A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence

TL;DR

ThreatRaptor is a system that leverages open-source cyber threat intelligence and advanced NLP techniques to automate and improve the efficiency of cyber threat hunting in computer systems.

Contribution

It introduces a novel framework combining NLP, a domain-specific query language, and automated query synthesis for effective threat hunting using OSCTI.

Findings

Accurately extracts threat behaviors from unstructured OSCTI text.

Automatically synthesizes effective TBQL queries from threat behaviors.

Efficiently searches large audit logs for malicious activities.

Abstract

Log-based cyber threat hunting has emerged as an important solution to counter sophisticated cyber attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the rich external knowledge about threat behaviors provided by open-source Cyber Threat Intelligence (OSCTI). To bridge the gap, we build ThreatRaptor, a system that facilitates cyber threat hunting in computer systems using OSCTI. Built upon mature system auditing frameworks, ThreatRaptor provides (1) an unsupervised, light-weight, and accurate NLP pipeline that extracts structured threat behaviors from unstructured OSCTI text, (2) a concise and expressive domain-specific query language, TBQL, to hunt for malicious system activities, (3) a query synthesis mechanism that automatically synthesizes a TBQL query from the extracted threat behaviors, and (4) an efficient query execution engine to search the big system audit logging data.