Toward Automated Cyber Defense with Secure Sharing of Structured Cyber Threat Intelligence

Cyber Threat sharing helps with defending against cyber attacks in a timely manner. Many frameworks have been proposed for CTI sharing such as Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII). However, CTI sharing in a controlled and automated manner is critical. In this paper, we demonstrate Relationship Based Access Control (ReBAC) as an appropriate model for CTI sharing. We also develop an approach for automated threat detection, generation and sharing of structured CTI and taking course of actions to mitigate cyber threats. Finally, we implement an Automated Cyber Defense System in a cloud based environment.

Automated summary

Cyber threat sharing is crucial for timely defense against cyber attacks. This paper emphasizes the importance of sharing threat intelligence in a controlled and automated manner, and proposes Relationship Based Access Control (ReBAC) as a suitable model. By developing an automated approach for threat detection and sharing, along with implementing an Automated Cyber Defense System in a cloud based environment, effective mitigation of cyber threats can be achieved.