Share and benefit: incentives for cyber threat intelligence sharing

Cyber Threat Intelligence (CTI) is an important asset for organisations to facilitate the safeguarding of their systems against new and emerging cyber threats. CTI continuously provides up-to-date information which enables the design and implementation of better security measures and mitigation strategies. Organisations gather data from different sources either internal or external to the organisation, which are analysed, resulting in CTI. Nevertheless, the gathered data usually contain a large amount of content that is irrelevant to CTI or even to cybersecurity. Furthermore, most approaches concerning CTI management (e.g., gathering, analysis) involve simply gathering and storing the information without any enrichment such as classification or correlation. However, in order to obtain optimal results, organisations should be able to utilise all capabilities of CTI. Therefore, in this work, we propose ThreatWise AI, a novel framework that enables the gathering, analysis, enrichment, storage, and sharing of CTI in an efficient and secure manner. In particular, we have developed a novel pipeline in ThreatWise AI which incorporates different advanced tools, with distinct capabilities that interact with each other to provide a complete set of functionalities for the administration of the overall CTI lifecycle. The developed tools integrate various Python scripts and provide gathering and analysis functionalities of CTI. Furthermore, the proposed framework leverages the MISP platform for storing, enriching and sharing while also integrating Artificial Intelligence (AI) and Machine Learning (ML) algorithms for advanced data enrichment.

The growing complexity of cyber threats, especially within critical infrastructure sectors like healthcare, energy, and maritime, highlights the need for comprehensive frameworks to facilitate the exchange of Cyber Threat Intelligence (CTI). This paper presents a CTI Exchange Governance Model aimed at enhancing the CTI sharing process within the DYNAMO platform, a European Union initiative focused on improving resilience against cyber threats across various phases of the resilience cycle: Prepare, Prevent, Protect, Respond, Recover, and Learn & Adapt. The DYNAMO project provides a suite of tools and strategies to support organizations in critical sectors, enabling efficient threat detection, mitigation, and response while fostering collaboration and compliance with regulatory standards. Sector-specific scenarios have been developed to address unique vulnerabilities in areas like healthcare, energy, and maritime, ensuring practical and targeted solutions for improving cyber resilience. While DYNAMO’s integrated tools handle CTI generation and alerts, a standardized and cohesive framework is still needed to guide and streamline CTI sharing across sectors, addressing gaps in current practices that impact interoperability and timely response. This governance model is structured around five key pillars: Collaboration & Trust, Data Sensitivity & Standardization, Compliance & Regulatory Alignment, Real-Time Collaboration & Response, and Continuous Learning & Improvement. These pillars ensure a secure, standardized, and compliant approach to CTI exchange, particularly in sectors vulnerable to increasingly sophisticated attacks. The model is uniquely tailored to align with DYNAMO's mission, offering a sector-specific approach while integrating best practices from established cybersecurity frameworks. The model is operationalized through the DYNAMO platform, leveraging tools like the Early Warning System (EWS) for real-time CTI sharing and a Data Anonymization Tool to ensure privacy and regulatory compliance. As a result, a practical framework has been developed to tailor the model’s implementation across healthcare, energy, and maritime sectors, ensuring a scalable and adaptable approach to CTI sharing. Ultimately, the governance model enhances CTI exchange by addressing interoperability challenges and strengthens governance practices to support collaboration, improve incident response times, and foster continuous improvement.

The healthcare information system (HIS) has become a victim of cyberattacks. Traditional ways to handle cyber incidents in healthcare organizations follow a predefined incident response (IR) procedure. However, this procedure is usually reactive, missing the opportunities to foresee danger on the horizon. Cyber threat intelligence (CTI) contains information on emerging attacks and should be ideally utilized to inform the IR procedure. However, current research shows that the IR has not been effectively informed by CTI, especially in healthcare organizations. This paper fills in this gap by proposing a proactive IR response procedure based on the National Institute of Standards and Technology (NIST) IR methodology. This paper then presents the NHS WannaCry case study to demonstrate the use of the proposed IR methodology. We collate cyber security advisories from different CTI sources such as US/UK CERT to protect interconnected systems and devices from Ransomware attacks. This research provides novel insights into the IR in healthcare through embedding CTI advisories into IR processes and concludes that our proposed IR procedure can be used to counteract WannaCry Ransomware using CTI advisories. It has the significance of transforming the way of IR from reactive to proactive using the CTI in healthcare.

