This paper proposes a machine learning-based approach for detecting the
exploitation of vulnerabilities in the wild by monitoring underground hacking
forums. The increasing volume of posts discussing exploitation in the wild
calls for an automatic approach to process threads and posts that will
eventually trigger alarms depending on their content. To illustrate the
proposed system, we use the CrimeBB dataset, which contains data scraped from
multiple underground forums, and develop a supervised machine learning model
that can filter threads citing CVEs and label them as Proof-of-Concept,
Weaponization, or Exploitation. Leveraging random forests, we indicate that
accuracy, precision and recall above 0.99 are attainable for the classification
task. Additionally, we provide insights into the difference in nature between
weaponization and exploitation, e.g., interpreting the output of a decision
tree, and analyze the profits and other aspects related to the hacking
communities. Overall, our work sheds insight into the exploitation of
vulnerabilities in the wild and can be used to provide additional ground truth
to models such as EPSS and Expected Exploitability.

提出了一种基于机器学习的方法来监测地下黑客论坛中野外漏洞利用的方式，利用监控其中的帖子并根据内容触发警报；通过使用 CrimeBB 数据集，开发了一种监督学习模型，能够过滤引用 CVE 的帖子并将其标记为概念证明、武器化或利用；利用随机森林，表明在分类任务中可以达到准确率、精确度和召回率均在 0.99 以上；此外，对武器化和利用之间的区别进行了解释，分析了与黑客社区相关的利润等方面。