Exploring Open Source Information for Cyber Threat Intelligence

2020 ◽  
Author(s):  
Victor Adewopo ◽  
Bilal Gonen ◽  
Festus Adewopo
Keyword(s):  
Open Source ◽  
Source Information ◽  
Threat Intelligence ◽  
Cyber Threat ◽  
Cyber Threat Intelligence

scholarly journals An Automatic Generation Approach of the Cyber Threat Intelligence Records Based on Multi-Source Information Fusion

2021 ◽  
Vol 13 (2) ◽  
pp. 40
Author(s):  
Tianfang Sun ◽  
Pin Yang ◽  
Mengming Li ◽  
Shan Liao
Keyword(s):  
Language Processing ◽  
Automatic Generation ◽  
Source Information ◽  
Advanced Persistent Threats ◽  
Security Personnel ◽  
Threat Intelligence ◽  
Cyber Threat ◽  
Emergency Events ◽  
Low Efficiency ◽  
Cyber Threat Intelligence

With the progressive deterioration of cyber threats, collecting cyber threat intelligence (CTI) from open-source threat intelligence publishing platforms (OSTIPs) can help information security personnel grasp public opinions with specific pertinence, handle emergency events, and even confront the advanced persistent threats. However, due to the explosive growth of information shared on multi-type OSTIPs, manually collecting the CTI has had low efficiency. Articles published on the OSTIPs are unstructured, leading to an imperative challenge to automatically gather CTI records only through natural language processing (NLP) methods. To remedy these limitations, this paper proposes an automatic approach to generate the CTI records based on multi-type OSTIPs (GCO), combing the NLP method, machine learning method, and cybersecurity threat intelligence knowledge. The experiment results demonstrate that the proposed GCO outperformed some state-of-the-art approaches on article classification and cybersecurity intelligence details (CSIs) extraction, with accuracy, precision, and recall all over 93%; finally, the generated records in the Neo4j-based CTI database can help reveal malicious threat groups.

scholarly journals Trends in Existing and Emerging Cyber Threat Intelligence Platforms

2019 ◽  
Vol 8 (12) ◽  
pp. 3194-3201
Keyword(s):  
Data Analysis ◽  
Comparative Analysis ◽  
Open Source ◽  
Analytical Techniques ◽  
Sensor Data ◽  
Raw Data ◽  
Cyber Threats ◽  
Threat Intelligence ◽  
Cyber Threat ◽  
Cyber Threat Intelligence

The purpose of this paper is to present comparative analysis of cyber threat intelligence platforms and their features. This work include comparative analysis of existing ontologies for cyber threat collectors/sensor, data enrichment and data analytical techniques used for raw data analysis and community models for sharing cyber threats, intelligence and countermeasures. Firstly, this work performs comparative analysis of various data sensors designed for collecting raw data from different networks: wired, wireless and mobile. Secondly, detail analysis is performed on various interfaces designed to map ontologies into schemas. Thirdly, efficient methods for data analysis are considered for comparative and detailed report. These method extracts threat information from raw data. Lastly, various cybersecurity community models are analyzed with an aim of identifying an efficient cyber threat sharing model. It is observed that ontology based data sensor mechanisms are more efficient as compared to taxonomy models. It helps in identifying various cyber threats in stipulated time period. In another observation, it is found that decision tree based data analytical techniques are more efficient for critical infrastructure based cyber threat intelligence systems as compared to other machine learning techniques. Further, open source community for cyber threat sharing is efficient if it allows everyone to share their threat information, create groups for specialized interests and keep logs of every subscriber. The proposed analysis is performed for open source and commercial cyber threat sharing platforms however various ontology models are available for intrusion detection systems in cyberspace. This work may be extended for other ontology models, deep learning threat analytical models and quality based threat sharing communities for non-IT sectors like: gas plants, water and electricity supply system etc. The proposed cybersecurity platform is useful for various practical systems where need of cybersecurity is increasing day by day. For example, Supervisory Control and Data Acquisition (SCADA) systems like: energy, oil/gas, transportation, power, water and waste water management systems etc. The conducted analysis is helpful in identifying appropriate cyber threat sharing platform for different applications

Darkweb Cyber Threat Intelligence Mining

2017 ◽  
Author(s):  
John Robertson ◽  
Ahmad Diab ◽  
Ericsson Marin ◽  
Eric Nunes ◽  
Vivin Paliath ◽  
...  
Keyword(s):  
Threat Intelligence ◽  
Cyber Threat ◽  
Cyber Threat Intelligence

Dark-Net Ecosystem Cyber-Threat Intelligence (CTI) Tool

2019 ◽  
Author(s):  
Nolan Arnold ◽  
Mohammadreza Ebrahimi ◽  
Ning Zhang ◽  
Ben Lazarine ◽  
Mark Patton ◽  
...  
Keyword(s):  
Threat Intelligence ◽  
Cyber Threat ◽  
Cyber Threat Intelligence

scholarly journals Improving Forensic Triage Efficiency through Cyber Threat Intelligence

2019 ◽  
Vol 11 (7) ◽  
pp. 162 ◽  
Author(s):  
Nikolaos Serketzis ◽  
Vasilios Katos ◽  
Christos Ilioudis ◽  
Dimitrios Baltatzis ◽  
Georgios Pangalos
Keyword(s):  
Information Security ◽  
Digital Forensics ◽  
Incident Response ◽  
Security Controls ◽  
Digital Forensic ◽  
Threat Intelligence ◽  
Cyber Threat ◽  
Series Of Experiments ◽  
Cyber Threat Intelligence ◽  
Security Incidents

The complication of information technology and the proliferation of heterogeneous security devices that produce increased volumes of data coupled with the ever-changing threat landscape challenges have an adverse impact on the efficiency of information security controls and digital forensics, as well as incident response approaches. Cyber Threat Intelligence (CTI)and forensic preparedness are the two parts of the so-called managed security services that defendants can employ to repel, mitigate or investigate security incidents. Despite their success, there is no known effort that has combined these two approaches to enhance Digital Forensic Readiness (DFR) and thus decrease the time and cost of incident response and investigation. This paper builds upon and extends a DFR model that utilises actionable CTI to improve the maturity levels of DFR. The effectiveness and applicability of this model are evaluated through a series of experiments that employ malware-related network data simulating real-world attack scenarios. To this extent, the model manages to identify the root causes of information security incidents with high accuracy (90.73%), precision (96.17%) and recall (93.61%), while managing to decrease significantly the volume of data digital forensic investigators need to examine. The contribution of this paper is twofold. First, it indicates that CTI can be employed by digital forensics processes. Second, it demonstrates and evaluates an efficient mechanism that enhances operational DFR.

Sign in / Sign up

Export Citation Format

Share Document