## 3 Sharing ML Models as Cyber Threat Intelligence
### Sharing IoCs in MISP  
In MISP, an attack is represented as an event where the IoCs (e.g., the IP address and the email address of the adversary) are structured as the attributes of the event. MISP can then correlate threat events thanks to the similarity of these attributes. To assist the security analyst, MISP can represent these correlations as a graph of interconnected events.  
Attributes are grouped into 16 categories (cfr. [[https://www.circl.lu/doc/misp/categories-and-types/](https://www.circl.lu/doc/misp/categories-and-types/)]([https://www.circl.lu/doc/misp/categories-and-types/](https://www.circl.lu/doc/misp/categories-and-types/)), accessed on 24 February 2021) which are again subdivided into more than 180 types. An example of an event with two attributes in MISP JSON format is shown in Listing 1.  
```
1{
2\"event\":{
3\"uid\":1\"1 fe1 rb10-07e0-448b-99e6-3856c6d7d06c\",
4\"dare\":220-12-15\"
5\"threat_level.id\":1\":1\"
6\"info\":This is a dummy event\",
7\"published\":true,
8\"analysis\":\":\"
9\"distribution\":\"0\",
10\"Attribute\":1
11\"type\":\"ip-src\",
13\"category\":\"Network activity\",
14\"to_ids\":true,
15\"distribution\":\"5\",
16\"connection\":\"This is a 1 st dummy attribute\",
17\"value\":\"1.2.3.4\"
18].
19{
20\"type\":\"renal\".
21\"category\":\"Network activity\",
22\"to_ids\":false,
23\"distribution\":\"5,
24\"comment\":\"This is a 2 nd dummy attribute\",
25\"value\":\"attackermail.com\"
26}
27]]
28].
29]
```  
**Listing 1** Example of a MISP (Malware Information Sharing Platform) threat event with two attributes in the JSON format.  
The sharing range of IoCs is declared in the 'distribution' field where the numeric value indicates whether an event or an individual attribute is shared (0) with members of the same organization as the owner of the event, (1) within the community (organizations on the same MISP server and organizations hosting MISP servers synchronizing with the main server), (2) with connected communities (including all organizations on synchronizing MISP servers and organizations hosting MISP servers two hops away connected to the aforementioned servers), (3) with all communities (events can propagate freely between servers), and (4) with local and/or cross-instance organizationsdefined in a sharing group. Additionally, attributes can (5) inherit the 'distribution' setting from the parent event. The 'to_ids' field represents whether the attribute is meant to be used as a pattern for detection in automated processes (e.g., in a NIDS solution like Snort or Suricata) or rather for correlation analysis.  
The example in Listing 2 illustrates how the published MISP event and attributes marked as IDS Signature are exported to a Suricata ruleset. It triggers an alert whenever a network packet is sent from the 1.2.3.4 IP address to the internal network.  
```
1#MISPexportofIDSrules-optimizedfor
2#
3#TheseNIDSrulescontainsomevariablesthatneedtoexistinyourconfiguration.
4#Makesureyouhaveset:
5#
6#SHOME.NET-Yourinternalnetworkrange
7#SEVERTRNAL.NET-Thenetworkconsideredasoutside
8#SSMPMP_SERVERS-AllyourinternalSHTPservers
9#SHTP_FORTS-TheportsusedtocontainHTTPtraffic(notrequiredwithsuricataexport)
10
11 alertip1.2.3.4 any->SHOME.NETany(msg:\"MISPel[]IncomingFromIP:1.2.3.4\";classtype:trojan-activity;
12 sid:4000011;rev:1;priority:1;reference:url,https://localhost:8443/events/view/1;)
```  
Listing 2: Exporting MISP threat event to Suricata ruleset.