# Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence

arXiv: https://arxiv.org/abs/2010.13637 · HTML: https://mlsanity.com/paper/2010.13637/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Oct 2020.

## Built on by (most cited first, 12 of 12)

- [Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild](https://mlsanity.com/paper/2307.10214/) (2023)
- [ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation](https://mlsanity.com/paper/2507.14201/) (2025)
- [CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models](https://mlsanity.com/paper/2410.21060/) (2024)
- [Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks with GPT-4](https://mlsanity.com/paper/2309.16422/) (2023)
- [A System for Automated Open-Source Threat Intelligence Gathering and Management](https://mlsanity.com/paper/2101.07769/) (2021)
- [On the Security Risks of Knowledge Graph Reasoning](https://mlsanity.com/paper/2305.02383/) (2023)
- [CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligence](https://mlsanity.com/paper/2510.11974/) (2025)
- [A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence](https://mlsanity.com/paper/2101.06761/) (2021)
- [Mining Temporal Attack Patterns from Cyberthreat Intelligence Reports](https://mlsanity.com/paper/2401.01883/) (2024)
- [TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction](https://mlsanity.com/paper/2607.05001/) (2026)
- [Leveraging Semantic Relationships to Prioritise Indicators of Compromise in Additive Manufacturing Systems](https://mlsanity.com/paper/2305.04102/) (2023)
- [Web Scale Graph Mining for Cyber Threat Intelligence](https://mlsanity.com/paper/2411.06239/) (2024)

## Abstract (arXiv)

Log-based cyber threat hunting has emerged as an important solution to counter sophisticated attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the rich external threat knowledge provided by open-source Cyber Threat Intelligence (OSCTI). To bridge the gap, we propose ThreatRaptor, a system that facilitates threat hunting in computer systems using OSCTI. Built upon system auditing frameworks, ThreatRaptor provides (1) an unsupervised, light-weight, and accurate NLP pipeline that extracts structured threat behaviors from unstructured OSCTI text, (2) a concise and expressive domain-specific query language, TBQL, to hunt for malicious system activities, (3) a query synthesis mechanism that automatically synthesizes a TBQL query for hunting, and (4) an efficient query execution engine to search the big audit logging data. Evaluations on a broad set of attack cases demonstrate the accuracy and efficiency of ThreatRaptor in practical threat hunting.