2020/10/26 by Peng Gao, Gao, Peng, Fei Shao +15 · 2 citations
Computer Science · #Advanced Malware Detection Techniques #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #Databases (cs.DB) #FOS: Computer and information sciences #Network Security and Intrusion Detection #Spam and Phishing Detection
paper · pdf · doi:10.48550/arxiv.2010.13637
openalex publication_date 2020/10/26 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Log-based cyber threat hunting has emerged as an important solution to counter sophisticated attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the rich external threat knowledge provided by open-source Cyber Threat Intelligence (OSCTI). To bridge the gap, we propose ThreatRaptor, a system that facilitates threat hunting in computer systems using OSCTI. Built upon system auditing frameworks, ThreatRaptor provides (1) an unsupervised, light-weight, and accurate NLP pipeline that extracts structured threat behaviors from unstructured OSCTI text, (2) a concise and expressive domain-specific query language, TBQL, to hunt for malicious system activities, (3) a query synthesis mechanism that automatically synthesizes a TBQL query for hunting, and (4) an efficient query execution engine to search the big audit logging data. Evaluations on a broad set of attack cases demonstrate the accuracy and efficiency of ThreatRaptor in practical threat hunting.