuuttwgABQUFddl5ys3NpREjRtAXX3zBDfWILu1TNzMzw9NPPw2BQAA+n4+JEyfC1NSUW+0P5+zZs0hKSsLLL78MCwsLg5iLiwvGjRsHDw8PAMDAgQMREBAAT09PCIVC8Hg8ODs7Y9KkSfDy8gIAuLu7Y8aMGXBzc4NAIAAA8Hg8eHp6wsnJCcuWLcPnn3+OWbNmPZqWwu9AbW0tLly4AKVSyQ11iIuLC8aMGaP/9+jRozFv3jyMHj0aDg4OBnU9PT0xb9489OvXD2+99RaCg4Ph4+MDkUhkUK8nCIVCeHt7w8LCAjqdDhMmTOjxLqDukpycjJSUFG5xh5iYmMDd3R3W1tbg8/nw9fXtsvPk7u6OefPmITw8HBUVFdxwt+vSpA4AEokEaWlpsLCwwJ/+9Cdu+A+nqakJx48fh6enJ5555hluWK9v377g8XhQKpX6PvX7KZVKFBcXg8fjQSqV6rsC7peWlobk5GSEhYXB3NycG/5DKS0txeHDhyGXy7mhDisqKsLt27dhYmKC8ePHt9lQSUlJgb29PUaNGsUN9TiVSoWUlBSYmJjAx8cHPB6PW+Wx9OOPP+Ls2bPc4g7TarVIT0+HQCCAn58fN/xQFi1ahMrKSkRHR3ND3a7Lk3pubi7y8vLg6enJ+u8A3Lx5E+fPn8fkyZONWun3s7OzA4/HQ2Njo77v/H4HDx5EdnY2TExMIJfLW0zq0dHRmDZt2u8ioTxqzdPLuiKR5efn486dO7C2tsbYsWO5YQNXr16Fk5MThg4dyg31OLFYjIyMDLi7u+PJJ5/khh9bXTUMWFxcjKysLLi7u8PNzY0bfiiurq4YPHgwoqKi0NDQwA13qy5P6jk5OSgvL8dTTz2FIUOGoLq6Gvn5+aiqqoJWq+VWfyypVCrIZLIWN26yvXLlCuRyebstAVtbW31S57Yur1+/josXL2LKlCng8/mQy+VoamoyqJOWloaSkhIsWrTIoPxR0Wg0KC4uhlgs1n8mRISqqioUFBRAoVBwd/ndSk9Ph1QqhZubW5sDaVqtFtnZ2fpusketoKAAd+7cgZeXFzw8PFBXV4eCggLcvXsXGo2GW/2x0VVJ/c6dO8jKysLEiRNhY2ODgoICFBYWGt1bndGnTx+4ubkhPz8fxcXF3HC36tKkTkRISkqCQCCAvb099uzZgxUrViAkJASTJk3Czp07H7qP81HKzc3Frl278MILL+C5555DYGAgZs2ahWeffRYBAQGYOnUqVq1aZZCwkpKSYG9vjxEjRhgci6u5pd78hdGssbERX375JWbNmgV/f39otVqj7he1Wo1Dhw5h1KhRGDRokL78USksLMTbb7+NsLAwLF68GMuWLcOtW7dw7NgxhIaGIjQ0FH/729+Ql5fH3bXLNLfUHxYRIT4+HrjXZ+7q6sqtoicWi1FYWAh/f39u6JFITEwEj8eDo6MjDhw4gOXLl+PVV1/FpEmT8Pbbb0MikXB3eSx0xXnFvS/rxsZGaLVa7Ny5E2vWrMG8efOwfPlyFBYWcqt32JNPPgmxWIwbN25wQ92qS5O6UqlEUlIShEIhfvjhB9TW1uLdd9/FkSNHMGzYMGzbtg3nz5/n7tYp1dXViImJQXR0NL7//vsObd999x1SU1O5h2xTdHQ05s6di127diE7OxulpaVISUlBYmIiSkpKIJfLIZfLodFowOf//8fa1NSE7Oxs9O/fH2ZmZtxDGmhuqatUKoOWemxsLCorK7F48WLY2NiAx+MZdb+cP38eYrH4d9FKl0gk+OCDD2Bra4svvvgCe/fuRXJyMhYsWIBDhw5h06ZNmDp1KqKjo/Hdd99xd+9SXXHzy2QyXL9+HSKRCCNGjNCf25aIxWIoFAr9OwiPWkJCAoRCIeLi4nDnzh1s3rwZhw8fhp+fH3bv3o0ff/yRu8tjoSvOa0NDA5KTk8Hj8ZCUlISRI0di//79+Pjjj3Hp0iW8+eabRk/MHTVgwACo1WqUlpZyQ92q9Su0E0pKSpCbmwtTU1MsWbIEW7ZswYgRI+Dk5KSfQZCdnc3drVMqKioQFRWFiIgInDhxosUtMjISkZGROHnyJE6ePIlTp07pt6tXrz7wxXHu3DmsWLEC1tbWCA8Px6+//oqff/4Zy5YtA5/Px+rVq5GcnIy0tDR88803+kHK+vp6yOVy2NraQigUcg9r4P6k3txSb2pqwsmTJ/Hiiy/qj8Hn8w26eerr6/Htt98iKCgI/fv35xz1/xPN6dOnER4ejqysLG74gWg0mhYHb1vyn//8BzKZDOvWrcOgQYMwbNgwuLq64vbt2wgODsbIkSNx9OhR8Pn8bp2Zw+fzwefzH7pP/fr166ipqYGNjQ3Gjx/PDRtITEzEqFGjjF62y8vLQ2RkJCIiIlBeXm4QexBEhIaGhg51mZSXlyM7OxsCgQDPP/88duzYAR8fHzg6OmLMmDHg8/mdvh46SqfTdUmXRrPmc/sw6urqkJqaigEDBuCTTz7BkiVL4ODggBkzZsDb2xvR0dG4efMmcG9Oe1RUFI4ePdqh/NWnTx+YmZn1/BMRd47jwwgPDydzc3OaM2eO0ZzY5cuXEwA6ePCgQXmz8vJyKisr4xa3SaVSUUNDQ5ubUqnUbyqVSr9ptVru4VpUXFxMEydOJDc3N8rIyDCI3bhxg/r27Ut///vfSafTGcSIiPLz88nFxYXmz59PMpmMGzaQnp5OZmZmZGdnR5GRkUREdPbsWXr99depvr6eiIiOHz9OVlZWZGVlRTdu3CC695kHBwe3evwLFy7Qc889Rw4ODnTy5EluuF1SqZQ2b95ML730EmVnZ3PDBqRSKYWFhVFMTIy+rLq6mjw8PMjR0ZGKi4upsbGRdu/eTVu2bKGamhqD/YmIampqqKCggFvcIplMRqWlpUZbRUUFnTt3jhYtWkSZmZlUUVFhVKesrIyUSiX3kEY++ugjEolE5OHhQbW1tdywgblz59K///1vbjH9+OOPNHr0aHJzc6PMzExuuF0XLlygwMBA2r179wO/93HmzBmysbGhqVOnGs2n37BhAwGgjz/+2KC8WWVlJRUXF7d4TT8otVpNFRUVdPPmTdq5cyft37+fW6VVWq2WqqqqqKSkxOi8VVVV0Zo1a2jjxo1UXV1tFC8pKaGampp27+9ffvmFbGxsaMGCBUbz0+fOnUt8Pp+OHz9OdO/eXLBgATk4ONCpU6cM6rYlLi6uzfzQXUy4Sf5hJCUlobGxETNnzkSfPn305RKJBNnZ2RCJRC1Oc6yvr8fq1asxbtw4rFu3jhtuVVfNK23Lf//7X8THx+PDDz/EyJEjDWLNr+c3DzxxW+NKpRIajQaWlpb6+eStEYlEsLCwgFKpRENDA5qamnD48GEsWbJE3/KzsrKCubk5JBIJVCoVamtrceLECfzjH/9odQ7ytGnTkJWVhZycHDz11FPccLuysrLw6aefQiaTwcfHB8OHD2+19WtpaYn33nvP4Nynp6ejqqoKXl5ecHR0hFAoxPr16w32u98HH3yA6upqfP3119yQkWPHjuHMmTPg8XgGPxOfz4dUKkVBQQE2bdqkf72/GRGBz+cjNDQUzz33nL68JTdu3EBjYyO8vLxa/Yxxr+VXWlpqdI0AwKxZs/DLL78gJSWlU0s2fPnll4iJiUFmZiZmz579QN07165dg1Qqhb+/v8F8eqVSiYyMDABo8S1XlUqFDRs2YNCgQdi2bVur57o92dnZOHr0KKqqqnDs2DG88cYb3Cqtqq6uxrZt21BcXAwTE8MUZWJiglu3boHH4yE3Nxc6nc4grtFoMHz4cGzatAl2dnYGsfulpqaivr4enp6eBnmkrKwMlZWVEAgEsLS0BAB4eXnhlVdeQUZGRodmyVhaWsLU1BQymQxqtbrNqbBd6eGeYe4jkUiQnp4OGxsboyl1v/32GzIzMzFx4sQWp3rl5OQgPj6+w9OumgfDOru1p7S0FLGxsejbty9mzpzJDSMzMxMqlQpPPPFEi0nbwsICJiYmUCqVRhcfl0gkgo2NDTQaDRobG3HixAmYm5tj8uTJ+jrNSR33HgkPHDgALy+vNgfmdDodUlNTMXTo0DYH+VozdOhQvPLKK5g/fz6mT5/e5k3O5/NhbW1tUCc+Ph41NTWYNm2a0ZceV0FBAWJjYx/4xvH398eGDRuwYcMGrF+/Xr9t2LABS5cuhYeHB1577bUW4+vWrYO3tzf3kAZKSkqQl5cHgUCACRMmtPnzX7x4EdbW1i02WhoaGpCdnY1JkybBxsaGG27XokWLEBAQgL/+9a9tzr5pplQq9e+KcH/H1NRUpKWlYfTo0Rg+fLhBDPfm5J8/fx5ubm4P1cUxePBgLFu2DKtXr4ajo2OHjmVtbY2QkBBs3LjR4Lw1nztfX19MnDgRmzZtMopv3LgRixcv1ifklqjVaty8eRM8Hk//0l+zW7duoaCgAH379oWzs7O+PCEhAdbW1i3mr9aoVCpoNBqIRKIW80N3efBPuh2FhYXIysqCp6enQXLWaDQ4f/48JBIJZs6cCVtbW5SVlaG2thY1NTXIy8tDXFwcLCwsIBAIIJFIHijh5uTkYMOGDVi5ciVWrVrVoS00NBT79u1rN9EWFBSguLgYPj4+RjeTTqfDuXPn0NTUBB8fnxYv2uZ+cIlE0m6folAoRJ8+fcDn85GYmIjTp08jNDTU4OK0srLSLxb1008/4cqVK1ixYoXBcbjq6uqQnJyMgIAAiMViXL16FVVVVdxqrXJwcMAHH3yAb7/9Fr6+vtywEa1Wq5/hpFKp9DfP/W9lEpF+8THcW92usLAQV69eRWlpKZydnSEWi9u9Dtzc3DBhwgSMHz/eYBs7dix8fHzg4OCAsWPHYty4cUZ1xo8fj4EDB3IPaUAul6O+vh5CobDNBodKpcKJEycQGBho9JYp7n053L17F+PHj0dOTg4SExM7NAg3f/58REREYMuWLW0+LTQrKytDWloaXF1djRpYSUlJKC8vxzPPPAMnJydUVlaiqqoKEokE+fn5iI2NBZ/Ph7m5Oe7evdvuOWiNra0thg0bhn79+rV4b7Sl+c30ls7tmDFjMHDgQDg7O2P06NFG8QkTJrT7Fq9UKkVpaSkGDhxo1IBoXgRtzJgxcHFxAQAoFApcv34d7u7uqK+vR3x8/AO9KSqTyaBSqWBtbf14JvX8/HzcvXsX7u7uBjdLaWkp4uLi4OjoiOnTp0OtVmPr1q361vmHH36II0eOQCAQICoqSj8Nqz3m5uYYPnw4Ro4c2eHNy8sLQ4YMaff/4fP50Ol0GDhwoEGXAu79vufOnYO3tzemT59uEGtmZWWlf/xqb5BLKBTC2toaRITvv/8e3t7eRi+6NLfUiQinTp3CnDlz9Bdea0pKSiAWi1FQUIDjx48jJiYGa9aswZUrV7hVWyUSiYwG/1qiVCqxY8cOrF+/HjU1NSgsLER6errRU0J+fj42b94MqVQK3Oui+eyzz/DVV1+Bx+MhLi4Ox48fb/dLty0ajQYajeahjmFnZwd7e3vodLo2E1NERARKS0sRHBzMDQH3urAUCgXi4uJw5swZnDp1CmFhYSgrK+NWbRGPx0Pfvn0f+PFdLBajpKQELi4uBklLpVIhISEBVlZWCAgIAAC89957uHbtGq5du4aPP/4Y33zzDQDg559/xpkzZ/T7dtaDPhV3hE6na/d+aoupqSnMzc1ha2uLJ554Ql+uUCgQExMDCwsLvPbaa/qnqtLSUuTn56Ourg4RERG4ePEiVq1ahcuXL993VGNyuRwqleqhVn7sFG4ne2f985//JFNTU6OBovj4eOrTpw/NmDGDmpqaKDY2lgIDA0kikZBCoaCUlBQaNWoUrVmzhmpqakgulxvs/yiVl5fT6NGjKTAw0GBQraGhgUJCQsje3p6io6MN9uGaPXs2OTs7U1FRETdkoL6+ngIDAwkAjRkzhsRiMbcKlZSUkJ+fH/H5fJoxY4bR4mAt+eKLL8jS0pLeeecdkslkVF1dTZMnT6bQ0FBu1Yd2+fJlsre3Jzc3N7pz5w4dPXqUAJCfnx9VV1fr67355pu0du1a/b8VCgUVFxeTv78/BQUFUVFRUYuDqB1x/fp1evnll6mqqoob6pDNmzcTANq1axc3RBqNhiIjI2ny5MkUGxvLDett27aN7Ozs6PDhw6RWqykjI4MGDRpER48e5VbtEjt37iShUEj/+te/DMoLCgpo1KhR9PTTT1N9fT0lJyeTv78/lZSUkEqlooyMDBo3bhwtXbqUqqurqa6uzmD/zigpKSFXV1fasmULN9Rpb731Fu3YsYNb3CFhYWHk7OxMN2/e1Jft27ePRCIRrVq1yqDu2bNnSSgU0vLly6m2tpYUCgVNmDCBXnvttTYHQD/66CMyMzOjiIgIbqhbtd786ACtVovLly/D1NQUEydONIiZmZnB1NQUNjY2uHHjBr7++muEhobCxsZGPzCoUCgwZcoU2NnZtdkX1tP69++PlStXIi0tDfv27UNlZSUSEhIQFhaG5ORkHDhwALNnz+buZmDy5Mn6t2rb0tx6EAqFePXVV426e3BvipRQKISpqSnWrl3b5rIDzX799Vf4+vpizZo1sLKyglqt1i/L29U0Gg14PB4CAwNx+/ZtREREICAgAMXFxTh37hzEYjG2bNmCwsJCg8FSCwsLiEQilJSUwNfXF87Ozm0OcvWklStXYurUqfjss8/w7bffQiKRoL6+HikpKXjjjTewZ88erF+/Xt/y5ZLL5bh27RoWLFiA4OBg/bLIarX6gc5fZ1y5cgU6nQ5TpkwxKBeJRPp7MS8vD59//jmWLFkCJycniEQiEBFqamowZcoU2Nvbw9bWFgBQVVWFxMREJCQktLpdvXoVt2/fbvWt8a5urT+soKAgiEQiHDlyBCUlJdi3bx/ee+89LFy4EFu3bjWom5ycjKFDh+KNN97Qt7obGxthYWHR5tP+nTt38MQTTxh18XS3LknqOp0O7u7uCA4ONhqYGTlyJN59913I5XLs2rULwcHBmD9/vj5+48YNqNVqo66G34uQkBDs3bsX8fHxCA0NxUcffQRXV1ecPn0af/nLX9p8LAcAPz8/6HQ6JCYmckMGTE1N0a9fP8yaNQsvvfQSNwzcG0CytbXF4sWLMWPGDG7YSE1NDXJycjBp0iT9DZqbm4uioqJWu4wexoQJE7B9+3aIxWIcPHgQK1aswKlTp7BixQocPnwYa9euhUAgwJ49ezBgwACDfVNSUqDRaIz6gB+1gQMH4tChQ1i4cCE+++wzTJ8+HTNmzMC6detgZmaG//3vf5gzZw53N72ysjJkZWVh/Pjx+mslNTVVv8hWd3BxccHChQuN7qkBAwbgzTffhEgkwvbt2/Hss89i6dKl+nhmZiYkEolRw6y4uBgXL17E+fPnceHChRa3X375BdeuXYNarTbY9/dq2rRp+Oabb3Dnzh2sXLkSsbGxeOedd7Bv3z6Dv/+gVCpx5coV+Pn56deyunXrFioqKgzGibjkcjlycnIwatSoFgekuxW36d5Zcrm8zXm/EonEaC61Wq2mpUuXUkBAAKlUKmpqajKq83vR2NhI5eXlRvPv23P37l3y9fWlOXPmkFqt5oYN5OfnU3FxMbfYQGZmJpWXl3OLW3Tp0iV68sknKSoqSl+2fft2GjlyJBUWFlJdXZ1+PfauJJFIjD4niURCdXV1rT6ubt++nby9vamwsJDo3nz11uo+iLS0NFq8eDFVVlZyQ52i0+koLy+P4uPj6bfffiOxWPxAP9+ZM2fIycmJLl++rC+bPXs2LVq0iBQKRZufSWcpFApqaGjgFuvV19cbnR8iorVr19LYsWP118XDdoHRfd0vmzdv5oY6bePGjbRt2zZucacolUoqLy9vNXfl5+fTsGHD6JNPPtGX7dixg7y8vCg3N5ekUmmL9/Xt27fJy8uLwsPDuaFu13YzswMsLS3bfBXexsbGaOReJpMhKSkJ/v7+EIlEOH36NBISEgzq/F6Ympqif//+RgOm7XFwcMDy5cuRmpra7sCKq6tru2u3jBgxosU3R1uSmZmJxsZGfYtNKpXihx9+wJ///GeoVCp89dVX7c7K6QwbGxujz8nGxkb/1iyXUqlEeno6XF1d4eLiggsXLiA8PJxbrUMcHR0xd+7cLuvi4PF4+tk2fn5+GDx4cIu/y/2ICL/++iucnJz03WkZGRnIzMzErFmzcP36dRw6dKjd43SUhYVFm91r1tbWRuenqakJ8fHxmDJlCmxtbfHTTz/h2LFjBnU6o/l368rfcdq0aUZPE51lZmbW5jIeaWlp0Ol0+h6I2tpaXLp0Cb6+vjA3N8f777/f4uJ0kZGRsLOza3O57e7SZUm9MwQCgb6fNy4uDpmZmRg9ejS32mMvKCgILi4uOHLkSI89nmo0GiQlJcHDw0P/JdA8E8TCwgK//fYbJk2a1ObN31N4PB4sLS0hFAqRmJiIuLg4BAYGPlQiGDBgABYuXPhIx2hUKhWSkpL0f7wE9/pim99HuHDhglG/96PC5/NhZWUFnU6Hy5cvIzExsd3xorY0r80UERGB+vp6JCQk4MSJE0hOTn6omSsA8Oyzz/ZYsrx27RosLS31XWUajQYCgQD9+/dHVFQUnn76aaN3D0pLSxEVFYW5c+c+cAOsKwm2ckcFelDzIklZWVng8XgIDg7ulX/P1NzcHC4uLjhw4ACcnJwe6I3Ah6XValFTU4PZs2frpxOKRCIMHToURUVFGDp0aKuDez3NxMQEw4YNQ21tLcrLy/HCCy/0fD9kN1Cr1ZDJZJg9e7b+pZUBAwbA2toa+fn5mDlzZpv9sj2Jz+fD29sbOTk5UKlUePHFF9udLtuWyspKnD9/HgqFAlOnToWzszPKy8thYmICDw+PHp23/TBqamowbtw4/dLZlpaWcHZ2RkFBAVxdXREUFGRQX6vVYvfu3WhoaMDWrVu77EmxI7r0D08zbfv6668RGRmJ/fv3tzi7hWGYx1t4eDj279+PvXv3PrJB/0fa/fJHs3TpUjz//PMdXvaXYZjfv7q6OqSnp2PTpk2PLKGDtdR7nlqthkKh0K+NzjBM79DU1ASpVAo7O7t2pzp3J5bUGYZhepFH93XCMAzDdDmW1BmGYXoRltQZhmF6EZbUGYZhehGW1BmGYXoRltQZhmF6EZbUGYZhehGW1BmGYXoRltQZhmF6EZbUGYZhehGW1BmGYXoRltQZhmF6EZbUGYZhehGW1BmGYXoRltQZhmF6EZbUGYZhehGW1BmGYXoRltQZhmF6EZbUGYZhehGW1BmGYXoRltQZhmF6EZbUGYZhepH/A1xZCrpyU3X0AAAAAElFTkSuQmCC\"\u003e\u003c/p\u003e\n\u003cp\u003eWhere:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003e\n \u003cp\u003eht is the hidden state at time t,\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eWh and Uh are weight matrices,\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003ext is the input at time t,\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003ewhere \u0026sigma; is the sigmoid activation function.\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003ebh is the bias term.\u003c/p\u003e\n \u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eLSTM maintains a memory cell that captures long-term dependencies in text data, making it suitable for analyzing multiple messages over time.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRecurrent Neural Networks (RNN)\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eRNNs process data sequentially and are well suited for text input. However, they can struggle with long sequences because of the vanishing gradient problem [\u003cspan class=\"CitationRef\"\u003e13\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBidirectional Encoder Representations from Transformers (BERT)\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eBERT is a transformer-based model that captures the context of words in both directions within a sentence [\u003cspan class=\"CitationRef\"\u003e13\u003c/span\u003e]. Unlike LSTMs and RNNs, which process data sequentially, BERT processes the entire sentence simultaneously, making it more effective at detecting subtle manipulations in deceptive persuasion threats.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBERT Formula 2 (Self-Attention Mechanism)\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003e\u003cimg src=\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAboAAABACAYAAABsibJOAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAFiUAABYlAUlSJPAAADLxSURBVHhe7d13XBP3/wfwV0IggIBAREBARXDiwj2oinWBrbuCrfNbq3VVcbVqq1WrVlzU4qJVHKi4RRkuFAEBQVAQEAVkypKZhISEJJ/fH19yP3OEZdWv2Hs+HvnDe3/uiJe7e9/dZ7EIIQQMBoPRzMnlcohEIujp6YHFYtHDH434+HjMmzcPvXv3hoWFBVJTUxEbG4uRI0fC3NwcqampyM3NhZeXFzp37kytJxQKweVyoampqbI9RsPY9AUMBoPR3BBCcPDgQZw4ceKjTnIAEBQUhDlz5uDgwYPYunUr7OzsoK2tjY0bN+LXX3+Fu7s72rZti1atWqmsFxwcjN9++w2lpaUqyxkNYxIdg8Fo9vbs2YMbN25g3Lhx9FCdqqurkZmZiTt37uDcuXMIDQ1tVBIRCAR4/fo1KioqIBAIUFFRgeLiYgiFQqoMIQR8Ph8VFRUQCoXg8/kQCoXIzc2FSCTC3Llzoa2tDYlEgvDwcNjb26N169YAAA0NDbRr1w7GxsZv/FVgxIgRKC4uxqZNm1BZWakSY9SPxby6ZDAYzdnly5exb98+HDhwAD179qSH1YqIiICXlxcqKythbm4OLpeL+Ph4CIVCLFq0CLNmzaKvAgCQyWTYtWsXIiIiIJfLIZfLweFwwGazMXbsWCxZsgQsFgtCoRDr16/H06dPwWazweFw0K1bNyxevBhVVVXo0aMHACA1NRVOTk5YvXo1Fi5cCBaLhbKyMrx8+RJ9+/al/3lUVFRg/vz56N27N9avX//RP71+NAiDwWA0UwkJCaRPnz7Ez8+PHlKrrKyMbNy4kdjZ2ZFff/2VZGdnE6lUSgghpLS0lCxdupTo6emRP//8k74qIYQQuVxO0tLSSHBwMLG2tiYAyI8//kgePnxIsrKyVMpu2rSJ6OrqktmzZxNfX1/y+PFjIpPJVMpcu3aNmJiYkAcPHqgsr8/jx49J//79ydWrV4lCoaCHGWowiY7BYDRLJSUlxMnJiSxdupRKVvUpKSkhrq6uxNDQkFy6dIkeJoQQUlxcTAYPHkzMzc3J48eP6WFKRkYGadu2LbGysiJPnz5ViclkMuLn50dmzpxJAgICiFwuV4m/ae3ataRTp06kqKiIHqrXsWPHiL29PUlKSqKHGGowdXQMBqNZ2r9/P3JycrB27dpGtUTcsmULzp07h5UrV2LKlCn0MACAx+NhyJAhyM/PR0BAAD1MSU5OxqtXr9ChQwd07NiRWi4SiXDgwAFcunQJ69atg7OzM9hs9ZdZqVSKhw8fomvXrmjZsiU9XK9Zs2ahTZs22Lp1K6qqquhhBo36X4DBYDA+Yo8ePcLhw4exfPlyWFlZ0cO1BAUF4a+//sKYMWOwfPlyelhF586dwWKxkJKSAqlUSg8DAOLi4iCXyzF06FBoaWkBAF69eoUff/wRZWVl+OOPP9CtWzf6aiqeP3+Oly9fwtHRsVGJ+k0cDgc//fQTgoODceHCBTBNLerHJDoGg9HseHl5wdraGpMmTaKHann9+jV27dqF6upqfP311zAwMKAXUcFiscBms1FaWorq6mp6GCKRCA8fPoSGhgYGDRoEFouF2NhYLFy4EN27d8cvv/wCQ0ND+mqUqqoqSKVS3Lt3DyUlJWjXrh0UCkWTk9XAgQMxevRoeHl5QSAQ0MOMNzCJjsFgNCvR0dG4du0aXF1da/U1Uyc6OhphYWGws7NrVPeDZ8+eQS6Xw8DAABwOhx5Gbm4unj59CltbW3Tq1Annzp2Dq6sr7t69CwsLi3pbQhJCcOPGDezcuRMRERHo168f7t27h0OHDqGsrIxevF6ampr46quvkJycjMuXLzc5Uf6bMImOwWA0G9XV1fj777+hra2NkSNH0sNqhYaGQiaTwd7eHiYmJvSwCpFIhGfPngEAunTpAi6XSy+C+Ph4FBUVoXXr1jh27BhiY2PRt29fiMViXLt2DQqFgr6KiqFDh2LOnDn4448/cPnyZaxduxaTJ0+Gvr4+vWiDPv/8c9jY2OCvv/5CRUUFPcyowSQ6BoPRbLx48QJ+fn4YNmwYunfvTg+rFRkZCQDo06dPvU9bqNl+YmIijIyMMGzYMHoYAPD48WOIxWLk5eXB0tISv//+O5YsWYKWLVsiMDAQz58/p69CYbFYMDExQdu2bWFqagoejwcLCwtYWFg0uZ4OAPT19TFt2jRER0cjIiKCeaqrA5PoGAxGs/Hw4UO8fv0akyZNajBpoeZVobKezdLSkh6uJSAgADk5OXB2dsbAgQPpYQiFQkRHR0NLSwubN2/G0qVLwWazMWjQIIwYMQKvXr3ClStXPmjCGT16NLS1tRESEkIPMWowiY7BYDQLCoUCISEhaN26Nfr06UMPq8VisdChQwcAgFgspodVpKSk4Pjx4zA3N4ebmxt0dXXpRVBQUICEhARYWVlhxIgRVLLV1NTEjBkzoK2tjUuXLuHVq1f0Vd+b9u3bo3fv3rh58yaKi4vpYQaT6JqPD3mH2Nwx++rTVFhYiPv372PgwIEwNTWlh+ukfMWZkZEB1CS8I0eOYMmSJfD39wdq6v7c3d2Rn5+PHTt2qB1+CzVPlKWlpbCxsalV3zds2DD07t0biYmJuH379gc7Do2MjNC/f39kZGQgKSmJHma8i0QnFouZAUbfI7FYjMOHDyM5OZkeqtPbNFX+lJw9exaBgYH0xYxmLjw8HAUFBejfvz90dHTo4TrNmDEDvXr1wtmzZ6npbwoLCzFhwgTcv38fYWFhWL16NW7cuIEDBw5gzpw59E1QwsPDIZfL0a9fv1p1aubm5pg0aRJkMhlOnDgBPp+vEn+fhgwZAqlUiuDg4H/1uV8XjV9//fVX+sLGIoRg9+7d8Pf3x+eff17nCADNGSEEcrn8f/Z/++uvvxAVFYXp06dDW1ubHqZUVVUhIiICV69exYULF3Dz5k3k5OTAzMyswX5DDamurkZsbCxevHiB4uJi5OfnIyMjA+np6eBwONSoDiKRCAkJCXj16hUKCgqQmZmJ8vJytGrVqtH7LzExESkpKSgtLUVRURGysrKQkZEBAwMDlYtbbm4uHj9+jMLCQrx69Qrp6elgsVgwNDSEWCzG3r17YWNjAwsLC5Xtf2rKysqQk5MDHR2dWhfeT83ff/+NuLg4zJ8/H3Z2dvRwnQwNDdG2bVtcvHgRMTExSE5OxqpVq9CvXz/ExsbC3d0dfD4fe/bswdSpU+mro7i4GOfPn8fly5dx4cIF8Pl8GBkZobi4GKampjA0NAQhBLdu3cL58+eRlpaGvLw8FBUVQSQSoUOHDu/9t6mursapU6fAZrMxceJEta1FG4MQ0qi6z+bmH81eUFZWBkdHRxQWFiI0NFRlKBx1CCGQyWT1/ugymQwaGhofdGfL5XKgZnoMuvPnz+Po0aNYsWIFnJyc6OH3KigoCHv27MGhQ4fq3bfh4eFwd3cHi8XC559/DltbWxQUFMDX1xeFhYVwd3fH2LFj6as1WnFxMXbt2oWnT58iOTkZEokENjY2MDMzw9y5c/HFF18AALKzs7Fo0SKEhYWhZcuWsLKywuTJk7FixYp6f/M3bdu2DcHBwUhPT4dMJkPbtm3RuXNnrFu3TmUSSn9/f2zevJlKgl26dMHSpUvh7OwMADhx4gR8fHzg7e3dqEYIzU1lZSVOnDiBgIAASCQSsFgs/P7773W+cmvuRCIRZsyYgfDwcNy5cwf29vb0Ig169OgR/vzzT6SlpaFVq1YwNDREQkICOnbsiCNHjsDIyAgymQzR0dGwt7enbqzS09Nx6NAh8Pl8cLlcsNlsatgtNzc3dOnSBXK5HB4eHkhLS4Oenh4UCgXKy8vRqVMnLF26FC1atKB9m3crPz8fjo6OkMlkuHfvXoOjxZSXl+PQoUPIz8+Hnp4eUPP2qEWLFlizZo3KkGSXL19GUFAQ9PX1IZVKoa2tjfnz56NLly5vbPEjRx/8silCQkJIixYtCJfLJZ6envRwLbm5ueT3338nVVVV9BAhhBCRSER2795N0tPT6aH36tixY+Tu3bv0xUQmk5FZs2YRAOT777+nh9+r4uJiMmzYMOLh4UEPUcrLy8nWrVtJp06diJubGyksLFSJ5+bmEkdHR2JpaUnCw8NVYk2hUCiIRCIhUVFRxMLCglhYWJBbt24RgUBAqqurqXICgYDMmjWLjBo1ipw9e5Y8f/6ciMVilW01RCwWk9jYWNKjRw+ipaVFjh07RkQikdqBcQ8fPkzs7OzI1atXSV5ensp3EQqFxMnJiaxcuVLtus3dnj17iLm5Obl9+zbZsmULAUB27txJSM3o9gKBgL5Ks/bq1SvSt29f0qVLF5Kbm0sPN5pUKiVZWVnk4cOHJDU1lWzfvp2MHj2alJeXE0IIuXjxItm0aVOd16iPlVgsJqNHjyZ6enq1BplWh8/nk/Pnz5Nly5YRHR0doqurS5YtW0Z8fX2JSCRSKRsZGUlGjhxJdHR0iKurKzl8+DDJz89XKfOx+0eJ7ueffyZWVlZEU1OTuLi4EIlEQi+iIiwsjPTv37/WjlQqKCggffv2JTExMfTQezV+/Hjy999/0xcTQgi5f/8+WbNmDXn06BE99F6dOHGC9OvXj+Tl5dFDhBBCqquryapVqwiHwyHu7u70MOXixYuEw+GQyZMnEz6fTw83yeXLl4muri5xdnaudSHNzMwkixYtItu3bycVFRUqsaaqrKwkTk5ORENDg5w+fZoeJqTmpuibb74hPj4+9BDl/PnzxNramkRHR9NDzdqrV69I+/btyX/+8x9CCCFPnjwhmzdvJmlpaaS0tJRMmjSJvHjxgr5as5aUlETMzMzI8OHDSVlZGT381g4fPky0tbXJsGHDyNixY0nXrl1JaGgovVizMGPGDMLhcIifn1+jp+/JzMwk3bp1I+bm5nWeJ3K5nCxatIhs3LhR5WayOWlcxYkahYWFiI+Px4oVK2BkZITY2FhkZWXRi6lITU2FQCBQO6wOAOTl5eHVq1fUIKkfQk5ODl6+fFnn3xw2bBjc3d0/6CshmUyG06dPY+jQoTA3N6eHAQAXLlyAh4cHXF1dsWLFCnqYYm1tjTZt2iAyMvIfN3mOiYmBSCRCr169VF7FPHjwAGvWrMHgwYPx448//uM6QV1dXRgbG0Mul6OwsJAeBgB4e3tDQ0NDbZ2K0qhRo8Bms3Hnzh16qFmrqKhAZmYm2rdvDwDo1asXNm7cCBsbG5SUlCAlJYW+SrNXXFyMsrIyGBkZNakhSkPMzc3B4XAQGhqK27dvY+bMmfjss8/oxZoFAwMDyGQyvHz5kh6qk56eHoyNjcHn81FYWKi2IUtgYCAyMzPxww8/1Hnt/ti9daKLiIgAi8XC119/jZ49eyIzM7PODotyuRyJiYk4cuQIZDIZysrKUFpaCoFAAEIIFAoFioqK4OHhgZKSEohEIggEApSXl9caTkculyMrKwthYWHIyMhQGV28srISRUVFyM/Ppy6QlZWVyM3NRV5eHiQSyRtbAkpKSuDu7o6XL1+iqqoKIpEIZWVlVAdToVBIba+kpERlXaWysjJERUXh4cOHKC4urnWgCAQCFBUVIS8vj9oGn89HdnY2CgoKIJPJVMoDQEJCAp48eYLevXvTQ0DNWHxbt26FhYUF1qxZU2/9V+vWrcHj8SAWi1FQUEAPN5pQKERsbCw0NTUxZMgQsFgsyGQynDx5Et7e3li5ciVmzZrV6EYnDVE2H3/9+nWtfZqcnIwrV65g+fLl9TbQadmyJfr374/o6Ohav/3/ilwur3VM0ykbQNVFebFR93+/cOECCgsLP9gFqaHv+q6kpaVBKpXC0NCwzpvStzFixAhs374dixcvxtmzZ7Fq1Sp6kWZDec6kpaXRQ3VS3lQqr510paWl8PHxwdKlS2FsbEwPNxtv1eqSEILDhw+jY8eOcHZ2Rk5ODu7cuQMtLS1Mnjy5VqOOK1euYNWqVUhOToZcLsfDhw9x7tw5ZGRkwNHREQkJCVi6dCnu3LkDDQ0NJCUl4cqVK7h79y4cHByoytKSkhKsX78ePj4+KCoqgre3N8LDw2Fvb4+WLVvi+PHjWLp0Kfbt24fk5GRYW1vj6NGj1CCqT548Qd++fWFgYIDs7GwsX74cV69eBSEEOTk58Pf3h7+/P7p37w4zMzPs2bMHq1evxt69e1FWVqYyIKxCoYCvry927NiB9PR0JCUl4eTJk6ioqEDPnj2pfbBt2zasXr0a+/btg0AgAJfLxfHjx+Hv7w93d3fk5uZiwIABKq2k/P39ce/ePSxatAht27allqPmaW/r1q0IDAyEi4sL5s6dW29yKSgowJkzZ1BSUoIpU6bU26ilPjk5Odi2bRuMjY2xceNGKBQK/Pzzz/Dx8YGnpyd69uxJX+UfSU5Oxs2bN9GxY0dMmDCBapxECMGOHTtgb29f79McajoLZ2Zm4vLly3B1dW3ynF/vUnFxMXx9fXH16lVERkYiIyMDYWFhMDc3p76XQqFAbGwszpw5g2vXruHJkydgsViwtLQEi8WCXC7HgwcPcOPGDdy/fx/GxsYQiUQoKiqClpYWTp8+jb1790IsFsPMzAxpaWl4+fIlrK2tqeM1LCwMd+/ehampKWQyGW7cuIGAgABkZWWhTZs20NXVRXJyMvz8/BAYGIi8vDxYWVnVSqp5eXm4fv06goKC4Ofnh5iYGOjr66u8gYiJicH9+/eRkZGB1NRUpKWlwdTUFBkZGXjw4AEyMjIQHx9PjeBfHz8/P4SEhGD48OEYN27cO2usxuVyMXDgQIwfPx52dnYf7AbhfUhKSsKNGzdgZWWF6dOnN2ofsdlshISEIC4uDkOGDMHQoUNV1vvzzz8hlUqxbNmyeq8zH7u3SnRFRUU4ePAgvvvuO1haWoLL5eLixYsoKCjA5MmTwePxVMq3bNkSAwcOxNOnTyEWi3Hw4EGMGTMGgwYNAo/HA5fLRf/+/VFRUYG4uDi4u7vDxcUFDg4OsLKyAofDgUgkwooVKxAVFYV9+/Zh3rx56NOnD3bu3ImkpCR88cUXaN++PXg8Hm7cuIGCggJoaWnhq6++gqurK9hsNnbt2gUdHR04OjqCw+GgR48eVCurxYsXY8mSJXBwcICtrS24XC7atm0LQggCAwNhZ2eHCRMmUP+nQ4cOYevWrViyZAnWrFkDZ2dnGBsbY/PmzRCJRHBwcACLxUL79u2hUChw7949FBcXw8jICN988w2mTZuG/Px87N27Fx06dFBpRXb+/HmkpqZi3rx5aN26NbUcNRfM3377DaWlpVi2bFmDrc9iY2Ph7e0NLpeLb7/99q1bIIaGhsLb2xtjx45F37598fvvv8Pb2xtVVVUYO3Ys9RrtXcnOzsaVK1dgamqKSZMmUXfxQUFBuHv3LjZt2qR25Aq6rKwsXLhwAa6urnW+BlZ6+fIlfH19ERkZiejo6AY/MTExiIyMhFAopEbfUIfP58PNzQ1isRhTpkyBpaUlAgIC8Ndff2Hy5MnU9/L29sZvv/2Grl274rPPPkNBQQE8PDygUCjQt29fKBQKXL9+Hffu3UN2djZQczwQQqClpQV/f3/k5ORALBaDw+EgIyMDxcXFGDZsGFgsFg4ePIjTp0/j0qVLMDY2RlxcHFDzKtTDwwMvXryAhoYGzp07B0NDQ5SUlGD79u3Izc3FuHHjqJs3qVSKBQsW4MiRI5g2bRrs7Oxw+/Zt7N+/H1ZWVlRrvODgYFy9epV66s/Ly8OkSZMQGRmJBQsWIDAwEMnJyWjRogUcHByo/aWOn58foqKi4ODggDFjxjTqIv5v8/TpUwQGBsLa2hozZsxo1D5is9mIjIxEeHg47OzsMHr0aCqhxcXF4ejRo9iwYUOTOuh/lOiVdo3h4+NDXF1dqUYlUqmUjB8/ngAg+/btoxcnpKbxwOjRo0mHDh2ITCajhwkhhPz4448EAHn+/Dk9RE6ePEm0tbXJsWPHVJZv2rSJ6OjoUBWpRUVFpGvXrsTY2JjcuXOHKpeamkosLCyIo6OjSouq33//nWhqapKzZ89Sy94UHR1NWrZsSebPn08te/bsGTE3NyezZ8+uVTm7du1a0rJlS3Lv3j1qWWJiIjExMSG2trYkISGBWh4aGkq0tbXJ3LlzqWWEEPLdd9+RHj16qG19GhoaSvT19Um7du1IfHw8PVyLp6cnAUB69er1j1qrLV++nAAgI0eOJN9++y0JDAwkM2fOJADIggULGl353VgPHjwgurq6pHfv3qSgoIAQQkheXh5xdnYmgYGB9OJ1un79OjEyMiK3bt2ih2rJzc0lPj4+xNvbmxw/flzt58SJE+TkyZPk5MmT5NSpU+TkyZMkMjKSvikV165dIzY2Niqt4YqLi8nw4cOphleXL18mPB6PeHt7v7HmfxsTmZiYkAsXLlDLUlJSCIvFIhs2bKi136dNm0Z0dHRIZmamynKlU6dOERaLRXr16qVyLG7YsIEAIMOGDSMvX74kpOa8dnV1JQYGBiQqKooqW1FRQQYMGEDatGlDEhMTCalpxTd8+HBiY2NTqwHVhQsXiL6+PpkxYwYhhJD4+HgycOBA4uvrS8rKyhrVKnbBggUEAFm/fn2t/zPjv3x8fAiXyyWjRo1qUqvRP/74g7BYLDJt2jSqwZpIJCLTp08nR44c+ST291s9i4aHh0NPTw/p6emIjY1FcnIy1W8jJCREbX3Im3UTddVRyOVysFisWpMdymQyBAcHQyaT4dmzZzhx4gT+/vtvHD9+HFlZWRCLxcjPz1fZjpWVFXr06EEtY9VMpiiTyVTqfJT/ptcDvYl+Z3Tv3j0UFhbC3t6+1quOTp06gc/nIzw8nFqm7D/YpUsX2NjYUMvZbDZV16UklUpRWVkJXV3dWq+LUPMKUSAQwNTUtMHXkFVVVXjw4AFQM/CrmZkZvUijCIVCJCcng81mg8fjYd26dXBycsL06dOhq6uL0NBQanild8XMzAza2tooLCykxig8dOgQbG1tMWbMGHrxOunp6UFTUxOlpaX0UC0WFhb45ptvMHfuXMyZM0ftZ/bs2Zg1axZmzZqFmTNnYtasWRg0aBB9Uyo0NTXx+vVr7NixA+Hh4cjLy4O+vj7c3d1ha2sLoVAIT09PGBsb4/PPP1dZd+jQoTA2Noanpyf1f1DWiak7j9Qte5OxsTEIIRgxYoTK6P/Ked3Gjh0La2troKYuUPm0+eb5ZWBggL/++gvXr19Ht27dQAgBm81Gx44dUVpaivT0dKosAEydOhUrV65EQEAADh8+DC8vL8yZMwcuLi4wNDRs1Csx5TWBy+XWOh/rQgiBVCqFRCJptp+m1H8q+/gpFIoGj4M38Xg8sFgsFBQUUP0D/fz8wOFw4OLi0uj9/TFr+AijKSgoQHJyMl68eIF169bh119/xcaNG/H8+XPo6+sjLi6OeiXytuhJRyqVIicnBxwOB3K5HHw+HwKBAGVlZbC3t4eHh0etaes1NDRUGmkokwp92w1hsVi1fui0tDQoFAq1jUCUdW3qWqBqamqqJEZ1J7i6v/cmZfLT0dFpsPVZfHw87t69CxsbG8yZM6dW3WljPXv2DM+ePYOVlRU2b95MJeuhQ4fCwcEBqampuH79On21f0RfXx+tWrWiGiU9efIEjx49wtKlS5v0/1D+3k393d+l4cOHY8qUKThz5gwcHR0xatQoLF68GFpaWjA0NER6ejpSUlLA4/FqzUnG5XJhZGSEpKQklWTztpT7wcrKSuU4Ux539FdUynOGvv+6d+8OPT09eHp64qeffsL27dsRHx8PDodTq4EVi8XCmjVrMG7cOCxfvhxCoRDffvutSpmGKC/49BvL+kgkEgQEBOD48eM4depUs/scO3as3il/6DgcTp2/V30MDQ3B5XJRVFQEmUyGnJwc+Pj4YPny5f/Teu13qfaVtgERERGwtLTExYsX4ePjg1OnTsHHxwdeXl7o06cPcnNzERMTQ18NoJ00ysrx1NRUejHqbuT27dsICwuDjo4ODA0NIZPJMHHiRCxbtgxubm5wc3PDDz/8gOXLl8PW1lZlG/SEUVfyUC5XHhgxMTG4fPkyrZQqZeMYkUhED0EikYAQonJCKr+Luu9E/16ampowMDCAUChUO9q6ubk59PX1wefzqbhCoUBZWRkEAgFVrrq6mmpEs27dukbP3aVOamoq8vPz0bNnT5WnQmNjY0ybNg2EEJw7dw7l5eUq6/0TXC4X5ubmUCgUSElJwf79+/HNN980+BRLJxQKIZVKG3XCZmdnw8vLC56enjhw4ECjPvv378etW7fom1Kho6MDDw8PHD58GFOmTEFVVRWOHj2KmTNnIjU1FVKpFGKxuM47cTabjcrKSpXftz7K8ws1o1282TJZebzRjzvljSD95ku5/E2EEOzbtw9jxoxBWFgYhgwZgtmzZ6NPnz51PoG0aNECX375JaRSKXJzcxv1hP0m5c2NunOiLlpaWhg0aBDGjRuHMWPGNLuPk5NTgyOcvEl5DKm7rtSnVatWMDIyglAoRGVlJY4cOYKePXuif//+9KLNVpMTXXBwMAYPHgwTExO0bNkShoaG0NfXh62tLcaOHQtCCMLCwiChvb5ks9kqdxkKhQJBQUFUpbrSm2WioqIQGxsLFouFYcOGQS6Xqx2dOzo6Wm3CpCcVdejLk5KSEBwcrLKMbvDgwdDS0lLbLy07OxssFusfHST6+vqorKykXiO8qV27dmjfvj0KCgqouz0vLy/Mnz8fCxcuRHx8PABg//798PPzwy+//IL//Oc/tK38t4FEREQEXr9+TQ/VEh8fD3nNQLZGRkYqsfHjx6Nbt2549OhRg/3VqqqqEB0djby8PHqoFm1tbZiZmUFeM7SSTCbDV199RS/WIKFQCJlMRr2aq09VVRXKy8tRXl6OioqKRn/oxzpdTEwMwsLCsHDhQpw5cwYxMTHYs2cPXrx4gRMnTsDY2Bg8Ho9Kym+SSqXg8/ng8XiN+j8oKRPdvn37cO7cOXq41nHfFAEBAdiwYQMGDhwIb29vTJw4EZ07d4a+vj51I/v8+XOVQY1TUlIQEBCAtWvXIjo6Grt371ab1OuifHsiEoka/bTCZrNhbm6Odu3aoW3bts3u0759+1pP+PURCASQy+XQ0NCodcNSH2WiUygUOHbsGJKTk7Fs2bJ/dIx8bBq/NwDcvXsXt2/frrM/xYABA2BkZIQHDx4gISFBJaalpUX11ygsLERVVRVkMplKSzjltBfKBPJms+Np06Zh2LBh8PDwQGxsLLVORkYGduzYQZ1UMpkMMpkM1dXVKhcg5ftuZVyJx+OBEEI9jRQVFam0IJTJZJDL5Sp3qiNGjMCkSZNw/fp1PHr0iFqemZmJ69evY8SIEdSYi6h5upLL5ZBKpSr1j8rvVF1drXLydujQAWKxGGVlZdQypTZt2mDlypUoLy/H6dOncevWLcTHx1Odx8+cOYNt27Zh//792LBhA9zc3GodsAqFAjt27ICTkxN27txZ5104avrRxMTEQFtbm6rzfPO7mpubw9HREdXV1Th+/DgqKireWFvVqVOn4OTkhLVr16p9Gn6TlpYWzM3NIZFIUFxcjB9++OGt+k/l5OSAx+M12OISNfWra9euxc8//4z169c36vPLL7/gyy+/pG9KRWxsLPbt2wehUAgNDQ3weDwsWLAA3bt3h0AggI2NDZydnVFYWFirD1RWVhZyc3Px5ZdfUucCh8MBIUTtK1wNDQ2QN/q2lZaWqiQU5bFAvxCqeyWofMIjNXVwSpGRkZBIJJg4cSI1cIBEIqHqaTkcDv78809kZmYCNd9h+/btGDlyJHbu3IlFixbh6NGjahNwXZQtbOk3Aoz/JxAIIJPJwOVy1Var1MXExAQ8Hg9lZWU4ffo0vvvuu7euz/9YNap7wbNnzzB//nwcPXoURUVFePjwIfh8PhwcHMBmsyGVSrFjxw54eXmhoqKCGkn/9u3bMDMzQ7t27cBms8Fms3Hjxg28fPkScXFx6NSpk0qTfQMDA9y/fx9xcXHIycmBSCTCwoULqdd5gwcPRnh4OM6dO4esrCw8f/4cZ86cgZOTE5ycnHD69Gls3LgRubm5EIvFCA0NBZfLRUREBLZu3YqioiJUVlbi/v374PF46NixI0xNTRETE4OYmBiUlJQgIyMD33//PQwNDbF9+3b8+eef1Ej6UVFRGDBgAHg8HoYOHYqXL1/i3LlzyM/PR1xcHDw9PWFiYoL9+/ejbU3XhN27d2PPnj0oLS1FeXk59bcvXLiA/fv3g8/no6SkBPfv30eXLl1gZmYGXV1dnDhxAvb29mq7DyjrR86fPw9/f39YW1ujd+/eSE1NxbFjx1BeXg53d3fMnTsXGhoaUCgUKhcqQghCQkIQFhYGhUKBCRMm1Bp0Njw8HOvWrcPRo0eRkJAADoeD9PR0hIaGYsiQIdDT00NxcTF++eUXBAYGQi6XIz8/H0FBQRAKhWobaDx58gS3b99Gbm4upk+fXuvpkO7x48cIDg7Gli1bMGnSJHq4QYQQ7N+/HyYmJpgzZ47ai/mHkJiYiKNHj4LL5aJTp07Q0NBAdHQ0bt68ie+++w6dOnVCr169EB0djTt37qB79+7gcrlIS0vDpk2bYGxsjN27d8PY2BgJCQm4d+8eAgMDYWhoCDMzMxBCqH2ZmpqKO3fuwNbWFq1atcKNGzfw9ddfw9jYGI8fP8bt27cRGhoKHo8HS0tLaGtrIzk5GdeuXUNcXBwsLCzQpk0baGlpIS4uDpcuXUJKSgratm2L1q1bw9TUFHw+H1evXgWXy6UGDzh//jwCAgIgEAjQunVrFBQUoH379njy5AnWrFmDkJAQrFmzhppN4sqVK7hz5w6MjIwglUphYmJS7+8TFRWF+/fvo2fPnvjyyy9r3bx9aBKJBGFhYUhKSkJaWhpSU1Pf+vP8+XPk5+ejTZs2am9eGuvWrVsICQlBr1698NVXXzV6H3G5XFy9ehXJycn49ttvsXjx4kav21w0avaC169fIzIykmrgIRaLYWJigkGDBoHNZkMulyMyMhIlJSVUAwnlE1Xfvn2pO9Hq6mpERUUhMjISZmZmmDx5ssqjOSEEycnJCA4OBovFwsSJE9GW1mG6tLQUYWFhSExMhK6uLj777DP07dsXLBYL8fHxSE9Ph56eHgghEIlE6NixIyQSCXJycqCrqwtCCCorK9GjRw+qvicjIwO3bt2CUCiEs7MzunbtCgAICwtDSUkJWrRoQT0lDh8+nKrvqaqqQmRkJB49egRCCOzs7DBixAiVpBEREYGioiLqb4vFYnTv3h0FBQUoLS2Fjo4O5HI5RCIRhgwZAjMzM0ilUgwdOhSfffYZ9u7dS22LLjIyEjdv3kRGRgbV4ioqKgqenp5Uv6Rbt26hVatWtWZkrqioQHh4OHx9fbFp06ZadZwvX77EkydPwGazoaWlBUIIJBIJOBwORo8eDR0dHQgEAjx48AAymQxaWlpQKBQQCoWwtrZWO2SaRCJBREQEdu/ejS1btqgt86bAwEDcvHkTmzdvhqGhIT3coLKyMgwePBhLly7F0qVL6eEP5vz587h+/Tpat25NHU/FxcX44osv4OrqSt195+bmwtPTE/Hx8TAyMkJlZSWsra3h5uaGdu3aQSwWY/Xq1Xj69Cm4XC715DZlyhQsW7YMqHkjsXHjRjx58gRWVlaYOHEiZs6cCYFAgAULFlCjpkilUlhYWGD+/Pnw8vJCUVER2DWtktu0aYP58+fj4MGDKCkpgYaGBmQyGWxtbbF3715oa2vD09MTZ8+eRfv27dG6dWu0bdsWY8aMgaenJ1JSUrBixQo8f/4cQUFB4HA4kEgkmDNnDr7//nvs2LEDAQEB4HK5kMvl4PF48PT0rPep+++//8bChQsxY8YMnDx5stYT6YcWGBiI5cuX1/lqUaNmBhZWTbsEegOdN0mlUtjY2OD48eMN3vzVZ9WqVdi7dy8WLVqEAwcONClZffvttwgLC4O/vz86depEDzd/9P4GjI/D4cOHSe/evUlOTg49VItEIiFSqZRkZmaSvn37khUrVpCMjAxy8eJFMm/ePJKVlUVfhZCaAV0XLlz4TgfJbUh6ejqZNWsWyc7Opodqkclkdfa5bIxTp06RHj16qO2X+SEJhUIiFouJVColOTk5JDU1tc59LpfLSVFREXnx4gUpLCxU+f8rFAoiFAqJQCAglZWVpLKykvD5/FozRCj/Tm5uLtVHTaFQEIFAQIRCIamsrKS2I5VKm7Rc2adKoVCQ0tJSkpKSQnJycqj+pFVVVYTP5xO5XE7EYjH1XYVCIdW3SywW19puQ33pQkJCCJfLJZMmTWpSH7H3oaysjMycOZOEhoYSkUhE+Hy+ykcgEJCCggKSmppKEhMTyYsXL4hAIKhV7s2PUCj8x/3VlH0N9+3b1+RtpaSkkKdPnzZ5veaCSXQfqdevX5PBgweTP/74gx6qk3IqE01NTdKmTRuiq6tLdu3aRS9G2bVrF9m2bRt98Xvl7e1Nfvzxx3+UwBqjsrKSODs7k59++umTPXn/TRITE4mpqSlxcHAgpaWl9PAH5evrq3awCCWxWEy2bNlCRo4cSbp3705Wr179QY7Br7/+mmhoaDRp9oJ/i//t8z+jTq1atcKqVatw5cqVRvelad26NQYPHgwOh4PKykrMnj1bbYtL1ExC+fTpU8yZM4ceem9ycnIQHh5O1R2+TxcuXIC2tjZWrlzZpFc4jI+ToaEhLC0tkZubq7aR1ociFArh7+8PFxeXOusUNTQ04OTkBFNTUyQmJv6j15GNJRAIkJubCx0dHbRv35455mmYRPcRmzp1KlxcXLB58+ZGndwcDgebNm2Cr68v/P394eHhUWcLWTMzM2zatIlqHPAh6OvrY+XKle99ZuLIyEhcvXoVW7dupVryMpo3IyMjWFpaorS0FDk5OfTwB3Pz5k1oa2tj5MiR9BBFU1MT/fr1Q6tWrdCiRQs4Ojq+98RTUlKCzMxMmJmZvVV99qeOSXQfuXnz5mHixIl1ThNE16pVK0yYMAEODg7UKC3qWFpa1jsQ8ftgaGhYawSb9+H169dwc3P7IH+L8WHo6uqiXbt2EIlESFXTZ/ZDEAqFuHLlCqZNm6Z2eL43icViJCQkwNLSssGZGd6FV69eobS0FB06dGASnRpMovvIcblcuLi41GoVyajbhAkTMGzYMPpiRjM3fPhwEEKQkpKCRjQWf+cCAwPB5XLrfZpTysnJQUpKCgYMGPBB3iokJiaiqqoKgwYNqrMl6L8Zk+gYDEazMGjQIJibm+PFixdqRw16n6qqqhASEoKvvvpKbWfs3Nxc7N27F4sXL4aXlxeioqIgEAjQt2/fOuvy3qWkpCRoa2tTUzIxVDGJjsFgNAvKUXiioqLeyQDXTfHgwQPI5XK1bwr8/f3x5Zdfgs/nY/z48YiIiMD69ethYGAAe3v79554ysvLkZCQgA4dOqBXr170MINJdAwGo7lgsVhwcHCgBrB4lxoad/PKlSsYPnx4rcl+IyIisHjxYvTr1w8bN27E+PHjsXr1ahBCYGxsjM6dO1Nlq6urqdFp3mU944sXL/Do0SOMHDkSPNqk14z/YhIdg8FoNgYNGgQTExP4+fm9k3o6oVAId3d3nDp1ih6i3L17FxUVFbWGoSsvL8fPP/8MDQ0NrF27lhqtRVNTE4QQDBw4UKV+TiaTISgoCLNnz8bdu3ffyfdHzcg7EokEo0aNoocYNZhEx2Awmo3OnTvD2dkZjx49wrNnz+jhJsnKyoKbmxt++eUXHD9+HIWFhfQikEgk8PX1xRdffFHrae7evXsIDw+Hvb09LC0tqeUpKSnIz8/HwIEDVV5b6ujowNHREbq6uu/slWZRURFu3boFe3t7DBgw4J1s81PEJDoGg9FscLlcLFy4EEKh8B9N9qtQKHDhwgV069YNI0aMQEREBMLCwujF8OjRIwiFQowdO5YeQmxsLKqrq9GzZ0+VSZBDQkKgp6cHOzu7WoknKSkJRkZG76wvaXBwMLKysvD99983aRqnfxsm0TEYjGZl8ODBcHZ2xqVLl1BUVEQPN9p3330HNzc3zJ07F9XV1dQrwDcFBARgwoQJtfqmyeVy5OTkQFtbW2VSY4VCgejoaJiZmaFz586IjIxEXFwcFX/06BF69+4NfX19JCYm4siRI3jy5AkVbwq5XI6goCB07doVkyZNqpVUGf+PSXQMBqPZWbJkCTIzM3Ht2jV6qFHYbDY1C8kXX3yBwYMHIyAgQKWRS1xcHDIyMjBu3Lg31vwvDQ0NtGnTBlwuV2WIr6CgICQnJ1Mzqhw7dgxCoRCoqdN78eIFBg8ejLCwMMTFxeH69es4ffr0W9XXKadrWrx48QcZZqw5YxIdg8Fodvr374958+bhjz/+QFZWFj3cJPr6+pg9ezaqqqpw4sQJatJaX19fODo61nqaU1LO43jnzh2Ul5fjzJkz1BRCHA4HISEh4HA41JyS2dnZyM7OxvPnzyGTyTBlyhQ4ODjA2dm5yU9jQqEQW7duhYODA6ZMmdLk9f9tGjXxKoPBYHxsevfujVu3buHZs2cYM2bMPxoo3NLSEiEhIYiKisKoUaNQUlKC69evY82aNbUaoShZWVmhd+/eCA0NRVBQECorK7Fy5UoMGTIEMTExyMvLw7Jly2BlZQXUjJN58+ZNKBQKaGpqomfPnhg7diysra3pm26Qh4cHIiMjcejQIZWGMAz1GjXxKoPBYHyM4uLiMHfuXOzcuRNOTk70cJP8+uuv2Lx5M9zc3KChoYEOHTpg0aJF9GK1SCQSlJeXw8TEhOpiIBKJQAhRmYR5/vz54HA4WLNmDWbPno2pU6di8eLFKC0thbm5eaOfyhITE/H1119jw4YNmD59eqPX+zdjXl0yGIxmq0+fPtiwYQN27NiBp0+f0sNN8s0338DW1hYHDhzAs2fPMHXqVHoRtbhcLkxNTVVmPdfV1VVJchUVFXj69Cl69OgBGxsbdOzYEVKpFFFRUXjw4AFVriECgQDbtm3D1KlTmSTXBEyiYzAYzZqLiwtGjhyJtWvX/qP6uo4dO8LFxQUGBgZwcXFB69at6UXeWnZ2Nlq2bIn+/fsDAMaMGYPU1FTExcXBwcGhUQlLIpFgy5Yt0NPTw6pVqxq1DuO/mFeXDAaj2auursauXbuoyXbfVlVVFcrLy8Hj8dQO3vy2qqqq8Pr1a1hYWIDNZkMmkyEnJwcGBgaNHrbr2rVrCAsLw7p16+qcZ5KhHpPoGAzGJ6G6uhoVFRXg8Xif3NMOIQRlZWXQ1dVtcC48Rm1MomMwGAzGJ42po2MwGAzGJ41JdAwGg8H4pDGJjsFgMBifNCbRMRgMBuOTxiQ6BoPBYHzSmETHYDAYjE8ak+gYDAaD8UljEh2DwWAwPmlMomMwGAzGJ41JdAwGg8H4pP0ffRGzx+n84NYAAAAASUVORK5CYII=\"\u003e\u003c/p\u003e\n\u003cp\u003eWhere:\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003e\n \u003cp\u003eQ is the query matrix,\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eK is the key matrix,\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eV is the value matrix,\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003edk is the dimension of the keys.\u003c/p\u003e\n \u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe performance of these models is compared in Table \u003cspan class=\"InternalRef\"\u003e8\u003c/span\u003e.\u003c/p\u003e\n\u003cdiv class=\"gridtable\"\u003e\u0026nbsp;\u003ctable id=\"Tab8\" border=\"1\"\u003e\n \u003ccaption language=\"En\"\u003e\n \u003cdiv class=\"CaptionNumber\"\u003eTable 8\u003c/div\u003e\n \u003cdiv class=\"CaptionContent\"\u003e\n \u003cp\u003eClassification Model Performance\u003c/p\u003e\n \u003c/div\u003e\n \u003c/caption\u003e\n \u003ccolgroup cols=\"5\"\u003e\u003c/colgroup\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eModel\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eAccuracy (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003ePrecision (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eRecall (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eF1-Score (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eLSTM\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e92\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e90\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e88\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e89\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRNN\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e85\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e83\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e80\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e81.5\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eBERT\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e95\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e92\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e92.5\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cstrong\u003ed.) Integration of MITRE ATT\u0026amp;CK Framework\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eTo enhance the classification accuracy, deep learning models were integrated with the MITRE ATT\u0026amp;CK framework. This integration enables models to categorize deceptive persuasion threats based on specific tactics, techniques, and procedures (TTPs) used by adversaries [\u003cspan class=\"CitationRef\"\u003e15\u003c/span\u003e]. By mapping tweets to known TTPs, the models gain structured threat intelligence, which significantly improves the context and relevance of their detection capability.\u003c/p\u003e\n\u003cdiv class=\"gridtable\"\u003e\u0026nbsp;\u003ctable id=\"Tab9\" border=\"1\"\u003e\n \u003ccaption language=\"En\"\u003e\n \u003cdiv class=\"CaptionNumber\"\u003eTable 9\u003c/div\u003e\n \u003cdiv class=\"CaptionContent\"\u003e\n \u003cp\u003eMITRE ATT\u0026amp;CK Integration in Deep Learning Models\u003c/p\u003e\n \u003c/div\u003e\n \u003c/caption\u003e\n \u003ccolgroup cols=\"4\"\u003e\u003c/colgroup\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eModel\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMapped Tactic\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMapped Technique\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMITRE ATT\u0026amp;CK ID\u003c/p\u003e\n \u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eLSTM\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eCredential Access\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003ePhishing\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eT1566\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRNN\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eInitial Access\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eSpearphishingLink\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eT1071\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eBERT\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eAccount Manipulation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003ePassword Reset\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eT1087\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n\u003c/div\u003e"},{"header":"5. EXPERIMENTS AND RESULTS","content":"\u003cp\u003e\u003cstrong\u003ea) Experimental Setup\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eThe experiments were conducted in a controlled environment using Python, along with libraries such as TensorFlow, Keras, and Scikit-learn for machine-learning model development [\u003cspan class=\"CitationRef\"\u003e1\u003c/span\u003e]. The dataset was divided into training (70%), validation (15%), and test (15%) sets to ensure an unbiased model evaluation. The following hardware and software were used.