A different cup of TI? The added value of commercial threat intelligence
A different cup of TI? The added value of commercial threat intelligence
复制标题
一杯不同的TI？
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
M. V. Eeten
中科院分区：
文献类型：
--
作者：
Xander Bouwman;H. Griffioen;Jelle Egbers;C. Doerr;B. Klievink;M. V. Eeten
商业威胁情报被认为对攻击者行为提供了无与伦比的覆盖，但由于其高昂的价格标签，许多组织无法负担。本文首次对商业威胁情报提供商的服务进行了经验评估。对于两家领先的供应商，我们描述了这些服务的组成，并将它们的指标相互比较。它们之间几乎没有重叠，也没有与四个大型开放威胁情报馈送的重叠。即使对于22个特定的威胁参与者--两家供应商都声称要跟踪这些参与者--我们也发现指标馈送之间的平均重叠只有2.5%到4.0%。少数重叠指标出现在另一个供应商的提要中，平均延迟一个月。这些发现引发了人们对付费威胁情报的覆盖范围和及时性的质疑。我们还对使用付费威胁情报的安全专业人员进行了14次采访。我们发现，在这个市场上，人们对价值的理解与之前关于质量指标的工作所假设的不同。对客户来说，覆盖范围差和体积小似乎不是问题。他们似乎是在优化他们稀缺资源的工作流程--分析师的时间--而不是检测威胁。受访者大多通过非正式流程和启发式方法来评估TI，而不是研究提出的量化指标。
Commercial threat intelligence is thought to provide unmatched coverage on attacker behavior, but it is out of reach for many organizations due to its hefty price tag. This paper presents the first empirical assessment of the services of commercial threat intelligence providers. For two leading vendors, we describe what these services consist of and compare their indicators with each other. There is almost no overlap between them, nor with four large open threat intelligence feeds. Even for 22 specific threat actors – which both vendors claim to track – we find an average overlap of only 2.5% to 4.0% between the indicator feeds. The small number of overlapping indicators show up in the feed of the other vendor with a delay of, on average, a month. These findings raise questions on the coverage and timeliness of paid threat intelligence. We also conducted 14 interviews with security professionals that use paid threat intelligence. We find that value in this market is understood differently than prior work on quality metrics has assumed. Poor coverage and small volume appear less of a problem to customers. They seem to be optimizing for the workflow of their scarce resource – analyst time – rather than for the detection of threats. Respondents evaluate TI mostly through informal processes and heuristics, rather than the quantitative metrics that research has proposed.