Bandit on the Hunt:针对网络威胁情报的动态爬虫
密码学与安全
2025-04-28 v1
摘要
公共信息 contains 有价值的网络威胁情报(CTI),用于防止未来攻击。尽管存在分享此类信息的标准,但大量信息 appears 在 non-standardized 的新闻文章或博客中。监控在线来源以获取威胁情报耗时且 source selection uncertain。当前 research focuses on 从 known sources 提取 Compromised Indicators of(IoC),很少 addressing new source identification。本文提出一种以 CTI 为 focus 的爬虫,采用多臂老虎机(MAB)和 various crawling strategies。它使用 SBERT 来识别 relevant documents while dynamically 调整 its crawling path。我们的 system ThreatCrawl achieves harvest rate 超过 25%,同时将 seed 扩大超过 300%,且保持 topic focus。此外,爬虫识别了 previously unknown but highly relevant 的 overview 页面、数据集和 domain。
引用
@article{arxiv.2504.18375,
title = {Bandit on the Hunt: Dynamic Crawling for Cyber Threat Intelligence},
author = {Philipp Kuehn and Dilara Nadermahmoodi and Markus Bayer and Christian Reuter},
journal= {arXiv preprint arXiv:2504.18375},
year = {2025}
}
备注
12 pages, 1 figure, 3 tables