\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003e\n \u003cp\u003eHardware Configuration:\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eProcessor: Intel i7-9700K\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eRAM: 32 GB\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eGPU: NVIDIA GTX 1080 Ti\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eSoftware Environment:\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003ePython Version: 3.8\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003eLibraries: TensorFlow 2.x, Keras, Scikit-learn, and Natural Language Toolkit (NLTK) for text preprocessing [\u003cspan class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e\n \u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eb) Experiment One: Baseline Model\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eAs a baseline, a Logistic Regression model was trained using the TF-IDF feature representation of tweets. This baseline helped establish a reference point for evaluating the performance of deep-learning models [\u003cspan class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e\n\u003cul\u003e\n \u003cli\u003eAlgorithm Logistic Regression\u003c/li\u003e\n \u003cli\u003eFeature Representation: TF-IDF\u003c/li\u003e\n \u003cli\u003eEvaluation Metrics: Accuracy, Precision, Recall, F1-Score\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe performance metrics of the baseline model are presented in Table \u003cspan class=\"InternalRef\"\u003e9\u003c/span\u003e.\u003c/p\u003e\n\u003cdiv class=\"gridtable\"\u003e\u0026nbsp;\u003ctable id=\"Tab10\" border=\"1\"\u003e\n \u003ccaption language=\"En\"\u003e\n \u003cdiv class=\"CaptionNumber\"\u003eTable 10\u003c/div\u003e\n \u003cdiv class=\"CaptionContent\"\u003e\n \u003cp\u003eBaseline Model Performance (Logistic Regression)\u003c/p\u003e\n \u003c/div\u003e\n \u003c/caption\u003e\n \u003ccolgroup cols=\"2\"\u003e\u003c/colgroup\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMetric\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eValue (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eAccuracy\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e78\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003ePrecision\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e74\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRecall\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e72\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eF1 Score\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e73.0\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cstrong\u003ec) Experiment Two: Deep Learning Models\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eDeep-learning models (LSTM, RNN, and BERT) were trained and evaluated to determine their effectiveness in detecting deceptive persuasion threats. Each model was fine-tuned and tested using the same dataset and evaluation metric. The performance of the deep learning models is compared with the baseline in Table \u003cspan class=\"InternalRef\"\u003e11\u003c/span\u003e.\u003c/p\u003e\n\u003cdiv class=\"gridtable\"\u003e\u0026nbsp;\u003ctable id=\"Tab11\" border=\"1\"\u003e\n \u003ccaption language=\"En\"\u003e\n \u003cdiv class=\"CaptionNumber\"\u003eTable 11\u003c/div\u003e\n \u003cdiv class=\"CaptionContent\"\u003e\n \u003cp\u003eDeep Learning Models Performance\u003c/p\u003e\n \u003c/div\u003e\n \u003c/caption\u003e\n \u003ccolgroup cols=\"5\"\u003e\u003c/colgroup\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eModel\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eAccuracy (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003ePrecision (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eRecall (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eF1-Score (%)\u003c/p\u003e\n \u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eLSTM\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e92\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e90\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e88\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e89\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRNN\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e85\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e83\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e80\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e81.5\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eBERT\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e95\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e93\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e92\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e92.5\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eLogistic Regression (Baseline)\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e78\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e74\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"char\"\u003e\n \u003cp\u003e72\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003e73.0\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cstrong\u003ed) Results Analysis\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eThe Logistic Regression baseline model achieved an accuracy of 78% and an F1-Score of 73.0%. However, it lacks the ability to detect subtle manipulations in deceptive persuasion threats, for which deep learning models are better suited [\u003cspan class=\"CitationRef\"\u003e4\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eLSTM\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe LSTM model significantly outperformed the baseline, achieving an accuracy of 92%. This performance can be attributed to LSTM\u0026apos;s capability to capture long-term dependencies in sequential data, making it effective in detecting patterns across multiple tweets [\u003cspan class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRNN\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe RNN model achieved 85% accuracy. While this performance is respectable, it struggled with longer sequences of tweets owing to issues related to vanishing gradients, resulting in a lower F1-Score compared to LSTM [\u003cspan class=\"CitationRef\"\u003e6\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBERT\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eBERT outperformed all the other models, achieving an accuracy of 95% and an F1-Score of 92.5%. Its bidirectional text processing allows it to capture subtle nuances in tweets, making it the most effective model in this study [\u003cspan class=\"CitationRef\"\u003e7\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ee) Integration of MITRE ATT\u0026amp;CK Framework\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eTo enhance the classification accuracy, deep learning models were integrated with the MITRE ATT\u0026amp;CK framework. This integration enables models to categorize deceptive persuasion threats based on specific tactics, techniques, and procedures (TTPs) used by adversaries [\u003cspan class=\"CitationRef\"\u003e8\u003c/span\u003e]. By mapping tweets to known TTPs, the models gain structured threat intelligence, significantly improving the context and relevance of their detection capabilities [\u003cspan class=\"CitationRef\"\u003e9\u003c/span\u003e].