Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence
Abstract
Threat intelligence is the provision of evidence-based knowledge about existing or potential threats. Benefits of threat intelligence include improved efficiency and effectiveness in security operations in terms of detective and preventive capabilities. Successful threat intelligence within the cyber domain demands a knowledge base of threat information and an expressive way to represent this knowledge. This purpose is served by the use of taxonomies, sharing standards, and ontologies. This paper introduces the Cyber Threat Intelligence (CTI) model, which enables cyber defenders to explore their threat intelligence capabilities and understand their position against the ever-changing cyber threat landscape. In addition, we use our model to analyze and evaluate several existing taxonomies, sharing standards, and ontologies relevant to cyber threat intelligence. Our results show that the cyber security community lacks an ontology covering the complete spectrum of threat intelligence. To conclude, we argue the importance of developing a multi-layered cyber threat intelligence ontology based on the CTI model and the steps should be taken under consideration, which are the foundation of our future work.
Discover the world’s research
- 15+ million members
- 118+ million publications
- 700k+ research projects
Figures
Modified Detection Maturity Level Model [4] [3]
Cyber Threat Intelligence Model
Filed under: Uncategorized | Tagged: Cyber Intelligence, Cyber Security, Cyber Threat Intelligence, Ontologies, Taxonomies | Commentaires fermés sur (PDF) Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence
© AFP / GENYA SAVILOV. Des hommes non-identifiés en uniforme et armés gardent l’entrée du bâtiment abritant le gouvernement de Crimée, à Simferopol le 2 mars 2014. 