Structured modeling of cyber threat intelligence data: methodological foundations and practical applicability

Abstract

This article examines structured modeling of cyber threat intelligence data as a prerequisite for its accumulation, correlation, analysis, and further use. It argues that storing individual indicators in spreadsheets, ticketing systems, or standalone reports without formalized relationships to events, infrastructure, software tools used in malicious cyber activity, campaigns, and analytical conclusions limits the practical value of the data. A distinction is made between a platform as an operational tool for working with information and a data representation model as a formal description of entities, their properties, and relationships. Based on a structural and functional analysis of official documentation, the study traces the development of formalized object representation from CRITs/CybOX to STIX 2.1 and separately examines the hypergraph approach of Synapse. Common subject-matter categories are identified to assess how these approaches represent observable technical objects, initial reports, attacks and confirmed compromises, campaigns, infrastructure, software tools, tactics, techniques, procedures, targets, and analytical assertions. The approaches are shown not to be interchangeable: CRITs/CybOX focuses on the practical accumulation of objects and derived attributes, STIX 2.1 on standardized representation and exchange, and Synapse on graph-based integration of factual, event-related, contextual, and analytical layers. The practical contribution consists in providing methodological guidance for moving from fragmented storage of indicators to systematic work with interconnected cyber threat data.