# A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence

arXiv: https://arxiv.org/abs/2101.06761 · HTML: https://mlsanity.com/paper/2101.06761/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 12 references that are in the map.
- First posted on arXiv 17 Jan 2021.

## Builds on (most cited first, 5 of 5)

- [Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence](https://mlsanity.com/paper/2010.13637/) (2020)
- [SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection](https://mlsanity.com/paper/1806.09339/) (2018)
- [AIQL: Enabling Efficient Attack Investigation from System Monitoring Data](https://mlsanity.com/paper/1806.02290/) (2018)
- [A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security](https://mlsanity.com/paper/1810.03464/) (2018)
- [Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection](https://mlsanity.com/paper/1903.08159/) (2019)

## Built on by (most cited first, 2 of 2)

- [Generating Fake Cyber Threat Intelligence Using Transformer-Based Models](https://mlsanity.com/paper/2102.04351/) (2021)
- [A System for Automated Open-Source Threat Intelligence Gathering and Management](https://mlsanity.com/paper/2101.07769/) (2021)

## Abstract (arXiv)

Log-based cyber threat hunting has emerged as an important solution to counter sophisticated cyber attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the rich external knowledge about threat behaviors provided by open-source Cyber Threat Intelligence (OSCTI). To bridge the gap, we build ThreatRaptor, a system that facilitates cyber threat hunting in computer systems using OSCTI. Built upon mature system auditing frameworks, ThreatRaptor provides (1) an unsupervised, light-weight, and accurate NLP pipeline that extracts structured threat behaviors from unstructured OSCTI text, (2) a concise and expressive domain-specific query language, TBQL, to hunt for malicious system activities, (3) a query synthesis mechanism that automatically synthesizes a TBQL query from the extracted threat behaviors, and (4) an efficient query execution engine to search the big system audit logging data.