Reproduce “Bandit on the Hunt: Dynamic Crawling for Cyber Threat Intelligence” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Philipp Kuehn, Dilara Nadermahmoodi, Markus Bayer, Christian Reuter
ThreatCrawl, a system developed at the Technical University of Darmstadt, integrates Sentence-BERT embeddings and a Multi-Armed Bandit algorithm for dynamic and automated discovery of Cyber Threat Intelligence (CTI) from the web. This approach achieved harvest rates exceeding 25% and expanded identified relevant domains by up to 269, proactively identifying novel CTI sources.
Key insights
- Combining semantic relevance classification with an adaptive exploration-exploitation strategy (MAB) enables efficient and dynamic discovery of novel CTI sources on the constantly evolving web.
- Moving beyond predefined sources to actively 'hunting' for new information reduces blind spots and provides earlier warnings about emerging threats and TTPs.
- Automating the laborious initial CTI collection phase frees up security analysts to focus on higher-value tasks like threat analysis and incident response.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.