  Despite the increased adoption of open-source cyber threat intelligence
(OSCTI) for acquiring knowledge about cyber threats, little effort has been
made to harvest knowledge from a large number of unstructured OSCTI reports
available in the wild (e.g., security articles, threat reports). These reports
provide comprehensive threat knowledge in a variety of entities (e.g., IOCs,
threat actors, TTPs) and relations, which, however, are hard to gather due to
diverse report formats, large report quantities, and complex structures and
nuances in the natural language report text.
  To bridge the gap, we propose ThreatKG, a system for automated open-source
cyber threat knowledge gathering and management. ThreatKG automatically
collects a large number of OSCTI reports from various sources, extracts
high-fidelity threat knowledge, constructs a threat knowledge graph, and
updates the knowledge graph by continuously ingesting new knowledge. To address
multiple challenges, ThreatKG provides: (1) a hierarchical ontology for
modeling a variety of threat knowledge entities and relations; (2) an accurate
deep learning-based pipeline for threat knowledge extraction; (3) a scalable
and extensible system architecture for threat knowledge graph construction,
persistence, updating, and exploration. Evaluations on a large number of
reports demonstrate the effectiveness of ThreatKG in threat knowledge gathering
and management
