Research on University’s Cyber Threat Intelligence Sharing Platform Based on New Types of STIX and TAXII Standards

Abstract

With the systematization of cyber threats, the variety of intrusion tools and intrusion methods has greatly reduced the cost of attackers' threats to network security. Due to a large number of colleges and universities, teachers and students are highly educated and the Internet access rate is nearly 100%. The social status makes the university network become the main target of threat. The traditional defense method cannot cope with the current complex network attacks. In order to solve this problem, the threat intelligence sharing platform based on various threat intelligence sharing standards is established, which STIX and TAXII It is a widely used sharing standard in various sharing platforms. This paper analyzes the existing standards of STIX and TAXII, improves the STIX and TAXII standards based on the analysis results, and proposes a new type of STIX and TAXII based on the improved results. The standard design scheme of threat intelligence sharing platform suitable for college network environment features. The experimental results show that the threat intelligence sharing platform designed in this paper can be effectively applied to the network environment of colleges and universities.

Modelo de referência para o desenvolvimento de aplicações de inteligência de ameaças cibernéticas e sua aplicabilidade para o compartilhamento de dados

“…Para que o processo de gerar conhecimento seja possível, se faz necessária a normalização desses dados em formato padrão unificado. Pois somente assim, é possível realizar o processo de análise nos dados armazenados com os mesmos mecanismos e utilizando as mesmas técnicas [34].…”