Understanding Cyber Threat Intelligence: Towards Automation

Abstract

Cyberattacks have the realistic potential of causing serious harm to humans, their assets and business processes. Cybersecurity is aimed at detecting, blocking and mitigating such threats and cyber threat intelligence is used to inform the decisions on how to respond to the ever-changing threats in and from cyber space. Increasing the effectiveness of cyber threat intelligence strengthens the collective digital defense. Cyber threat intelligence is collection, analysis and dissemination of relevant data, information and knowledge about cyber threats. Automation of such efforts increases the efficiency and allows use of advanced analysis techniques which requires large computational power. Such automation requires machine readable content. Standardization and structure provides a computer with the ability to read and process data, information and potentially knowledge. This thesis gives an overview of what cyber threat intelligence is and the status of standardization efforts within the domain. A datamodel which provides automation possibilities is suggested and explained.