Looking under the Streetlights

Looking under the Streetlights: Evaluating Cyber Threat Intelligence Feeds Using Quantitative Metrics and User Appreciation Scores

Egbers, Jelle (TU Delft Technology, Policy and Management)

van Eeten, M.J.G. (graduation committee)
Warnier, Martijn (graduation committee)
Klievink, A.J. (graduation committee)
Bouwman, X.B. (mentor)

Delft University of Technology

Engineering and Policy Analysis

2021-03-01

In the battle against ever-changing cyber threats, a new ally has joined in: Cyber Threat Intelligence. Evolved from historical blacklists and anti-virus, Threat Intelligence aims to protect and inform its clients against both nation state actors, as well as cyber criminals. Threat Intelligence comes in many shapes and sizes, and for a wide range of prices. For the average consumer of Threat Intelligence, it is unknown which form will fit their needs, nor which price range is suitable for them.

This mystery surrounding Threat Intelligence, caused by its prohibitively high pricing, shows in the limited amount of research that has been conducted on the topic. Bouwman et al. lifted a tip of the veil, interviewing professionals regarding their use of Threat Intelligence and presenting descriptive statistics of its contents. They found very limited overlap between Threat Intelligence sources and that acquisition is largely based on gut-feeling. However, it is still largely unknown if these findings generalize to the whole field of Threat Intelligence and if these findings on macro level translate to more granular levels, it is our goal to find this out.

Threat Intelligence

http://resolver.tudelft.nl/uuid:c336cb59-192f-4e20-b166-5718b0de5d2f

2021-03-08

Student theses

master thesis

© 2021 Jelle Egbers