HuntSmart: Hypothesis-Driven Threat Hunting Using GenAI

As cyber threats grow in sophistication and frequency, organizations face increasing pressure to detect and mitigate these threats swiftly and accurately. Threat hunting—a proactive approach to identifying malicious activity beyond traditional defenses—remains essential yet challenging. Extracting Tactics, Techniques, and Procedures (TTPs) from vast, unstructured threat data is largely manual, time-consuming, and inconsistent. Additionally, effective threat hunting requires generating actionable hypotheses, a process traditionally reliant on human expertise.This project introduces HuntSmart (2024), a tool designed to automate critical aspects of threat hunting. HuntSmart enhances TTP extraction through the use of the SecureBERT deep learning model, which is configured as a one-to-one classifier to handle cyber threat intelligence (CTI) data. The tool integrates generative AI for automated hypothesis generation via the Gemini API, aligning each hypothesis with the MITRE ATT&CK framework and including Indicators of Compromise (IoCs). HuntSmart prioritizes hypotheses by risk factors such as impact and detection complexity, enabling threat hunters to focus on high-risk threats and providing targeted mitigation suggestions. By automating TTP extraction, risk-based prioritization, and mitigation and detection guidance, HuntSmart offers a scalable and effective approach to threat hunting, contributing a structured, AI-driven methodology to enhance organizational cybersecurity resilience.