Сyber threat information intelligence integration models

Abstract

In the context of the constant growth of information on attacks on information systems, the task of increasing the effectiveness of cyber threat intelligence processes is relevant. As a rule, all information accompanying these processes is called cyber threat intelligence information, without dividing it by the essence of a specific process. On the other hand, the description of the structure of the complex of all processes is very general. All this leads to a high level of uncertainty in the description of cyber threat intelligence, which significantly complicates the implementation of classical automation technologies, assessing their necessity and effectiveness. The lack of specificity in understanding information processes also hinders the implementation of artificial intelligence tools: it is difficult to determine the place of application and the fundamental possibility of training a neural network on cyber threat intelligence data. One of the directions of overcoming this problem can be the use of formalized constructions that describe the relationship between the main components of the process of formation and application of an intelligence product. As part of the research based on the paradigm of the attributive-transfer approach to the nature of information, means of system and semantic analysis, a method of structural analysis of information processes and a method of semantic synthesis of basic concepts were developed. The use of these methods allowed to form: a basic set of agreed concepts of cyber threat intelligence; a model of the role (function) of threat intelligence in the process of cyber defense; a model of cyber threat intelligence processes. The research results allow us to present cyber threat intelligence as a set (information-functional structure) of coordinated information processes. For each of these processes, the semantics of information and the essence of its transformations are defined. In order to refine to the required level of specification, each of the processes can also be represented by an information-functional structure. The proposed models allow us to classify threat intelligence information and form structures for its integration within the framework of the introduction of classical automated processing technologies. The procedure for analyzing the possibility of using artificial intelligence technologies is significantly simplified. Based on the research results, a computer system was developed to support the processes of managing cyber threat risks in a corporate information system.