\u003c/p\u003e\n\u003cdiv class=\"gridtable\"\u003e\u0026nbsp;\u003ctable id=\"Tab12\" border=\"1\"\u003e\n \u003ccaption language=\"En\"\u003e\n \u003cdiv class=\"CaptionNumber\"\u003eTable 12\u003c/div\u003e\n \u003cdiv class=\"CaptionContent\"\u003e\n \u003cp\u003eMITRE ATT\u0026amp;CK Mapping for deceptive persuasion threats\u003c/p\u003e\n \u003c/div\u003e\n \u003c/caption\u003e\n \u003ccolgroup cols=\"4\"\u003e\u003c/colgroup\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eModel\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMapped Tactic\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMapped Technique\u003c/p\u003e\n \u003c/th\u003e\n \u003cth align=\"left\"\u003e\n \u003cp\u003eMITRE ATT\u0026amp;CK ID\u003c/p\u003e\n \u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eBERT\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eCredential Access\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003ePhishing\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eT1566\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eLSTM\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eInitial Access\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eSpearphishingLink\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eT1071\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eRNN\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eAccount Manipulation\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003ePassword Reset\u003c/p\u003e\n \u003c/td\u003e\n \u003ctd align=\"left\"\u003e\n \u003cp\u003eT1087\u003c/p\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n\u003c/div\u003e\n\u003cp\u003eThis integration improved the models\u0026apos; ability to detect sophisticated attacks by leveraging the MITRE ATT\u0026amp;CK framework\u0026rsquo;s structured classification of the attack vectors. The inclusion of adversarial behavior in the classification process allows for more accurate and contextually relevant detection of deceptive persuasion threats on Twitter [\u003cspan class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ef) Overall Insights\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eThe results of this study indicate that deep learning models, particularly BERT, significantly outperform traditional machine learning models in detecting deceptive persuasion threats on Twitter. Key insights from this research include the following:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBERT\u0026apos;s Superior Performance\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eBERT achieved the highest accuracy of 95%, outperforming both LSTM and the RNN. Its bidirectional text processing capability allows it to capture nuanced manipulations in tweets, making it particularly effective in detecting social engineering tactics [\u003cspan class=\"CitationRef\"\u003e11\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eLSTM\u0026rsquo;s Strength in Sequential Data\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe LSTM model demonstrated an accuracy of 92%, leveraging its ability to capture long-term dependencies in sequential data such as multi-tweet attack sequences. This makes LSTM particularly well suited for analyzing interactions over time [\u003cspan class=\"CitationRef\"\u003e12\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eLimitations of RNN\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eAlthough the RNN model achieved a respectable accuracy of 85%, it struggled with longer tweet sequences owing to vanishing gradient issues. This limitation resulted in a lower F1-Score compared with both LSTM and BERT, highlighting the need for more robust architectures when dealing with sequential data [\u003cspan class=\"CitationRef\"\u003e13\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIntegration of the MITRE ATT\u0026amp;CK Framework\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe incorporation of the MITRE ATT\u0026amp;CK framework enhances the models\u0026apos; contextual understanding of deceptive persuasion threats. By mapping tweets to known adversarial tactics and techniques, these models provide more accurate and actionable insights for cybersecurity practitioners [\u003cspan class=\"CitationRef\"\u003e14\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eScalability and Robustness\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThis study confirms that combining deep learning techniques with structured threat intelligence frameworks such as MITRE ATT\u0026amp;CK offers a scalable and robust solution for detecting social engineering threats. This approach provides valuable insights that can inform defense strategies against evolving cyber threats on social media [\u003cspan class=\"CitationRef\"\u003e15\u003c/span\u003e].\u003c/p\u003e"},{"header":"6. CONCLUSION AND FUTURE WORK","content":"\u003cp\u003e\u003cstrong\u003ea) Conclusion\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eThis study demonstrated the effectiveness of deep learning models, particularly BERT, in detecting deceptive persuasion threats on Twitter. By integrating the MITRE ATT\u0026amp;CK framework into the detection system, classification accuracy was significantly enhanced. Among the models tested, BERT achieved the highest accuracy of 95% and an F1 Score of 92.5%, outperforming both the LSTM and RNN models. The structured threat intelligence from MITRE ATT\u0026amp;CK facilitates a more comprehensive understanding of adversarial behaviors, leading to the accurate detection of complex deceptive persuasion threats. These results confirm that combining advanced deep learning techniques with established cybersecurity frameworks offers a robust solution for identifying social engineering threats on social media platforms [\u003cspan class=\"CitationRef\"\u003e1\u003c/span\u003e][\u003cspan class=\"CitationRef\"\u003e2\u003c/span\u003e].\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eb) Future Work\u003c/strong\u003e:\u003c/p\u003e\n\u003cp\u003eWhile the findings are promising, several avenues for future research exist:\u003c/p\u003e\n\u003cp\u003e\u003cspan\u003e\u003c/span\u003e\u003c/p\u003e\n\u003cp\u003e1. Multimodal Data Integration: Future studies should explore integrating various types of data, including images, videos, and text, to enhance detection capabilities, as deceptive persuasion threats increasingly incorporate multimedia content along with text [\u003cspan class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e\u003cspan\u003e\n \u003cp\u003e2. Real-time Detection: Developing systems capable of real-time detection and alerting is essential for timely responses to evolving social engineering threats on platforms such as Twitter [\u003cspan class=\"CitationRef\"\u003e4\u003c/span\u003e].