On the Automated Assessment of Open-Source Cyber Threat Intelligence Sources

Abstract

Global malware campaigns and large-scale data breaches show how everyday life can be impacted when the defensive measures fail to protect computer systems from cyber threats. Understanding the threat landscape and the adversaries' attack tactics to perform it represent key factors for enabling an efficient defense against threats over the time. Of particular importance is the acquisition of timely and accurate information from threats intelligence sources available on the web which can provide additional intelligence on emerging threats even before they can be observed as actual attacks. In this paper, an approach to automate the assessment of cyber threat intelligence sources and predict a relevance score for each source is proposed. Specifically, a model based on meta-data and word embedding is defined and experimented by training regression models to predict the relevance score of sources on Twitter. The results evaluation show that the assigned score allows to reduce the waiting time for intelligence verification, on the basis of its relevance, thus improving the time advantage of early threat detection.

A Systematic Mapping Study on Cyber Security Indicator Data

“…Within these, they found that the majority of indicators were active for at least 20 days before they are listed, and that some data were biased towards certain countries. Tundis et al [18] also surveyed existing open source threat intelligence sources, and, based on interviews with 30 experts (i.e., cyber security professionals and academic researchers), they proposed an approach for the automated assessment of such sources.…”

cyberaCTIve: a STIX-based Tool for Cyber Threat Intelligence in Complex Models

“…Quality of CTIbased feeds is a topic of wide interest [10], [11] in attempts to determine best data sources with high-quality curated cyber-security withholding crucial elements to make decisions. Tundis et al (2019) [12], for instance, investigated automated assessment of sources and computed a relevance score index to reduce the time needed to verify gathered intelligence.…”

“…We implemented a standard web-based system with so called responsive browser window elements, i.e., flexible hypertext elements that adapts the interface it to fit in different screens (tablets, PC desktops, and even cell phones) and browsers (Opera, IE, Safari, Firefox, or Edge). For this we have used the framework provided by W3-CSS (from the World-Wide Web consortium, using cascading style sheets) 12 . The advantage of using W3-CSS over other similar alternatives is due to its simplicity and lack of jQuery/JavaScript elements that were not required by our application.…”

Incorporating Cyber Threat Intelligence into Complex Cyber-Physical Systems: A STIX Model for Active Buildings

“…Examples of data sources [33] combine technical, human, and internal domains, and the knowledge could be both structured and unstructured [19,34]. This naturally raises concerns about the quality of CTI-based feeds: indeed, it is a topic of wide interest [35,36]; Tundis et al [37], for instance, investigated automated assessment of sources and computed a relevance score index to reduce the time needed to verify gathered intelligence. Another task on the same line is that of assessing and evaluating data made available from various sources: open (publicly available) CTI feeds, data from security vendors, industry reports on vulnerabilities, open-source intelligence (OSINT) reports [38], security data extracted from IDS or firewall, data from the security, information, and event management (SIEM) platform, incident response systems, and network traffic and flow logs, to mention a few.…”