# A Methodology to Evaluate Standards and Platforms within Cyber Threat Intelligence
## 5 Platforms Evaluation Results  
Results regarding the selection and evaluation of the platforms are presented and explained. From the searching process of TI platforms, a massive number of projects were identified. The most relevant results count more than 30 different platforms. In References [16; 55] a significative number of platforms were analyzed, totalizing 30 and 23, respectively. In Reference [20], a smaller number of platforms are mentioned and considered consolidated in the area.  
In more specific studies [19; 36; 56] only open source and popular platforms are evaluated. Another work [14] proposed a framework to evaluate some platforms and described the results from three of them. Some reliable and relevant sources also mentioned emerging platforms that have great potential [57; 58]. A considerable part of the platforms presented was excluded according to the exclusion method applied that considered the adherence to the intelligence flow. Thereby, a total of 16 platforms were ranked in terms of popularity and the results are presented in Table 6.  
\begin{table}
\begin{tabular}{c c c c} \hline
**Platform** & **Popularity** & **License Model** & **References** \\ \hline \hline Accenture CIP & + & Closed source & [16; 55] \\ \hline \hline Anomalal STAXX & +++ & Closed source with free version & [16; 20; 55] \\ \hline \hline MISP & ++++ & Open Source (GNU General Public License) & [13; 14; 16; 19; 20; 36; 55] \\ \hline CRIPs & +++ & Open Source (GNU General Public License) & [16; 19; 36] \\ \hline OpenCTI & +++ & Open Source (Apache License) & [9; 57; 58] \\ \hline Facebook TE (beta) & ++ & Open Source (BSD License) & [16; 20] \\ \hline \hline Falcon Intelligence & ++ & Closed source & [16] \\ \hline \hline MANITS & ++ & Open Source (GNU General Public License) & [16; 19] \\ \hline McAfee TIE & + & Closed source & [16; 55] \\ \hline Microsoft Interflow & + & Closed source & [16; 55] \\ \hline Soltra Edge & +++ & Closed source & [16; 19; 20; 55] \\ \hline ThreatQ & ++ & Closed source & [14; 16; 20; 55] \\ \hline ThreatConnect & ++ & Closed source & [16; 20; 55] \\ \hline EkeletiQ & + & Closed source & [16; 20; 55] \\ \hline IBM X-Force & ++ & Closed source & [16; 20; 55] \\ \hline CIF & ++ & Open Source (GNU General Public License) & [13; 16; 19; 36] \\ \hline \hline \end{tabular} Legend: very high (++++) high (+++) medium (++) low (+).  
\end{table}
Table 6: TI platforms described by popularity and license model.  
\begin{table}
\begin{tabular}{c c c c} \hline
**STIXv2**[46; 47] \& TAXII [52] & **IODEFv2**[52] \& RID [53] & **OpenIOC**[54] \\ \hline \hline \multicolumn{4}{c}{**Holistic Architecture**} \\ \hline \hline Threat & ++++ & ++++ & ++++ \\ \hline Incident & ++++ & ++++ & +++ \\ \hline Threat Actor & ++++ & ++++ & ++ \\ \hline Defense & ++++ & ++ & + \\ \hline \hline \multicolumn{4}{c}{**Intelligence Process**} \\ \hline \hline Common formatting & ++++ & ++++ & ++++ \\ \hline Structured format & ++++ & ++++ & ++++ \\ \hline Low overhead & ++ & ++ & +++ \\ \hline Machine readability & ++++ & ++++ & ++++ \\ \hline Unambiguous data model & ++++ & ++++ & ++++ \\ \hline Relationship mechanisms & ++++ & ++ & ++++ \\ \hline Interoperability & ++++ & ++ & ++++ \\ \hline Transport mechanism & ++++ & ++++ & + \\ \hline Practical application & ++++ & ++ & ++ \\ \hline \hline \end{tabular} Legend: very high (++++) high (+++) medium (++) low (+).  
\end{table}
Table 5: Evaluation of TI standards.  
Considering that the scope of this work is restricted to open source or free platforms, about half of the platforms were excluded. Next, the popularity criteria was applied to select the platforms.