# Analysis of Cyber-Intelligence Frameworks for AI Data Processing
## 5 Results
According to the analysis shown in Table 3, it can be concluded that the Mitre Att&ck framework is the most suitable for processing large-scale data for cyber-intelligence purposes based on the following points of interest:  
While it is true that the Diamond Model presents good results in terms of maturity, ease of use, visualisation--with its characteristic diamond that helps to understand the information in a simple way--and even granularity, with the presence of detailed features and meta-features, this model has significant shortcomings in variables that are especially relevant for the application of AI, such as the lack of parameterisation capacity, low scalability, reduced flexibility, and the absence of datasets. Cyberkill Chain stands out for its maturity, popularity--it is widely known in the community--and ability to easily integrate with other systems, but like the Diamond Model, it does not possess the characteristics necessary for optimal AI implementation, such as flexibility, parameterisation, scalability, and the existence of datasets. Mitre Att&ck has flexibility, has its own taxonomy, is referenced in datasets, has proprietary software, is regularly updated, and allows for parameterisation and granularity. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Diamond MODEL** & **CYBERKILL CHAIN** & **MITRE ATT\&CK** \\ \hline MATURITY & YES & YES & YES \\ FLEXIBILITY & NO & NO & YES \\ POPULARITY & NO & YES & YES \\ OWN TAXONOMY & NO & NO & YES \\ DATASETS & NO & NO & YES \\ PROPRIETARY SOFTWARE & NO & NO & YES \\ ADAPTATION TO DIFFERENT ATTACKS & YES & NO & YES \\ UPDATE & NO & NO & YES \\ EASE OF USE & YES & NO & NO \\ PARAMETTERISATION & NO & NO & YES \\ GRANULARITY & YES & NO & YES \\ VISUALISATION & YES & YES & YES \\ EASY INTEGRATION WITH OTHER SYSTEMS & NO & YES & YES \\  & ACTIVE & ACTIVE & ACTIVE \\ ORIENTATION & ATTACKERS & ATTACKERS SOFTWARE \\ SCALABILITY & NO & NO & YES \\ INTEROPERABILITY & YES & YES & YES \\ PERFORMANCE & NO & NO & YES \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Analysis of the variables proposed in each of the models. These factors are essential for the implementation of AI, as the existence of structured data and the ability to adapt and customise the model and to have a high level of detail can facilitate the training of machine-learning algorithms. Furthermore, its ability to work successfully with datasets of variable volume and to share its knowledge with other tools are also appropriate for its combination with AI algorithms. However, other variables that may be of interest for an overall analysis of the power of the framework, such as popularity, maturity, and orientation, show that it outperforms the rest of the models by a wide margin. This idea is reinforced by the powerful dataset available on the MITRE website, which allows extensive data processing for machine-learning techniques, and the large community that develops new implementations on a regular basis. The use of the other two models analysed would require the creation of an ad hoc dataset without a homogeneous taxonomy as a starting point, which would make it extremely difficult to process the data to achieve the objectives of this research. Once the use of the Mitre Att&ck framework has been considered, the treatment that can be given to it in order to achieve the objectives of applying AI techniques is presented in Figure 5. It can be seen that the processing of the data collected from various sources (including the official MITRE repository) will allow the enrichment of each of the phases of the cyber-intelligence branches (CTI, IR, and VM) through the development of modules that will be seen later (generation of attack sequences and determination of attack authorship). All the information obtained must pass through the sieve of the chosen framework, i.e., Mitre Att&ck, so all the information must be converted into matrices or, where appropriate, vectors, to which the appropriate machine-learning techniques will be applied to obtain sequences or authorship.