# Quality Dimensions for Automatic Assessment of Structured Cyber Threat Intelligence Data
## 3 Proposed Automated CTI Data Quality Assessment Method
### Definition of the Formulae for the Dimensions  
We now start a presentation and consideration of measurement formulae for selected dimensions in their popularity order as they were introduced in Table 1. We have used the following common notations in the measurement formulae of the dimensions:  
\(v_{t}\) denotes a \(t\)-th CTI report from the set \(V\);  
\(o_{i}\) denotes an \(i\)-th STIX object from the set \(O\);  
\(p_{i}\) denotes an \(i\)-th STIX object property from the set \(PV\). _Timeliness (TM)._ The importance of timeliness is recognized by the absolute majority of researchers; however, a measurement of timeliness differs in different research studies. A simple definition of timeliness is provided by [PERSON] and [PERSON] [15]. A definition of timeliness adapted to various situations is provided by [PERSON] et al. [24]. We will follow it and elaborate on it. Therefore, we will define several cases of the timeliness dimension adapted to specific situations. (a) _Basic case._ This is the time difference between the current time and creation time of the objects in the CTI provided by the feed. The timeliness of CTI \(\
u_{t}\) is calculated as follows (Equation (1)):  
\[TM_{basic}(v_{t})= \begin{cases}1,\ if\ current\ time-max(modified(o_{i}),\ o_{i}\in O)\leq\ threshold\\ threshold\times\frac{1}{current\ time-\max(modified(o_{i}),\ o_{i}\in O)},\ in\ opposite\ case\end{cases}  \tag{1}\]  
The value of threshold is applied to show how many days need to be considered for the CTI to be valuable. When the threshold is over, to slow down the decline of the dimension value, the obtained value is multiplied by the threshold value. The CTI consists of several objects that are created at the same time. During the creation of the objects, the properties _created_ and _modified_ have the same values. When new information concerning objects in CTI becomes available, the CTI can be updated. In such a case, a few objects are modified only. Consequently, the latest modification time of the object is chosen for the timeliness dimension. 2. _Indicator object case_. The timeliness dimension can be based on specific properties of objects. The indicator object has unique properties _valid_from_ and _valid_until_ available only in this object. The value of property _valid_from_ usually repeats the value of property _created_. However, the value of property _valid_until_, if it is available (since it is optional), defines the time till this indicator is valid. So, to know the time till the indicator is valid is very important. If this value is available, it must be used in the calculation of the timeliness dimension (Equation (2)). The _valid_until_ property is usually defined for an indicator with the pattern \"ipv4-addr:value\". The threshold is applied for the indicator case, as well. The value of timeliness declines very quickly if the threshold is not applied. \[TM_{indicator}(o_{i})=\left\{ \begin{array}{c}\textit{threshold}\times\frac{1}{ \textit{valid}_{\textit{until}(o_{i})}-\textit{current time}},\textit{ if }\textit{valid}_{\textit{until}(o_{i})}>\textit{current time}\\ 0,\textit{ in opposite case}\end{array} \right.\] (2)  
If relationship objects are defined, the indicator object can be related to several types of other objects. These types are as follows: _attack-pattern_, _campaign_, _infrastructure_, _intrusion-set_, _malware_, _threat-actor_, _tool_, _course-of-action_, _grouping_. In this case, the timeliness of the objects must be corrected according to the related indicator object. 3. _Statistical data case_. When statistical data about the decline of timeliness for specific CTI objects are available, the timeliness dimension must be adapted (Equation (3)). We know that the decline of certain CTI objects is higher than for others. File hashes used in the indicator object will likely have unchanged values, as malware binaries are often subject to slight modification, resulting in changed hash values.