Pyramid Convolution and Bidirectional Graph Attention for Cyber Threat Detection from Unstructured Text

The exponential growth of unstructured cyber threat intelligence necessitates automated detection mechanisms that are both semantically precise and structurally aware. Existing solutions often falter due to the dichotomy between shallow textual pattern matching and computationally expensive graph reasoning, while also struggling with the severe class imbalance inherent in security datasets. We propose ThreatHunter, a hybrid framework that synergizes a Pyramid Convolutional Semantic Encoder for multi-granularity feature extraction with a Bidirectional Graph Attention Network for capturing complex entity relationships. To resolve ambiguity in sophisticated attack narratives, we introduce an auxiliary instruction-tuned language model that distills analytical rationales into the primary network. Extensive experiments demonstrate that ThreatHunter outperforms state-of-the-art baselines like SecureBERT, achieving superior F1-scores and robustness against adversarial noise.