网络威胁情报模型：网络威胁情报领域内分类法、共享标准与本体的评估
Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence
AI总结：
该研究评估了网络威胁情报领域相关本体、共享标准和分类法在威胁多维度要素等方面的覆盖与表达能力，指出现有全面性本体建设不足、存在设计不完善等问题。
摘要：
网络威胁情报是指提供关于现有或新出现威胁的、基于证据的知识。威胁情报的益处包括提升态势感知能力、提高安全运营效率，以及增强预防、检测和响应能力。为了处理、关联和分析海量威胁信息与数据，并得出能在有效时间内共享和使用的情报，需要采用结构化、机器可读的格式，这类格式需具备行业所需的表达能力，同时保持无歧义性。这一目标在很大程度上通过本体、模式和分类法等技术实现。本研究评估了与网络威胁情报相关的本体、共享标准和分类法的覆盖范围及高层概念表达能力，评估维度涵盖威胁与攻击的“谁、什么、为什么、哪里、何时、如何”要素，此外还包括行动方案和技术指标。结果证实，目前对构建全面的网络威胁情报本体的重视程度很低，现有工作的设计不够完善、互不兼容、存在歧义，且缺乏用于推理的恰当语义和公理。
英文摘要：
Cyber threat intelligence is the provision of evidence-based knowledge about existing or emerging threats. Benefits from threat intelligence include increased situational awareness, efficiency in security operations, and improved prevention, detection, and response capabilities. To process, correlate, and analyze vast amounts of threat information and data and derive intelligence that can be shared and consumed in meaningful times, it is required to utilize structured, machine-readable formats that incorporate the industry-required expressivity while at the same time being unambiguous. To a large extent, this is achieved with technologies like ontologies, schemas, and taxonomies. This research evaluates the coverage and high-level conceptual expressivity of cyber-threat-intelligence-relevant ontologies, sharing standards, and taxonomies pertaining to the who, what, why, where, when, and how elements of threats and attacks in addition to courses of action and technical indicators. The results confirm that little emphasis has been given to developing a comprehensive cyber threat intelligence ontology, with existing efforts being not thoroughly designed, non-interoperable, ambiguous, and lacking proper semantics and axioms for reasoning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
