Measuring and visualizing cyber threat intelligence quality

Abstract

The very raison d'être of cyber threat intelligence (CTI) is to provide meaningful knowledge about cyber security threats. The exchange and collaborative generation of CTI by the means of sharing platforms has proven to be an important aspect of practical application. It is evident to infer that inaccurate, incomplete, or outdated threat intelligence is a major problem as only high-quality CTI can be helpful to detect and defend against cyber attacks. Additionally, while the amount of available CTI is increasing it is not warranted that quality remains unaffected. In conjunction with the increasing number of available CTI, it is thus in the best interest of every stakeholder to be aware of the quality of a CTI artifact. This allows for informed decisions and permits detailed analyses. Our work makes a twofold contribution to the challenge of assessing threat intelligence quality. We first propose a series of relevant quality dimensions and configure metrics to assess the respective dimensions in the context of CTI. In a second step, we showcase the extension of an existing CTI analysis tool to make the quality assessment transparent to security analysts. Furthermore, analysts' subjective perceptions are, where necessary, included in the quality assessment concept.

Contextualized Filtering for Shared Cyber Threat Information

“…If the information matches with that of the recipient, the CTIP is relevant to the recipient. Another notable effort is [ 21 ], which also suggested the use of specific characteristics, such as the industry sector in the Identity SDO, that are included in STIX objects to achieve filtering (similar to the domain-tagging approach). In case that a CTIP and an organization share the same characteristics, the CTIP is relevant to the organization.…”

“…Keyword searching is offered by most CTIP repositories [ 14 ]. Domain tagging concerns the categorization of shared CTIPs into domains, such as finance and education, with the utmost goal of presenting them to the organizations belonging to the same domain [ 21 ]. Keyword searching is labor-intensive, error-prone, and demands expertise in order to define the proper keywords [ 13 , 14 , 15 ], while the use of domain tagging is insufficient since current approaches only classify CTIP into a few arbitrary, high-level domains that are not sufficiently specific.…”

Cyber Threat Intelligence

“…To this end, a second future direction is how to assure CTI quality. Whereas first approaches aim to analyze and propose quality metrics for CTI (Schlette et al 2020), the subjective nature and the diversity of threat information demand further research. Based upon data analysis, a stronger data-centric focus must take the entire CTI life cycle and organizational dependencies into account.…”

DEALER: decentralized incentives for threat intelligence reporting and exchange

“…The verification needs to be as objective and meaningful as possible to provide guidance for buyers, since the actual data are encrypted. The following items serve as verification guidelines: -consistency with metadata of the seller's previous incidents -similarity check for incident metadata and verified incidents -assessment of various threat intelligence quality indicators [24] After receiving the incident data, each verifier independently performs a verification of the contained information. A basic consistency check using metadata of the seller's previous incidents verifies that the incident originates from the same industry.…”

“…To achieve this, the implemented questions are based on objective CTI data quality indicators developed for STIX2 [24]. The quality criteria are divided into three major domains.…”