Cyber-attack is one of the significant threats affecting to any organisation specifically to the Critical Infrastructure (CI) organisation. These attacks are nowadays more sophisticated, multi-vectored and less predictable, which make the Cyber Security Risk Management (CSRM) task more challenging. Critical Infrastructure needs a new line of security defence to control these threats and minimise risks. Cyber Threat Intelligence (CTI) provides evidence-based information about the threats aiming to prevent threats. There are existing works and industry practice that emphasise the necessity of CTI and provides methods for threat intelligence and sharing. However, despite these significant efforts, there is a lack of focus on how CTI information can support the CSRM activities so that the organisation can undertake appropriate controls to mitigate the risk proactively. This paper aims to fill this gap by integrating CTI for improving cybersecurity risks management practice specifically focusing on the critical infrastructure. In particular, the proposed approach contributes beyond state of the art practice by incorporating CTI information for the risk management activities. This helps the organisation to provide adequate and appropriate controls from strategic, tactical and operational perspectives. We have integrated concepts relating to CTI and CSRM so that threat actor's profile, attack detailed can support calculating the risk. We consider smart grid system as a Critical Infrastructure to demonstrate the applicability of the work. The result shows that cyber risks in critical infrastructures can be minimised if CTI information is gathered and used as part of CSRM activities. CTI not only supports understanding of threat for accurate risk estimation but also evaluates the effectiveness of existing controls and recommend necessity controls to improve overall cybersecurity. Also, the result shows that our approach provides early warning about issues that need immediate attention.

Many organizations are continually put in danger by sophisticated and malevolent cyber attacks in today's rapidly developing threat landscape, which is evolving at a rapid rate. Cybercriminals, who are more skilled, more organized, and have more financial resources than in the past. Cyber Threat Intelligence, abbreviated as CTI, has emerged as a popular topic and is now being considered by many organizations as a potential solution to the growing number of cyber attacks. The purpose of this work is to conduct a literature review on the previous research that has been done on CTI. The most fundamental question about what CTI is investigated through the process of doing a literature study. This is done by contrasting several definitions in order to identify areas of agreement and disagreement. It has been discovered that neither the organization nor the suppliers have a comprehensive grasp of the information that is deemed to be CTI; hence, further study is required in order to define CTI. This article also listed existing CTI products and services, including as threat intelligence data feeds, threat intelligence standards, and tools that are being utilized in CTI. This study outlines four research issues in cyber threat intelligence and assesses contemporary work carried out in each of those areas. These difficulties were determined based on an assessment of the CTI definition, standards, and technologies. When an organization is inundated with a massive amount of threat data, the need for trained threat data analysts who are able to fully utilize CTI and transform the data into actionable information becomes more vital than it has ever been before. The problem of poor data quality is not a recent development; nonetheless, because to the increasing use of CTI, further study in this field is required.

The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats (APT). Extracting attack behaviors, i.e., Tactics, Techniques, Procedures (TTP) from Cyber Threat Intelligence (CTI) can facilitate APT actors’ profiling for an immediate response. However, it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature. Based on the Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) of threat behavior description, this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network (HTN) and Graph Convolutional Network (GCN) to solve this issue. It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence. With the help of the Bidirectional Encoder Representation from Transformers (BERT) pretraining model to analyze the contextual semantics of cyber threat intelligence, the task of threat behavior identification is transformed into a text classification task, which automatically extracts attack behavior in CTI, then identifies the malware and advanced threat actors. The experimental results show that F1 achieve 94.86% and 92.15% for the multi-label classification tasks of tactics and techniques. Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks. The F1 for malware and advanced threat actors identification task reached 98.45% and 99.48%, which are better than the benchmark model in the experiment and achieve state of the art. The model can effectively model threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

