Cyber Treat Intelligence Modeling

Aviad, Adiel; Węcel, Krzysztof

doi:10.1007/978-3-030-20485-3_28

Cited by 5 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The CTI information sharing class includes the complexity factors related to the exchange of CTI between different entities [28,40]. In the bibliography, those factors range from purely theoretical to technical ones.…”

Section: Cti Information Sharingmentioning

confidence: 99%

See 1 more Smart Citation

A Reference Model for Cyber Threat Intelligence (CTI) Systems

et al. 2022

View full text Add to dashboard Cite

Cyber Threat Intelligence (CTI) is a new but promising field of information security, with many organizations investing in the development of proper tools and services and the integration of CTI related information. However, as a new field, there is a lack of a conceptual framework with corresponding definitions. This paper discusses CTI complexity factors, proposes a set of definitions of the CTI key concepts and an eight-layer CTI Reference Model as a base for CTI systems design. In addition, the proposed reference model is validated by applying it to three case studies, producing the respective CTI Reference Architectures.

show abstract

Section: Cti Information Sharingmentioning

confidence: 99%

“…This group includes factors related to the measurement of intelligence quality. These factors are objectivity, subjectivity, performance, behavior, accuracy of metrics [60], and organization's relevance [40] of produced intelligence.…”

Section: Cti Quality Of Intelligencementioning

confidence: 99%

A Reference Model for Cyber Threat Intelligence (CTI) Systems

et al. 2022

View full text Add to dashboard Cite

show abstract

“…In general, adoption usually begins with the recognition of the need for information, then moves to searching in possessed repositories, next to the initial decision to accept the received information, followed by validation in practice, and ending with absorption. On the other hand, knowledge provides the means to analyze and understand data and information [58,59,60], delivering the circumstances for an internal agreement between what we know and what we want to know.…”

Section: Knowledge Adoption and Reusementioning

confidence: 99%

Dynamical Aspects of Knowledge Evolution

Owoc

Weichbroth

2019

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Undeniably, in this rapidly changing world some knowledge granules change over time. Tracking these changes seems to be one of the most crucial processes in knowledge management. Every potential change is a result of knowledge adoption and application to solve a given problem or task in particular domains. However, there is a lack of a model that provides an eventdriven framework, along with the core adoption process explicitly expressed with related factors, which together serve as an efficient tool to adopt and reuse knowledge on one hand, while on the other, to measure and evaluate the various aspects of knowledge quality and usefulness. This paper aims to fill this gap by introducing a knowledge adoption process and an ontology-aided encapsulation knowledge (OAKE) model. While the former breaks down the tacit adoption process into two explicit sub-processes and measurable factors, the latter exposes knowledge evolution over time by a sequence of recorded events.

show abstract

“…STIX was initially developed by the United States government and MITRE. Currently, it is maintained by the Organization for the Advancement of Structured Information Standards (OASIS) [ 28 ].…”

Section: Introductionmentioning

confidence: 99%

Contextualized Filtering for Shared Cyber Threat Information

Dimitriadis

Prassas

Flores

et al. 2021

Sensors

View full text Add to dashboard Cite

Cyber threat information sharing is an imperative process towards achieving collaborative security, but it poses several challenges. One crucial challenge is the plethora of shared threat information. Therefore, there is a need to advance filtering of such information. While the state-of-the-art in filtering relies primarily on keyword- and domain-based searching, these approaches require sizable human involvement and rarely available domain expertise. Recent research revealed the need for harvesting of business information to fill the gap in filtering, albeit it resulted in providing coarse-grained filtering based on the utilization of such information. This paper presents a novel contextualized filtering approach that exploits standardized and multi-level contextual information of business processes. The contextual information describes the conditions under which a given threat information is actionable from an organization perspective. Therefore, it can automate filtering by measuring the equivalence between the context of the shared threat information and the context of the consuming organization. The paper directly contributes to filtering challenge and indirectly to automated customized threat information sharing. Moreover, the paper proposes the architecture of a cyber threat information sharing ecosystem that operates according to the proposed filtering approach and defines the characteristics that are advantageous to filtering approaches. Implementation of the proposed approach can support compliance with the Special Publication 800-150 of the National Institute of Standards and Technology.

show abstract

Cyber Treat Intelligence Modeling

Cited by 5 publications

References 10 publications

A Reference Model for Cyber Threat Intelligence (CTI) Systems

A Reference Model for Cyber Threat Intelligence (CTI) Systems

Dynamical Aspects of Knowledge Evolution

Contextualized Filtering for Shared Cyber Threat Information

Contact Info

Product

Resources

About