Development of an application for the detection of cyber vulnerabilities and examination of cyber attack scenarios: The case of Turkiye

With the rapid advancement of technology, the volume of data generated in the digital realm has increased exponentially, thereby enhancing the value of data belonging to institutions, organizations, and individuals in cyberspace. As the significance of safeguarding digital data has grown, efforts in this area have gained urgency; however, current measures remain insufficient. Due to cyberattacks conducted through various techniques, cybersecurity—which refers to the protection of security and confidentiality within cyberspace—has become a critical concern for public institutions, private sector entities, energy companies, and all individuals utilizing internet and computer technologies. Cybersecurity encompasses all measures taken to detect vulnerabilities in systems and software operating within information technology infrastructures and to protect against attacks that aim to render these systems inoperable. The integration of information and communication technologies into daily life has expanded the need for data protection across a wide spectrum, from public agencies to private enterprises, from individuals to critical infrastructure providers. In parallel, the frequency and complexity of cyberattacks have reached alarming levels. A review of incidents in 2021 reveals that an average of six million cyberattacks occurred daily. As a result, a significant amount of confidential information has fallen into the hands of malicious actors, causing irreparable harm to individuals, corporations, and even nation-states. In one case, hackers of unknown identity accessed $570 million worth of cryptocurrency from Binance, one of the world's largest crypto exchanges, inflicting substantial financial loss. In response, both governments and private entities have made considerable investments to develop preventative strategies. Such attacks can only be mitigated through robust infrastructures and effective cybersecurity protocols. The concept of the "white-hat hacker" has emerged to detect, prevent, or counteract cyber threats in a defensive or preemptive capacity. This thesis aims to analyze the structure of emerging cyber threats, driven by accelerated digital transformation, and to contribute to the identification of cyber vulnerabilities and the analysis of cyberattack scenarios through a case study focusing on Türkiye. Initially, the research presents a comprehensive literature review addressing core cybersecurity concepts, types of attacks, attacker methodologies, and defense strategies. The study integrates both theoretical and practical evaluations based on international standards and frameworks such as the Cyber Kill Chain, MITRE ATT&CK Matrix, ISO/IEC 27001, and the NIST Cybersecurity Framework. In this context, prominent cyber incidents from both global and national perspectives are examined, and Türkiye's national cybersecurity strategies are analyzed comparatively. Within the scope of the thesis, a novel dataset comprising authentic cyberattack instances collected from open-source platforms both in Türkiye and globally was constructed. This dataset was analyzed using machine learning techniques, with a primary focus on classification algorithms. Experimental studies revealed that tree-based machine learning models, particularly XGBoost and LightGBM, yielded highly successful results. The LightGBM model achieved a ROC AUC score of 0.99, an accuracy of 93.34%, a precision of 0.9325, a recall of 0.9334, and an F1 score of 0.9326. The XGBoost model surpassed these figures, delivering a ROC AUC score of 0.9954, accuracy of 98.88%, and precision, recall, and F1 score values of 0.9384. These findings demonstrate that, in terms of overall classification performance, XGBoost outperforms LightGBM. In addition to these models, the study also evaluated a deep learning-based architecture, Long Short-Term Memory (LSTM). While the LSTM model produced a promising ROC AUC score of 0.941—indicating potential in distinguishing between classes—its classification performance metrics were notably lower: 67.83% accuracy, 0.680 precision, 0.674 recall, and an F1 score of 0.657. These results suggest that while LSTM possesses class-separation capabilities, its overall classification efficacy remains inferior to conventional machine learning algorithms when applied to tabular data. This further implies that models designed for sequential data may exhibit suboptimal performance when deployed in contexts lacking a temporal or ordered data structure. Furthermore, the analysis process examined the distribution of cyberattacks across targeted industries, their geographical and temporal patterns, and the relationships between attacker groups and the techniques employed. The application developed within this research facilitates the prediction of attackers and the formulation of defensive strategies based on variables such as attack methodology, target, and impact. This machine learning–driven approach offers a practical foundation for institutions to strengthen their cybersecurity postures more effectively. In conclusion, this study provides a comprehensive contribution to the field of cybersecurity through both theoretical and applied dimensions. Its central objective is to enhance awareness at the public, private, and individual levels, support the formulation of strategic planning, and offer scientific justification for the development of decision support systems. The thesis underscores that cyber threats extend beyond technical challenges to encompass social, economic, and national security dimensions. It emphasizes the need for multi-stakeholder collaboration and integrated strategies to address these challenges. Cyberattacks constitute a substantial threat to millions of people, organizations, and governments worldwide and must be confronted through global cooperation. Keywords: Cybersecurity, Cyberattack, Machine Learning, Cyber Threats in Turkey, Data Analytics, Defense Strategies, Critical Infrastructure Security