Cyber threats continue to evolve in complexity, thereby traditional cyber threat intelligence (CTI) methods struggle to keep pace. AI offers a potential solution, automating and enhancing various tasks, from data ingestion to resilience verification. This paper explores the potential of integrating artificial intelligence (AI) into CTI. We provide a blueprint of an AI-enhanced CTI processing pipeline and detail its components and functionalities. The pipeline highlights the collaboration between AI and human expertise, which is necessary to produce timely and high-fidelity cyber threat intelligence. We also explore the automated generation of mitigation recommendations, harnessing AI’s capabilities to provide real-time, contextual, and predictive insights. However, the integration of AI into CTI is not without its challenges. Thereby, we discuss the ethical dilemmas, potential biases, and the imperative for transparency in AI-driven decisions. We address the need for data privacy, consent mechanisms, and the potential misuse of technology. Moreover, we highlight the importance of addressing biases both during CTI analysis and within AI models, warranting their transparency and interpretability. Lastly, our work points out future research directions, such as the exploration of advanced AI models to augment cyber defenses, and human–AI collaboration optimization. Ultimately, the fusion of AI with CTI appears to hold significant potential in the cybersecurity domain.

In today’s world, cyber-attacks are becoming more frequent and thus proactive protection against them is becoming more important. Cyber Threat Intelligence (CTI) is a possible solution, as it collects threat information in various information sources and derives stakeholder intelligence to protect one’s infrastructure. The current focus of CTI in research is the clear web, but the dark web may contain further information. To further advance protection, this work analyzes the dark web as Open Source Intelligence (OSINT) data source to complement current CTI information. The underlying assumption is that hackers use the dark web to exchange, develop, and share information and assets. This work aims to understand the structure of the dark web and identify the amount of its openly available CTI related information. We conducted a comprehensive literature review for dark web research and CTI. To follow this up we manually investigated and analyzed 65 dark web forum (DWF), 7 single-vendor shops, and 72 dark web marketplace (DWM). We documented the content and relevance of DWFs and DWMs for CTI, as well as challenges during the extraction and provide mitigations. During our investigation we identified IT security relevant information in both DWFs and DWMs, ranging from malware toolboxes to hacking-as-a-service. One of the most present challenges during our manual analysis were necessary interactions to access information and anti-crawling measures, i.e., CAPTCHAs. This analysis showed 88% of marketplaces and 53% of forums contained relevant data. Our complementary semi-automated analysis of 1 186 906 onion addresses indicates, that the necessary interaction makes it difficult to see the dark web as an open, but rather treat it as specialized information source, when clear web information does not suffice.

The volumes and sophistication of cyber threats in today’s cyber threat landscape have risen to levels where automated quantitative tools for Cyber Threat Intelligence (CTI) have become an indispensable part in the cyber defense arsenals. The AI and cyber security research communities are producing novel automated tools for CTI that quickly find their ways into commercial products. However, the quality of such automated intelligence products is being questioned by the intelligence community. Cyber security operators are forced to complement the automated tools with costly and time-consuming human intelligence analysis in order to improve the quality of the end product. For improving the quality, it has been suggested that researchers should incorporate methods from traditional intelligence analysis into the quantitative algorithms. This article presents a novel approach to cyber intelligence analysis called AMBARGO, which takes the inherent ambiguity of evidence into account in the analysis, using the Choquet integral, in formalizing the re-evaluation of evidence and hypotheses made by human analysts. The development of AMBARGO revolves around a cyber attribution use case, one of the hardest problems in CTI. The results of our evaluating experiments show that the robustness of AMBARGO outperforms state-of-the-art quantitative approaches to CTI in the presence of ambiguous evidence and potentially deceptive threat actor tactics. AMBARGO has thus the potential to fill a gap in the CTI state-of-the-art, which currently handles ambiguity poorly. The findings are also confirmed in a large-scale realistic experimental setting based on data from an APT campaign obtained from the MITRE ATT&CK Framework.

