IEEE Transactions on Quantum EngineeringDate of publication xxxx 00, 0000, date of current version xxxx 00, 0000.

Log-based cyber threat hunting has emerged as an important solution to counter sophisticated cyber attacks. However, existing approaches require non-trivial efforts of manual query construction and have overlooked the rich external knowledge about threat behaviors provided by open-source Cyber Threat Intelligence (OSCTI). To bridge the gap, we propose EFFHUNTER, a system that facilitates cyber threat hunting in computer systems using OSCTI. Built upon mature system auditing frameworks, EFFHUNTER provides (1) an unsupervised, light-weight, and accurate NLP pipeline that extracts structured threat behaviors from unstructured OSCTI text, (2) a concise and expressive domain-specific query language, TBQL, to hunt for malicious system activities, (3) a query synthesis mechanism that automatically synthesizes a TBQL query for threat hunting from the extracted threat behaviors, and (4) an efficient query execution engine to search the big audit logging data. Evaluations on a broad set of attack cases demonstrate the accuracy and efficiency of EFFHUNTER in enabling practical threat hunting.

No abstract

No abstract