FeedMeter: Evaluating the Quality of Community-Driven Threat Intelligence

Andreas Rüedlinger, Rebecca Klauser, Pavlos Lamprakis, Markus Happe, Bernhard Tellenbach, Onur Veyisoglu, Ariane Trammell

2024

Abstract

A sound understanding of the adversary in the form of cyber threat intelligence (CTI) is key to successful cyber defense. Various sources of CTI exist, however there is no state-of-the-art method to approximate feed quality in an automated and continuous way. In addition, finding, combining and maintaining relevant feeds is very laborious and impedes taking advantage of the full potential of existing feeds. We propose FeedMeter, a platform that collects, normalizes, and aggregates threat intelligence feeds and continuously monitors them using eight descriptive metrics that approximate the feed quality. The platform aims to reduce the workload of duplicated manual processing and maintenance tasks and shares valuable insights about threat intelligence feeds. Our evaluation of a FeedMeter prototype with more than 150 OSINT sources, conducted over four years, shows that the platform has a real benefit for the community and that the metrics are promising approximations of source quality. A comparison with a prevalent commercial threat intelligence feed further strengthens this finding.

Paper Citation

in Harvard Style

Rüedlinger A., Klauser R., Lamprakis P., Happe M., Tellenbach B., Veyisoglu O. and Trammell A. (2024). FeedMeter: Evaluating the Quality of Community-Driven Threat Intelligence. In Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP; ISBN 978-989-758-683-5, SciTePress, pages 54-66. DOI: 10.5220/0012357600003648

in Bibtex Style

@conference{icissp24,
author={Andreas Rüedlinger and Rebecca Klauser and Pavlos Lamprakis and Markus Happe and Bernhard Tellenbach and Onur Veyisoglu and Ariane Trammell},
title={FeedMeter: Evaluating the Quality of Community-Driven Threat Intelligence},
booktitle={Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP},
year={2024},
pages={54-66},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012357600003648},
isbn={978-989-758-683-5},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 10th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP
TI - FeedMeter: Evaluating the Quality of Community-Driven Threat Intelligence
SN - 978-989-758-683-5
AU - Rüedlinger A.
AU - Klauser R.
AU - Lamprakis P.
AU - Happe M.
AU - Tellenbach B.
AU - Veyisoglu O.
AU - Trammell A.
PY - 2024
SP - 54
EP - 66
DO - 10.5220/0012357600003648
PB - SciTePress