Toward Automated Cyber Defense with Secure Sharing of Structured Cyber Threat Intelligence

Cyber Threat sharing helps with defending against cyber attacks in a timely manner. Many frameworks have been proposed for CTI sharing such as Structured Threat Information Expression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII). However, CTI sharing in a controlled and automated manner is critical. In this paper, we demonstrate Relationship Based Access Control (ReBAC) as an appropriate model for CTI sharing. We also develop an approach for automated threat detection, generation and sharing of structured CTI and taking course of actions to mitigate cyber threats. Finally, we implement an Automated Cyber Defense System in a cloud based environment.