APT-scope: A novel framework to predict advanced persistent threat groups from enriched heterogeneous information network of cyber threat intelligence

BFLS: Blockchain and Federated Learning for sharing threat detection models as Cyber Threat Intelligence

As the cyber threat landscape is constantly becoming increasingly complex and polymorphic, the more critical it becomes to understand the enemy and its modus operandi for anticipatory threat reduction. Even though the cyber security community has developed a certain maturity in describing and sharing technical indicators for informing defense components, we still struggle with non-uniform, unstructured, and ambiguous higher-level information, such as the threat actor context, thereby limiting our ability to correlate with different sources to derive more contextual, accurate, and relevant intelligence. We see the need to overcome this limitation in order to increase our ability to produce and better operationalize cyber threat intelligence. Our research demonstrates how commonly agreed upon controlled vocabularies for characterizing threat actors and their operations can be used to enrich cyber threat intelligence and infer new information at a higher contextual level that is explicable and queryable. In particular, we present an ontological approach to automatically inferring the types of threat actors based on their personas, understanding their nature, and capturing polymorphism and changes in their behavior and characteristics over time. Such an approach not only enables interoperability by providing a structured way and means for sharing highly contextual cyber threat intelligence but also derives new information at machine speed and minimizes cognitive biases that manual classification approaches entail.

In recent years, cyber attacks have consistently grown in terms of volume, sophistication, coordination, and pervasiveness. Such attacks impose billions of dollars loss to companies and government entities annually. Sharing cyber threat intelligence (CTI) about ongoing attacks can significantly improve the current situation as many cyber attackers tend to reuse or share their network infrastructure, techniques, tactics, and procedures across multiple attacks. Therefore, many security professionals devote their time and effort on hunting cyber threats and sharing such valuable information with the public through public data sharing platforms such as social media and text sharing websites. However, due to the sheer volume of information that is being shared on such platforms; finding CTI information is tantamount to looking for a needle in a haystack. In this paper, we present a new scalable framework, IoCMiner, to automatically extract CTI, in special Indicators of Compromise, from Twitter. It utilizes a combination of graph theory, machine learning, and text mining technique to achieve its goal. IoCMiner relies on a reputation model to discover credible twitterers who publish CTI, and only tracks the tweet stream of such Twitter handles. Moreover, it employs a CTI classifier to further filter out non-CTI tweets from the observed data streams. Finally, IoCs uses a set of regular expression rules to extract IoCs from the identifies tweets. Through experimentation, we show the usefulness of IoCMiner in finding fresh IoCs from Twitter. In the course of four weeks, IoCMiner identified more than 1,200 IoCs, including malicious URLs. Only 10% of the URLs were already listed in public blacklist databases at the time of extraction. The number of URLs that appeared in blacklists increased to 26% after one week.

Cyber Threat Intelligence (CTI) serves as necessary information to support intentional cyberattack detections, but the extraction of CTI primarily relies on manual efforts, which is extremely inefficient. This paper presents an approach, named CTIGEN, to enhancing text summarization by leveraging cybersecurity-domain-specific Named Entity Recognition to ensure that the generated summaries possess the characteristics of CTI. This refinement makes the summaries suitable for direct use as CTI or simplifies the task for security professionals to analyze relevant information. CTIGEN involves defining and extracting CTI-specific named entities, using them to fine-tune the summarization process, and creating a dataset named text-to-CTI to evaluate CTIGEN. Experimental results showed a 4.35% improvement on CNN/DailyMail dataset and a 11.96% improvement on text-to-CTI dataset, and the CTI entity coverage rate improved by 19.39% compared to the traditional pre-trained language models, confirming the model’s capability to produce concise, accurate, and CTI-oriented summaries, thereby contributing to improved efficiency in CTI generation.

The increasing complexity and scale of cyber threats have pushed Cyber Threat Intelligence (CTI) beyond the capabilities of traditional rule-based systems. This article explores how Artificial Intelligence (AI), particularly Machine Learning (ML), Deep Learning (DL), Natural Language Processing (NLP), and graph-based analytics, is reshaping the CTI landscape. By automating threat data processing, enhancing attribution, and enabling predictive capabilities, AI is transforming CTI into a proactive and scalable discipline. By analysing CTI architectures, real-world use cases, platform comparisons, and current limitations, this study highlights the emerging opportunities and challenges at the intersection of cybersecurity and AI. This analysis concludes that the future of CTI lies in hybrid systems that seamlessly combine human expertise with intelligent automation.