# A Methodology to Evaluate Standards and Platforms within Cyber Threat Intelligence
## 3 Proposed Evaluation Methodology
### Evaluation Criteria
#### 3.2.1 Data Model Architecture  
In terms of architecture, to define the applicability in different use cases, four main entities were used to represent the _cyber_ threat intelligence scenario in a generic manner. In this approach, those entities indirectly derives from the 5W3H (what, who, why, when, where, how, how much and how long) method, which aims to answer the questions presented in Table 1. This is a generic method, applied in different areas, with the main objective of clarifying a topic in its completeness. The method was used for representation because, since it consists of an effective mechanism to obtain the complete description of a topic, it facilitates any necessary decision making about the subject addressed. Thus, within the threat intelligence ecosystem, the method can be used not only to identify and characterize threats and incidents. When correlating data from indicators and the information generated with the questions raised by the 5W3W method, it is simpler to implement effective mechanisms for detecting and mitigating threats. First, _what_ is used to directly define the topic that is being analyzed. In the cyber threat intelligence context, it can be usually summarized by the terms threats and incidents, which cover since evidences and probable attacks to real malicious occurrences. For an adequate definition, these terms should be accompanied by other information like the type of threat or incident and the context it is inserted. After defined, the topic can be characterized using _where_, _when_ and _how_. _Where_ can refer to the geographic location it started and parts of the path it took until it reaches the target. _When_ provides a time frame, specifying date and time of occurrence. _How_ is used to describe the way the threat or \begin{table}
\begin{tabular}{c l} \hline \hline
**Question** & **Description** \\ \hline What & Directly describes the topic being addressed \\ \hline Where & Specifies geographic references about the topic \\ \hline When & Specifies relevant time frames to the topic like date and time \\ \hline Who & Associates the topic with an entity capable of executing it \\ \hline Why & Describes possible motivations for the occurrence of the topic \\ \hline How & Describes the main characteristics and mechanisms of the topic \\ \hline How much & Refers to the costs and impacts generated by the topic \\ \hline How long & Description of the topic’s effectiveness in terms of time \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Description of the 5W3H method. incident took place and the tactics and techniques applied. It is important to say that the granularity of the information describing these entities is variable depending on the use case. Another essential point is to associate the threat or incident with its threat actor, which can be described by _who_ and _why_. _Who_ can be an organization or an individual that is responsible for the threat or incident. _Why_ is important to better characterize the threat actor by understanding the motivations behind the event. Some detailed characteristics of the threat or incident can be discovered using _how long_ and _how much_. _How long_ indicates the effective durability of the threat or incident if no action is taken. _How much_ is used to measure the intensity of the attack and analyze its damage capacity and defense cost. The information gathered with the _how long_ and _how much_ statements, together with all the characteristics described with the _how_ statement, can also be used to analyze and measure the capacity of action of the threat actor. Further, using the correlation between all the information raised about the threat, incident or threat actor using the 5W3H method, it is very likely that actionable intelligence was produced and it is possible to use it to define mechanisms for defense and specify some courses of action. Based on the exposed, the four main entities used to delineate a holistic representation of the cyber threat intelligence scenario are threat, incident, threat actor and defense.