A Methodology to Evaluate Standards and Platforms within Cyber Threat Intelligence

Abstract

The cyber security landscape is fundamentally changing over the past years. While technology is evolving and new sophisticated applications are being developed, a new threat scenario is emerging in alarming proportions. Sophisticated threats with multi-vectored, multi-staged and polymorphic characteristics are performing complex attacks, making the processes of detection and mitigation far more complicated. Thus, organizations were encouraged to change their traditional defense models and to use and to develop new systems with a proactive approach. Such changes are necessary because the old approaches are not effective anymore to detect advanced attacks. Also, the organizations are encouraged to develop the ability to respond to incidents in real-time using complex threat intelligence platforms. However, since the field is growing rapidly, today Cyber Threat Intelligence concept lacks a consistent definition and a heterogeneous market has emerged, including diverse systems and tools, with different capabilities and goals. This work aims to provide a comprehensive evaluation methodology of threat intelligence standards and cyber threat intelligence platforms. The proposed methodology is based on the selection of the most relevant candidates to establish the evaluation criteria. In addition, this work studies the Cyber Threat Intelligence ecosystem and Threat Intelligence standards and platforms existing in state-of-the-art.

A Comparative Study on Cyber Threat Intelligence: The Security Incident Response Perspective

“…The authors enhance previous CTI comparisons by emphasizing strengths, weaknesses, and structure as well as use cases for CTI formats [58]. Other current works reproduce CTI format analysis with similar evaluation criteria and results [59], [60] or extend research to the evaluation of CTI sharing platforms. In this respect, Bauer et al [61] identified the necessity of CTI standardization for information description and CTI sharing use cases within their non-functional platform criteria.…”

A Threat Hunting Framework for Industrial Control Systems

“…This information can be shared amongst trusted stakeholders [46]. Different CTI platforms were evaluated in [47]. According to this paper, MISP is a reliable platform for CTI sharing.…”

A workflow and toolchain proposal for analyzing users’ perceptions in cyber threat intelligence sharing platforms

“…Since its inception within military circles, MISP has grown into one of the leading open-source sharing platforms used by over 6000 organizations worldwide 1 . MISP is also one of the most studied platforms [14], [15], [16], characterized as holistic and applicable in diverse scenarios as well as flexible considering the compatibility with different formats [11].…”

“…Furthermore, usability has been included as key evaluation criteria in recent frameworks for comparing the state-of-theart in CTI sharing platforms [11]. Nevertheless, despite this acknowledgment on the importance of UX in the context of CTI sharing platforms, empirical evidence on their usability, or perceived UX is scarce to non-existent.…”