DarkPulse: An Automated Threat Intelligence and Leak Analytics Platform

Cybersecurity intelligence is distributed across vulnerability databases, threat bulletins, malware feeds, andincident disclosures. Conventional automated monitoring workflows frequently analyze records as isolated silos or relyon simple keyword filtering, obscuring multi-hop attack vectors and developing threat campaigns. This paper presentsDarkPulse, an automated threat intelligence correlation and risk prioritization platform that integrates heterogeneouspublic feeds into a unified analytical graph. DarkPulse ingests disclosures from the National Vulnerability Database (NVDAPI 2.0), the CISA Known Exploited Vulnerabilities (KEV) catalog, and security RSS/Atom advisories, persisting theminto an immutable raw/normalized dual-storage layer. The extraction pipeline combines deterministic indicator regexeswith spaCy named entity recognition and an alias canonicalization map to construct a directed multi-relational NetworkXgraph. DarkPulse applies a rolling-window temporal z-score detector to surface anomalous mention bursts alongside amulti-factor risk scoring engine that balances graph centrality, CVSS metrics, exponential recency decay, and monitoredasset relevance. Served through an asynchronous REST backend and evaluated on real-world threat feeds across anautomated 115-test verification suite, the platform delivers real-time contextual correlation and prioritized threat triagevia an interactive single-page web console.