Documents
Presentation Slides
Presentation Slides
QoI: Assessing Participation in Threat Information Sharing
- Citation Author(s):
- Submitted by:
- Jeman Park
- Last updated:
- 19 April 2018 - 1:10pm
- Document Type:
- Presentation Slides
- Document Year:
- 2018
- Event:
- Presenters:
- Jeman Park
- Paper Code:
- SS-L14.4
- Categories:
- Log in to post comments
We introduce the notion of Quality of Indicator (QoI) to assess the level of contribution by participants in threat intelligence sharing. We exemplify QoI by metrics of the correctness, relevance, utility, and uniqueness of indicators. We build a system that extrapolates the metrics using a machine learning process over a reference set of indicators. We compared these results against a model that only considers the volume of information as a metric for contribution, and unveiled various observations, including the ability to spot low-quality contributions that are synonymous to free-riding.