论文标题
威胁性：一种用于自动开源网络威胁情报收集和管理的AI驱动系统
ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management
论文作者
论文摘要
开源网络威胁情报（OSCTI）对于跟上快速变化的威胁格局至关重要。但是，当前的OSCTI收集和管理解决方案主要集中于妥协的结构化指标（IOC）供稿，这些指标是低级和孤立的，仅提供了潜在威胁的狭窄观点。同时，在公开公开的众多OSCTI报告（例如，安全文章，威胁报告）的非结构化文本中发现的广泛而相互联系的知识仍然很大程度上尚未得到震惊。 为了弥合差距，我们提出了ThrantKg，这是一个用于OSCTI收集和管理的自动化系统。威胁性有效地从多个来源收集了大量的OSCTI报告，利用专门的基于AI的技术来提取有关各种威胁实体及其关系的高质量知识，并通过集成新的OSCTI数据来构建和不断更新威胁知识图。威胁性设备具有模块化和可扩展的设计，可添加组件来容纳多种OSCTI报告的结构和知识类型。我们广泛的评估表明，威胁性在增强威胁知识收集和管理方面的实际有效性。
Open-source cyber threat intelligence (OSCTI) has become essential for keeping up with the rapidly changing threat landscape. However, current OSCTI gathering and management solutions mainly focus on structured Indicators of Compromise (IOC) feeds, which are low-level and isolated, providing only a narrow view of potential threats. Meanwhile, the extensive and interconnected knowledge found in the unstructured text of numerous OSCTI reports (e.g., security articles, threat reports) available publicly is still largely underexplored. To bridge the gap, we propose ThreatKG, an automated system for OSCTI gathering and management. ThreatKG efficiently collects a large number of OSCTI reports from multiple sources, leverages specialized AI-based techniques to extract high-quality knowledge about various threat entities and their relationships, and constructs and continuously updates a threat knowledge graph by integrating new OSCTI data. ThreatKG features a modular and extensible design, allowing for the addition of components to accommodate diverse OSCTI report structures and knowledge types. Our extensive evaluations demonstrate ThreatKG's practical effectiveness in enhancing threat knowledge gathering and management.