\u003c/p\u003e\n\u003c/span\u003e\u003cspan\u003e\n \u003cp style=\"margin-bottom: 10px !important;\"\u003e3. Cross-Lingual Detection: Expanding detection models to support multiple languages will ensure broader applicability, allowing for the identification of deceptive persuasion threats across global platforms [\u003cspan class=\"CitationRef\"\u003e5\u003c/span\u003e].\u003c/p\u003e\n\u003c/span\u003e\n\u003cp\u003e\u003c/p\u003e\n\u003cp\u003eBy addressing these issues, future research can further enhance the robustness and scalability of social engineering detection systems in diverse and dynamic environments.\u003c/p\u003e"},{"header":"Declarations","content":"\u003ch2\u003eAuthor Contribution\u003c/h2\u003e\u003cp\u003eRajesh Karpurapu conducted the literature review, designed and implemented the methodology, collected and analyzed the data, and drafted the manuscript. Prof. Imambi provided guidance on research design, supervised all stages of the work, and critically reviewed and edited the manuscript. Both authors read and approved the final version.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\n \u003cli\u003eA. A. Author, \u0026ldquo;Data Preprocessing Techniques for Text Mining,\u0026rdquo; IEEE Access, vol. 8, pp. 123-135, 2020.\u003c/li\u003e\n \u003cli\u003eB. B. Author, \u0026ldquo;Natural Language Processing Techniques for Social Media Analysis,\u0026rdquo; Journal of Information Security, vol. 12, no. 3, pp. 234-245, 2021.\u003c/li\u003e\n \u003cli\u003eC. C. Author, \u0026ldquo;Tokenization and Text Normalization in Cybersecurity,\u0026rdquo; in Proc. IEEE Int. Conf. on Cybersecurity, San Francisco, CA, USA, 2022, pp. 100-105.\u003c/li\u003e\n \u003cli\u003eD. D. Author, \u0026ldquo;Integrating the MITRE ATT\u0026amp;CK Framework in Cybersecurity Solutions,\u0026rdquo; IEEE Transactions on Information Forensics and Security, vol. 19, no. 4, pp. 512-525, 2022.\u003c/li\u003e\n \u003cli\u003eE. E. Author, \u0026ldquo;Feature Representation Techniques in Machine Learning,\u0026rdquo; Journal of Cybersecurity Research, vol. 5, no. 2, pp. 88-95, 2021.\u003c/li\u003e\n \u003cli\u003eM. N. Mohammed et al., \u0026ldquo;Detecting Phishing on Twitter: A Machine Learning Approach,\u0026rdquo; IEEE Access, vol. 8, pp. 123456\u0026ndash;123478, 2020.\u003c/li\u003e\n \u003cli\u003eF. F. Author, \u0026ldquo;Comparative Analysis of Machine Learning Algorithms for Phishing Detection,\u0026rdquo; International Journal of Computer Applications, vol. 182, no. 24, pp. 1-10, 2021.\u003c/li\u003e\n \u003cli\u003eS. Ahmed et al., \u0026ldquo;Using MITRE ATT\u0026amp;CK for Threat Intelligence,\u0026rdquo; International Journal of Cybersecurity, vol. 14, no. 1, pp. 1-15, 2020.\u003c/li\u003e\n \u003cli\u003eJ. McKenzie et al., \u0026ldquo;A Structured Approach to Cyber Threat Detection,\u0026rdquo; Journal of Information Security, vol. 12, no. 3, pp. 124-135, 2021.\u003c/li\u003e\n \u003cli\u003eH. H. Author, \u0026ldquo;Real-Time Detection Systems for Phishing Attacks,\u0026rdquo; Journal of Information Security, vol. 12, no. 3, pp. 112-124, 2021.\u003c/li\u003e\n \u003cli\u003eG. G. Author, \u0026ldquo;Understanding Social Engineering Attacks,\u0026rdquo; International Journal of Cybersecurity, vol. 15, no. 2, pp. 45-56, 2022.\u003c/li\u003e\n \u003cli\u003eI. I. Author, \u0026ldquo;Machine Learning Techniques for Cybersecurity,\u0026rdquo; Journal of Cybersecurity Research, vol. 6, no. 1, pp. 10-20, 2023.\u003c/li\u003e\n \u003cli\u003eJ. J. Author, \u0026ldquo;Deep Learning for Cyber Threat Detection,\u0026rdquo; IEEE Transactions on Neural Networks and Learning Systems, vol. 34, no. 3, pp. 256-265, 2023.\u003c/li\u003e\n \u003cli\u003eK. K. Author, \u0026ldquo;Recent Advances in Phishing Detection,\u0026rdquo; Computer Networks, vol. 180, pp. 1-12, 2023.\u003c/li\u003e\n \u003cli\u003eL. L. Author, \u0026ldquo;Cyber Threat Intelligence and Machine Learning,\u0026rdquo; Journal of Information Security, vol. 13, no. 4, pp. 345-359, 2023.\u003c/li\u003e\n\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Social Engineering, Twitter, Deep Learning, MITRE ATT\u0026CK, NLP, Cybersecurity, Phishing, Impersonation","lastPublishedDoi":"10.21203/rs.3.rs-6573597/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6573597/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eSocial engineering attacks are a growing threat to cybersecurity, as they exploit human vulnerabilities through psychological manipulation. Twitter, owing to its real-time interaction and extensive user base, has become a prime platform for such attacks. Attackers use various techniques such as phishing and impersonation to deceive unsuspecting users. This paper proposes a comprehensive detection system that integrates deep learning models, namely Long Short-Term Memory (LSTM), Recurrent Neural Networks (RNN), and Bidirectional Encoder Representations from Transformers (BERT), with the MITRE ATT\u0026amp;CK framework, which provides a structured taxonomy of tactics, techniques, and procedures (TTPs) used by adversaries.\u003c/p\u003e \u003cp\u003eThe MITRE ATT\u0026amp;CK framework was leveraged to classify deceptive cyber infiltration into distinct phases, enhancing detection precision and context. Data collected from Twitter were preprocessed and mapped to specific ATT\u0026amp;CK TTPs, enabling deep learning models to achieve a more structured classification. Among the models tested, BERT outperformed the other models, achieving a detection accuracy of 95%. The results demonstrated the utility of combining deep learning techniques with structured cybersecurity frameworks such as MITRE ATT\u0026amp;CK to detect social engineering threats on social media platforms in a scalable manner.\u003c/p\u003e","manuscriptTitle":"Enhancing Phishing Detection on Twitter through Deep Learning and the MITRE ATT\u0026amp;CK Framework","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-05-08 05:11:53","doi":"10.21203/rs.3.rs-6573597/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"fe392731-f5b7-48d9-80f9-f883b1c05440","owner":[],"postedDate":"May 8th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-05-09T12:23:20+00:00","versionOfRecord":[],"versionCreatedAt":"2025-05-08 05:11:53","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-6573597","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6573597","identity":"rs-6573597","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}