Taxonomy of cyber threat intelligence framework

Abstract

Cyber threat intelligence is commonly utilised in the cyber security domain. Pyramid of Pain, MITRE ATT&CK framework, Cyber Kill Chain and The Diamond Model of Intrusion Analysis are examples of cyber security framework or concepts that are used for analysing cyber threat intelligence data. However, the cyber security frameworks or concepts do not divulge in the details on activities execution for harnessing cyber threat intelligence data as they are not exclusively developed for cyber threat intelligence purposes. Researchers have developed the cyber threat intelligence framework that delineate cyber threat intelligence activities and manages resources e.g. human and technologies to deal with cyber threats. Thus, this research reviews cyber threat intelligence framework to understand the architecture of the solution. Our observations have identified three main components that are common for the cyber threat intelligence framework. Furthermore, the discussion on this topic is a reference for cyber security scholars and practitioners that plan to understand and design cyber threat intelligence framework that fit their requirements.