Cyber threat intelligence framework using advanced malware forensics

The emerging risk of cybercrimes has compelled the organisations to shift their cyber defence strategy from reactive to proactive. In this paper, we have analysed various cyber threat intelligence models used by organizations with respect to their potential features, their methods of countermeasures, language specification of the threat indicators, whether they are open source or closed source, owning organization, acceptance parameters of security requirements and capability to measure the efficacy of cyber threat intelligence feeds. In addition to this, the paper also proposes a cyber-threat intelligence framework which overcome the problems found in existing models and frameworks. The proposed framework consists of three layers. Layer 1 consists of input layer data incoming from online and offline sources. Layer 2 pre-processes, classifies and filters the received data from layer 1. Layer 3, provides a detailed report using Elastic search–Logstash–Kibana (ELK) stack. The implementation result shows that the proposed model detects new generation malware effectively and fulfils all the security requirements as proposed in SANS Tools and Standards for Cyber Threat Intelligence Projects.