Authors: Mario Faiella 1 ; Gustavo Gonzalez-Granadillo 1 ; Ibéria Medeiros 2 ; Rui Azevedo 2 and Susana Gonzalez-Zarzosa 1

Affiliations: 1 Atos Research & Innovation, Cybersecurity Laboratory and Spain ; 2 LASIGE, Faculty of Sciences, University of Lisboa and Portugal

ISBN: 978-989-758-378-0

ISSN: 2184-2825

Keyword(s): Threat Intelligence Platforms, Open Source Intelligence (OSINT), Data Enrichment, MISP, Threat Score.

Related Ontology Subjects/Areas/Topics: Data and Application Security and Privacy ; Information and Systems Security ; Information Assurance ; Management of Computing Security ; Risk Assessment ; Security in Information Systems ; Security Management ; Security Metrics and Measurement

Abstract: One of the weakest points in actual security detection and monitoring systems is the data retrieval from Open Source Intelligence (OSINT), as well as how this kind of information should be processed and normalized, considering their unstructured nature. This cybersecurity related information (e.g., Indicator of Compromise - IoC) is obtained from diverse and different sources and collected by Threat Intelligence Platforms (TIPs). In order to improve its quality, such information should be correlated with real-time data coming from the monitored infrastructure, before being further analyzed and shared. In this way, it could be prioritized, allowing a faster incident detection and response. This paper presents an Enriched Threat Intelligence Platform as a way to extend import, quality assessment processes, and information sharing capabilities in current TIPs. The platform receives structured cyber threat information from multiple sources, and performs the correlation among them with both static and dynamic data coming from the monitored infrastructure. This allows the evaluation of a threat score through heuristic-based analysis, used for enriching the information received from OSINT and other sources. The final result, expressed in a well defined format, is sent to external entities, which is further used for monitoring and detecting incidents (e.g., SIEMs), or for more in-depth analysis, and shared with trusted organizations. (More)

PDF ImageFull Text


Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Faiella, M.; Gonzalez-Granadillo, G.; Medeiros, I.; Azevedo, R. and Gonzalez-Zarzosa, S. (2019). Enriching Threat Intelligence Platforms Capabilities.In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT, ISBN 978-989-758-378-0, ISSN 2184-2825, pages 37-48. DOI: 10.5220/0007830400370048

author={Mario Faiella. and Gustavo Gonzalez{-}Granadillo. and Ibéria Medeiros. and Rui Azevedo. and Susana Gonzalez{-}Zarzosa.},
title={Enriching Threat Intelligence Platforms Capabilities},
booktitle={Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,},


JO - Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT,
TI - Enriching Threat Intelligence Platforms Capabilities
SN - 978-989-758-378-0
AU - Faiella, M.
AU - Gonzalez-Granadillo, G.
AU - Medeiros, I.
AU - Azevedo, R.
AU - Gonzalez-Zarzosa, S.
PY - 2019
SP - 37
EP - 48
DO - 10.5220/0007830400370048

Login or register to post comments.

Comments on this Paper: Be the first to review this paper.