  Log-based cyber threat hunting has emerged as an important solution to
counter sophisticated cyber attacks. However, existing approaches require
non-trivial efforts of manual query construction and have overlooked the rich
external knowledge about threat behaviors provided by open-source Cyber Threat
Intelligence (OSCTI). To bridge the gap, we build ThreatRaptor, a system that
facilitates cyber threat hunting in computer systems using OSCTI. Built upon
mature system auditing frameworks, ThreatRaptor provides (1) an unsupervised,
light-weight, and accurate NLP pipeline that extracts structured threat
behaviors from unstructured OSCTI text, (2) a concise and expressive
domain-specific query language, TBQL, to hunt for malicious system activities,
(3) a query synthesis mechanism that automatically synthesizes a TBQL query
from the extracted threat behaviors, and (4) an efficient query execution
engine to search the big system audit logging data.
