GQ02 Threat Intelligence for Cyber Security Decision Making

Cyber Security Decision Making is becoming a core aspect of cyber defense efforts. Advanced decision models and processes, such as the OODA Loop do heavily depend on the available information. The major task of this project is to develop and implement an approach to support the OBSERVE (Information collection) and ORIENT (Information analysis) phases of this type of model.

https://www.airuniversity.af.edu/Portals/10/AUPress/Books/B_0151_Boyd_Discourse_Winning_Losing.PDF

The topic can be split into two parts:

CL/GQ02a: Develop a support approach for the OBSERVE phase based on readily available sources, such as CVEs, NVD, and MISP. The import interface should ideally be based on the STIX/TAXII standard.

CL/GQ02b: Develop a support approach for the ORIENT phase exploring the potential of “emerging patterns” and “weak signals” in network defense. The goal is to monitor internal network traffic and map it on the information collected in the OBSERVE phase.

The following sources can serve as starting point for this project:

https://levelblue.com/blogs/security-essentials/incident-response-methodology-the-ooda-loop

https://levelblue.com/resource-center/ebook/insider-guide-to-incident-response/incident-response-process-and-procedures

https://cve.mitre.org/; https://nvd.nist.gov/; https://www.misp-project.org/

https://www.oasis-open.org/2021/06/23/stix-v2-1-and-taxii-v2-1-oasis-standards-are-published/

The suggested structure for the paper accompanying the project is:

1. Introduction/Topic description/Motivation
2. State of the art in literature and practice
3. Modelling method and approach used
4. Development of the model
5. Prototype (documentation, source code, etc.)
6. Test
7. Discussion of the results
8. Outlook and conclusion

Tags: Quirchmayr;