Cyber Threat Intelligence for “Things”

Wagner, Thomas D.

doi:10.1109/cybersa.2019.8899384

Cited by 6 publications

(4 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Following each of the steps of the intelligence cycle, in Table 3 we summarize these requirements. Please note that they are applicable not only in information technology infrastructure, but also in industrial control environments, where cyber threat intelligence is also a must [27,59] and where all the problems we have identified in our work are also present.…”

Section: Compromises Spread Over Timementioning

confidence: 90%

Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

2022

View full text Add to dashboard Cite

Cyber threat intelligence feeds the focus on atomic and computed indicators of compromise. These indicators are the main source of tactical cyber intelligence most organizations benefit from. They are expressed in machine-readable formats, and they are easily loaded into security devices in order to protect infrastructures. However, their usefulness is very limited, specially in terms of time of life. These indicators can be useful when dealing with non-advanced actors, but they are easily avoided by advanced ones. To detect advanced actor’s activities, an analyst must deal with behavioral indicators of compromise, which represent tactics, techniques and procedures that are not as common as the atomic and computed ones. In this paper, we analyze why these indicators are not widely used, and we identify key requirements for successful behavioral IOC detection, specification and sharing. We follow the intelligence cycle as the arranged sequence of steps for a defensive team to work, thereby providing a common reference for these teams to identify gaps in their capabilities.

show abstract

Section: Compromises Spread Over Timementioning

confidence: 90%

Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

2022

View full text Add to dashboard Cite

show abstract

“…A common method for the IDS is presented here that triggers security alarms. In [19], an empirical survey on the weight-based technique for attribute quality is presented. In [20], A requirement definition was proposed for the CTI platform.…”

Section: Related Workmentioning

confidence: 99%

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Alshehri¹

2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Cyber Threat Intelligence (CTI) has gained massive attention to collect hidden knowledge for a better understanding of the various cyber-attacks and eventually paving the way for predicting the future of such attacks. The information exchange and collaborative sharing through different platforms have a significant contribution towards a global solution. While CTI and the information exchange can help a lot in focusing and prioritizing on the use of the large volume of complex information among different organizations, there exists a great challenge ineffective processing of large count of different Indicators of Threat (IoT) which appear regularly, and that can be solved only through a collaborative approach. Collaborative approach and intelligence sharing have become the mandatory element in the entire world of processing the threats. In order to covet the complete needs of having a definite standard of information exchange, various initiatives have been taken in means of threat information sharing platforms like MISP and formats such as SITX. This paper proposes a scoring model to address information decay, which is shared within TISP. The scoring model is implemented, taking the use case of detecting the Threat Indicators in a phishing data network. The proposed method calculates the rate of decay of an attribute through which the early entries are removed.

show abstract

“…Indicators, which are system artifacts or observables connected with an attack, security warnings, incident reports, and threat intelligence, are some examples of CTI. CTI also include any additional pertinent information about recommended (or susceptible) security tool setups [2][3][4].…”

Section: Introductionmentioning

confidence: 99%

Cyber Threat Intelligence: Current Trends and Future Perspectives

Cinar

2023

JERR

View full text Add to dashboard Cite

Many organizations are continually put in danger by sophisticated and malevolent cyber attacks in today's rapidly developing threat landscape, which is evolving at a rapid rate. Cybercriminals, who are more skilled, more organized, and have more financial resources than in the past. Cyber Threat Intelligence, abbreviated as CTI, has emerged as a popular topic and is now being considered by many organizations as a potential solution to the growing number of cyber attacks. The purpose of this work is to conduct a literature review on the previous research that has been done on CTI. The most fundamental question about what CTI is investigated through the process of doing a literature study. This is done by contrasting several definitions in order to identify areas of agreement and disagreement. It has been discovered that neither the organization nor the suppliers have a comprehensive grasp of the information that is deemed to be CTI; hence, further study is required in order to define CTI. This article also listed existing CTI products and services, including as threat intelligence data feeds, threat intelligence standards, and tools that are being utilized in CTI. This study outlines four research issues in cyber threat intelligence and assesses contemporary work carried out in each of those areas. These difficulties were determined based on an assessment of the CTI definition, standards, and technologies. When an organization is inundated with a massive amount of threat data, the need for trained threat data analysts who are able to fully utilize CTI and transform the data into actionable information becomes more vital than it has ever been before. The problem of poor data quality is not a recent development; nonetheless, because to the increasing use of CTI, further study in this field is required.

show abstract

Cyber Threat Intelligence for “Things”

Cited by 6 publications

References 4 publications

Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Cyber Threat Intelligence: Current Trends and Future Perspectives

Contact Info

Product

Resources

About