# Quality Dimensions for Automatic Assessment of Structured Cyber Threat Intelligence Data
## 3 Proposed Automated CTI Data Quality Assessment Method
### Definition of the Formulae for the Dimensions
Meanwhile, information regarding object types such as malware analysis, threat actors, and tools might not change over time. For such object types, statistical decline must be taken into account. \[TM_{statistical}(o_{i})=\left\{ \begin{array}{c}1,\textit{ if }\textit{modified}(o_{i})+\textit{ decline}(o_{i})\geq\textit{current time}\\ \textit{threshold}\times\frac{1}{\textit{modified}(o_{i})+\textit{ decline}(o_{i})-\textit{current time}},\textit{ in opposite case}\end{array} \right. \tag{3}\]  
_Completeness (CM)_. Definitions of the completeness dimension also vary, as do definitions of the timeliness dimension. Several authors [19; 24; 28] have used graph theory to establish the connectedness of SDOs in CTI. [PERSON] et al. [24] applied the obtained values of the connectedness of SDOs to define the amount of data dimension. However, we suppose that such an approach is also directly suitable to define the completeness dimension (Equation (4)). Moreover, such an approach, which was expressed indirectly, was used by [PERSON] et al. [28]. \[CMI(v_{t})=\frac{|SRO\in O|}{\frac{|SDO\in O|\times(|SDO\in O|-1)}{2}} \tag{4}\]  
The completeness dimension sets the number of existing SROs in a given CTI in relation to the maximum possible number of SROs, as defined by the number of SDOs for this CTI. However, such a definition sets quite low values for the completeness dimension, since not all the SDOs can be grouped together. We have noticed that the extensiveness dimension used by several authors [23; 25] and the completeness dimension used by [PERSON] et al. [24] are defined in the same way. The extensiveness dimension according to this definition counts the number of filled in optional properties. The extensiveness dimension is defined at three levels: optional property of the object (Equation (5)); optional properties of the object (Equation (6)); and all the objects of report (Equation (7)). \[EX(p_{i})=\left\{ \begin{array}{l}1,\;if\;o(p_{i})\;is\;present\\ 0,\;in\;the\;opposite\;case\end{array} \right. \tag{5}\]  
\[EX(o_{i})=\frac{\sum_{i=1,no}EX(p_{i})}{no} \tag{6}\]  
\[EX(v_{t})=\frac{\sum_{o\in O}EX(o_{i})}{|O|} \tag{7}\]  
We decided to join the formulae for \(CMI(v_{t})\) and \(EX(v_{t})\) into a single formula of completeness (Equation (8)). The values of coefficients are defined in Equation (9). The CTI reports describing only indicators of compromise do not contain SROs. Such reports are usually submitted in a prompt way, and they are valuable for use at the technical level. However, the first term of Equation (8) for such reports is equal to 0. To assess the completeness of such reports as highly as possible, the value of coefficient \(w_{1}\) is assigned as 30% and the value of coefficient \(w_{2}\) is assigned as 70%. \[CM(v_{t})=w_{1}\times CMI(v_{t})+w_{2}\times EX(v_{t}),\;w_{1}\;and\;w_{2}\;are\; weight\;coefficients \tag{8}\]  
\[w_{1}=30\%,\;w_{2}=70\% \tag{9}\]  
Accuracy (syntactic) (AC). The accuracy dimension according to our investigation was less popular than the dimensions of timeliness and completeness. Consequently, it was considered in fewer research studies and fewer definitions can be found. For accuracy, we chose the following definition: \"The degree to which data has attributes that correctly represent the true value of the intended attribute of a concept or event\" [16]. Having in mind this definition, we base the accuracy definition on the syntactic accuracy of the JSON schema. The JSON schemas for all object types with values for properties are defined by the OASIS consortium [14]. This enables objects to be automatically validated against those schemas to assess syntactic accuracy. The accuracy dimension is defined at three levels: for every property of the object (Equation (10)), for the properties of the object (Equation (11)), and for all objects in the report (Equation (12)). The extensiveness dimension was defined in a similar way. However, in this case, all the properties and their values are considered against the JSON schema standard of a specific object. \[AC(p_{i})=\left\{