The sharing of cyber-threat intelligence is an essential part of multi-layered tools used to protect systems and organisations from various threats. Structured standards, such as STIX, TAXII and CybOX, were introduced to provide a common means of sharing cyber-threat intelligence and have been subsequently much-heralded as the de facto industry standards. In this paper, we investigate the landscape of the available formats and languages, along with the publicly available sources of threat feeds, how these are implemented and their suitability for providing rich cyber-threat intelligence. We also analyse at a sample of cyber-threat intelligence feeds, the type of data they provide and the issues found in aggregating and sharing the data. Moreover, the type of data supported by various formats and languages is correlated with the data needs for several use cases related to typical security operations. The main conclusions drawn by our analysis suggest that many of the standards have a poor level of adoption and implementation, with providers opting for custom or traditional simple formats.

/pdf/a-comparative-analysis-of-cyber-threat-intelligence-sources-4f0zeu818e.pdf

A comparative analysis of cyber-threat intelligence sources, formats and languages

Recently, the use of IoT devices in living environments has increased due to the development of various wireless communication technologies As the number of types of IoT devices has grown exponentially, many kinds of insecure operating systems and open source software programs are being used As they run with security vulnerabilities, IoT devices using such OS and software can be targeted by malicious attackers In addition, due to the operating characteristics of IoT devices, it is difficult to apply security patches immediately when vulnerabilities are found Accordingly, there is an increasing need for managing and sharing cyber security threat information in order to prevent security threats and accidents This paper suggests a platform structure and application method for collecting, analyzing and sharing vulnerability information about IoT devices

/pdf/management-platform-of-threats-information-in-iot-56e3yz6sqj.pdf

Management platform of threats information in IoT environment

Threat intelligence sharing has become a cornerstone of cooperative and collaborative cybersecurity. Sources providing such data have become more widespread in recent years, ranging from public entities (driven by legislatorial changes) to commercial companies and open communities that provide threat intelligence in order to help organisations and individuals to better understand and assess the cyber threat landscape putting their systems at risk. Tool support to automatically process this information is emerging concurrently. It has been observed that the quality of information received by the sources varies significantly and that in order to assess the quality of a threat intelligence source it is not sufficient to only consider qualitative indications of the source itself, but it is necessary to monitor the data provided by the source continuously to be able to draw conclusions about the quality of information provided by a source. In this paper, we propose a methodology for evaluating cyber threat information sources based on quantitative parameters. The methodology aims to facilitate trust establishment to threat intelligence sources, based on a weighted evaluation method that allows each entity to adapt it to its own needs and priorities. The approach facilitates automated tools utilising threat intelligence, since information to be considered can be prioritised based on which source is trusted the most at the time the intelligence arrives.

/pdf/a-quantitative-evaluation-of-trust-in-the-quality-of-cyber-2uvnlegsmw.pdf

A Quantitative Evaluation of Trust in the Quality of Cyber Threat Intelligence Sources

SCERM—A novel framework for automated management of cyber threat response activities

Cyber threat information (CTI) sharing involves processes of the collection, analysis and sharing of cyber threat information among multiple organizations. CTI is highly sensitive and inadvertent access can harm an organisation’s reputation. Moreover, CTI sharing may also inadvertently advertise a vulnerability that may be present in the organisation’s infrastructure. Therefore, preserving the privacy and anonymity of the CTI participants is critical. This paper proposes "Siddhi", a blockchain and Self-Sovereign Identity(SSI) enabled CTI platform that will realize traceability, anonymization and data provenance in a scalable fashion. Siddhi is equipped with SSI-enabled mobile wallet to ensure anonymous reporting of threat information and supports TAXII and STIX standards for exchanging the threat information between participants in the blockchain network.

Blockchain and Self-Sovereign Identity Empowered Cyber Threat Information Sharing Platform

Intrusion detection in big data using hybrid feature fusion and optimization enabled deep learning based on spark architecture

One of the important challenges in threat intelligence is to use them efficiently which can be obtained by both external and internal sources. The need for organization to have cyber threat intelligence is growing and a basic component for any such capacity is sharing threat intelligence between trusted partners, which will help us to target and compute the large cyber security information. This paper briefly explains the way of sharing the threat information which is both human and machine readable using Structured Threat Information Expression (STIX) and Trusted automated exchange of indicator information.

P. Vijay Bhaskar Reddy

Papers

Intrusion detection in big data using hybrid feature fusion and optimization enabled deep learning based on spark architecture

A Latest Comprehensive Study on Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Indicator Information (TAXII)