Contextualized Filtering for Shared Cyber Threat Information.

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Cyber threat information sharing is crucial for collaborative security but faces challenges with information overload.
• Current filtering methods (keyword, domain-based) are inefficient, requiring significant human input and domain expertise.
• Existing approaches using business information offer only coarse-grained filtering.

Purpose of the Study:

• To develop an advanced, automated filtering approach for cyber threat information.
• To address the challenge of information overload in cyber threat sharing.
• To enhance the efficiency and relevance of shared threat intelligence.

Main Methods:

• Proposed a novel contextualized filtering approach leveraging standardized, multi-level business process context.
• Developed a method to measure the equivalence between shared threat information context and organizational context.
• Designed an architecture for a cyber threat information sharing ecosystem based on the contextualized filtering approach.

Main Results:

• The contextualized filtering approach automates the filtering of cyber threat information.
• Demonstrated the ability to measure the contextual equivalence for actionable threat intelligence.
• The proposed ecosystem architecture supports customized and automated threat information sharing.

Conclusions:

• The novel contextualized filtering approach significantly improves cyber threat information sharing efficiency.
• This method automates filtering by aligning threat context with organizational needs.
• Implementation supports compliance with NIST Special Publication 800-150.