# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 1 Introduction  
Recent advances in cyber technologies (Internet of Things devices, cloud computing, mobile communication networks, etc.) have caused a paradigm shift in terms of services, business, and data management and transmission. All of these activities are migrating from the physical to the cyber-enabled world [1], where they are more accessible and their execution is more convenient for the general user. However, the security of our information in this cyber world (or cybersecurity) [2] should also be guaranteed, a task that is not always easy due to the complexity and sophistication of existing cyberattacks [3]. Cyber intelligence, that is, the technologies to acquire and analyse information to identify, track, and predict cyber capabilities, intentions, and activities to offer courses of action that enhance decision making [4], has become an indispensable branch of cybersecurity. The growing inability to mount an adequate response to attacks on information systems or operations has progressively directed the efforts of organisations towards the application of effective preventive measures that make it possible to avoid these attacks, or at least reduce them. This is conducted by implementing preparatory actions that increase resilience in the event of a cyberattack, resulting in a considerable increase in the importance of cyber intelligence in recent years [5]. Frameworks [6] of cyber intelligence can be characterised as schemes that allow for building and organising work more efficiently by providing common concepts, libraries, entities, and design patterns. In this sense, there are currently different frameworks that allow the structuring of information and its transformation into intelligence through a generally cyclical process. The aim of this work is to study the most relevant cyber-intelligence frameworks (specifically, Diamond Model, Cyberkill Chain, and Mtire Att&ck) using a real cyberattack example in order to determine the most suitable one for its combination with artificial intelligence (AI) tools. The final goal of this combinationis to successfully process and analyse large-scale information regarding cyberattacks, where information, in this context, is defined as in the International Organization of Standards (ISO) publication ISO/IEC 27000:2018: \"_any communication or representation of knowledge such as facts, data, events, things, processes, ideas, concepts, or opinions in any medium or form, including textual, numeral, graphic, cartographic, narrative, or audiovisual that, within a certain context, has a particular meaning_\" [7; 8]. This would allow for automating and exploiting the generated intelligence, allowing better protection of organisations and the detection of behavioural patterns to infer the actions of attackers or guide Law Enforcement Agencies in their fight against cybercrime. To the authors' knowledge, this is the first work that studies the three aforementioned frameworks by comparing them in a real application. In this sense, the novelties presented in this study are:  
* The provision of a detailed explanation and the current status of the state of the art of the three most relevant cyber-intelligence frameworks: Diamond Model, Cyberkill Chain, and Mitre Att&ck. * A case study of a real cyberattack for the three mentioned frameworks, emphasising the strengths, weaknesses, and best perspective offered by each one of them. * The definition of seventeen variables of interest in order to compare, among other characteristics, the efficacy, adaptability, and simplicity of the frameworks. * An analysis, based on these seventeen characteristics, of the most appropriate framework to combine with AI methods and, more specifically, machine-learning models. With this analysis, we also conclude the suitability of each framework depending on the specific situation and knowledge of interest.