Reputation Analysis for Publicly Available Threat Data Feeds in HailaTaxii.com
Reputation Analysis for Publicly Available Threat Data Feeds in HailaTaxii.com
Embedded Files
Cyber Threat Intelligence (CTI) has recently emerged as an undeniable part of cybersecurity. The idea behind cyber threat intelligence is to provide the ability to recognize and act upon indicators of attack and compromise (IOC) scenarios in a timely manner. CTI helps identify indicators of attacks (e.g., IP address, domains, hashes, etc.), collected from an information repository (open-source or private) before they can actively compromise different organizations. In this paper, we describe the current status of the Cyber Threat Intelligence research and the significance of sharing CTI feeds among organizations. We also discuss analyzing existing open-source CTI source feeds to measure their reputation. This reputation can help us compare the feeds and reduce the search space while using feeds in future research. Our results show that various threat feeds have various qualitative values and some are definitely more valuable with novel IOCs while some are copying threat indicators from others or delaying their feeds. Furthermore, some threat feeds are publishing more standard formatted (e.g., STIX, TAXII) IOCs while others are publishing text formatted data.
Cyber Threat Intelligence (CTI) has recently emerged as an undeniable part of cybersecurity. The idea behind cyber threat intelligence is to provide the ability to recognize and act upon indicators of attack and compromise (IOC) scenarios in a timely manner. CTI helps identify indicators of attacks (e.g., IP address, domains, hashes, etc.), collected from an information repository (open-source or private) before they can actively compromise different organizations. In this paper, we describe the current status of the Cyber Threat Intelligence research and the significance of sharing CTI feeds among organizations. We also discuss analyzing existing open-source CTI source feeds to measure their reputation. This reputation can help us compare the feeds and reduce the search space while using feeds in future research. Our results show that various threat feeds have various qualitative values and some are definitely more valuable with novel IOCs while some are copying threat indicators from others or delaying their feeds. Furthermore, some threat feeds are publishing more standard formatted (e.g., STIX, TAXII) IOCs while others are publishing text formatted data.
Table: Qualitative Reputation of Threat Feeds
Remarks:
Remarks:
I led this research project as part of the Advanced Network Security course taught by Dr. Zahid Anwar. Dr. Nazmus Sakib Miazi who was a Ph.D. student at UNC Charlotte back then was my team member in this project. Dr. Zahid helped us throughout the project by providing his valuable comments.
I led this research project as part of the Advanced Network Security course taught by Dr. Zahid Anwar. Dr. Nazmus Sakib Miazi who was a Ph.D. student at UNC Charlotte back then was my team member in this project. Dr. Zahid helped us throughout the project by providing his valuable comments.
Publications:
Publications:
Mir Mehedi A. Pritom, M. N. Sakib Miazi, and Zahid Anwar "Reputation Analysis of Public Threat Data Feeds" (PDF for reports is available)
Page updated
Google Sites
Report abuse