# A Methodology to Evaluate Standards and Platforms within Cyber Threat Intelligence
## 1 Introduction  
Over the last years, with the relevant increase in computational power and communication technologies, a new trend of diverse network devices and different technological systems emerged quickly and they are delivering a wider range of exploitable vulnerabilities [1]. Consequently, the number of cyber attacks and their costs have also increased [2]. Also, these new cyber exploits are more complex and targeted [3], generating sophisticated and improved attacks. Such facts indicate that the cybersecurity spectrum is fundamentally changing and becoming increasingly challenging. The progressive evolution of the current cyber attacks arises from a cascade of new sophisticated applications that are being developed by attackers and security experts, and the more complex a system gets, the more insecure it becomes [4]. Another reason for the improvement of the attacks is the fact that these are being better planned and applied in a more specific way [5], which makes them more complex. Most of them are developed to not be detected by first level defenses, being ableto persist on the system [6]. Besides that, these new threats are in a constant process of modification and improvement, making their detection and defense more complicated [5]. The advances and modifications in the cyber attack ecosystem have encouraged changes in the traditional defense model and the search for more efficient and proactive methods [1; 6]. Considering the presented scenario, the idea of Cyber Threat Intelligence (CTI) has been rapidly popularizing and is often posed as a new solution for applying effective security to enterprise [7]. Any valuable information that can be used to identify, characterize or assist in the response to cyber threats is commonly referred to as cyber threat information and the analysis of this type of information can produce intelligence to inform the user about threats to their system [8]. Within the limitations of the CTI approach, there is the heterogeneity of the data involved [9; 10], and the massive amount of data for collection [11]. So, in order to effectively use the cyber threat information, mechanisms capable of consuming, analyzing, evaluating and classifying the information are highly needed [12]. Thus, new automated systems with the ability to consume a vast amount of data, provide sophisticated defense capabilities and respond to incidents in real-time are being developed and commonly referred to as Threat Intelligence (TI) platforms [13; 14]. These platforms should include automatic processes of data transformation and intelligence production to ensure a more efficient, proactive and timely defense model [15]. Besides, due to the heterogeneity of the data inserted in the CTI context, considerable efforts have been made in order to standardize the data [13] and make it compatible among different systems[12]. The interoperability of the data is important to facilitate the automatic gathering and analysis of the data and the sharing of cyber threat intelligence [9]. However, since the field is growing rapidly [15], today CTI concept lacks a consistent definition [11; 16] and a heterogeneous market of CTI platforms emerged. Diverse systems and tools, which accomplish different goals, are implemented as threat intelligence platforms [14]. Besides, capabilities, performance levels, and applicable use cases vary greatly among platforms an this is not always transparent to the user [14]. Therefore, it is notorious a research gap involving the analysis of CTI systems and tools available, in order to describe in detail their features and evaluate the quality of the information that can be produced and disseminated with them. The goal of this research is to provide a methodology for the evaluation of the standards and platforms of Cyber Threat Intelligence.