Building language model guided CTI systems for consistent and comprehensive CTI data

Abstract

To combat rapidly evolving cyber threats, security practitioners are beginning to pay attention to cyber threat intelligence (CTI). In this regard, many existing studies present novel CTI systems that collect CTI data from publicly available sources and utilize them for threat analysis and detection. However, none of them validate that the CTI data they collect is consistent. Besides, since they cover limited threat information, they cannot provide a comprehensive view of cyber threats. Therefore, this dissertation addresses the problems of existing CTI systems through the following two research topics: (1) inconsistency check of CTI data and (2) the collection and utilization of various types of CTI data. We first propose an inconsistency checking system to identify the presence of inconsistencies among the CTI data addressed in publicly available sources and identify the degree and characteristics of conflicting CTI data. Next, we present a novel CTI system based on a pre-trained language model to collect various types of CTI data. We believe that the systems proposed in this dissertation will help security practitioners to analyze and detect cyber threats more clearly and reliably.