MTIV: A trustworthiness determination approach for threat intelligence

Abstract

With the gradually sharing of threat intelligences, users concern more about their trustworthiness, which is difficult to be judged. Some threat intelligence sharing platforms choose to show the risk or credibility, and inform users the trustworthiness of the threat intelligence. Several researchers have proposed the requirements and techniques for threat intelligence trust assessment. However, they do not present any tool-based or model solutions. In this paper, we present a Trustworthiness Determination Approach for Threat Intelligence (MTIV) to make up these shortcomings. First, we propose a framework to excavate threat intelligence via multiple sharing platforms, and extract multidimensional trustful features of the threat intelligence. Based on these, contributions of dimensional trustful features to the trustworthiness determination can be derived. Then we introduce Deep Belief Network (DBN) to determine the trustworthiness of the threat intelligence. The experimental results verify that MTIV is more effective than traditional methods. Our work will be of benefit to build a more credible threat intelligence sharing platform, and enhance the capability of real-time detection and resisting the cyberspace attacks.