# A System for Automated Open-Source Threat Intelligence Gathering and Management

arXiv: https://arxiv.org/abs/2101.07769 · HTML: https://mlsanity.com/paper/2101.07769/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 22 references that are in the map.
- First posted on arXiv 19 Jan 2021.

## Builds on (most cited first, 9 of 9)

- [Distributed Representations of Words and Phrases and their Compositionality](https://mlsanity.com/paper/1310.4546/) (2013)
- [Data Programming: Creating Large Training Sets, Quickly](https://mlsanity.com/paper/1605.07723/) (2016)
- [POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting](https://mlsanity.com/paper/1910.00056/) (2019)
- [Enabling Efficient Cyber Threat Hunting With Cyber Threat Intelligence](https://mlsanity.com/paper/2010.13637/) (2020)
- [SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection](https://mlsanity.com/paper/1806.09339/) (2018)
- [AIQL: Enabling Efficient Attack Investigation from System Monitoring Data](https://mlsanity.com/paper/1806.02290/) (2018)
- [A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security](https://mlsanity.com/paper/1810.03464/) (2018)
- [Querying Streaming System Monitoring Data for Enterprise System Anomaly Detection](https://mlsanity.com/paper/1903.08159/) (2019)
- [A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence](https://mlsanity.com/paper/2101.06761/) (2021)

## Built on by (most cited first, 7 of 7)

- [Generating Fake Cyber Threat Intelligence Using Transformer-Based Models](https://mlsanity.com/paper/2102.04351/) (2021)
- [Time for aCTIon: Automated Analysis of Cyber Threat Intelligence in the Wild](https://mlsanity.com/paper/2307.10214/) (2023)
- [Beyond Single-Value Metrics: Evaluating and Enhancing LLM Unlearning with Cognitive Diagnosis](https://mlsanity.com/paper/2502.13996/) (2025)
- [Few-Sample Named Entity Recognition for Security Vulnerability Reports by Fine-Tuning Pre-Trained Language Models](https://mlsanity.com/paper/2108.06590/) (2021)
- [Enterprise Use Cases Combining Knowledge Graphs and Natural Language Processing](https://mlsanity.com/paper/2404.01443/) (2024)
- [Towards Improved Anomaly Detection for Cloud Cybersecurity via Graph Neural Networks](https://mlsanity.com/paper/2606.28923/) (2026)
- [Identifying Security Platform Product Abuse with Machine Learning](https://mlsanity.com/paper/2609.21303/) (2026)

## Abstract (arXiv)

To remain aware of the fast-evolving cyber threat landscape, open-source Cyber Threat Intelligence (OSCTI) has received growing attention from the community. Commonly, knowledge about threats is presented in a vast number of OSCTI reports. Despite the pressing need for high-quality OSCTI, existing OSCTI gathering and management platforms, however, have primarily focused on isolated, low-level Indicators of Compromise. On the other hand, higher-level concepts (e.g., adversary tactics, techniques, and procedures) and their relationships have been overlooked, which contain essential knowledge about threat behaviors that is critical to uncovering the complete threat scenario. To bridge the gap, we propose SecurityKG, a system for automated OSCTI gathering and management. SecurityKG collects OSCTI reports from various sources, uses a combination of AI and NLP techniques to extract high-fidelity knowledge about threat behaviors, and constructs a security knowledge graph. SecurityKG also provides a UI that supports various types of interactivity to facilitate knowledge graph exploration.