# Quality Dimensions for Automatic Assessment of Structured Cyber Threat Intelligence Data
## 3 Proposed Automated CTI Data Quality Assessment Method
### Definition of the Formulae for the Dimensions
\[RP(p)=\frac{RP_{u}}{max(RP_{u}\in U)} \tag{16}\]  
_Similarity/exclusivity_ (_SM_). The reported event is more valuable if the event was not reported before by other producers, since the report provides new observed information. To compare the similarity of two CTIs \(v_{i}\), \(v_{k}\), we use a weighted similarity function, \(SM(v_{i},v_{k})\), which can be expressed as follows (Equation (17)):  
the dimension of the appropriate amount of data [24]. The definition of the dimension of the amount data provided by [PERSON] et al. [24] is more suitable for the definition of completeness. The report, which contains homogeneous SDO types and very few relationships, does not seem to be very helpful. To distinguish between a report with homogeneous object types and one with more different object types we apply the dimension of amount of data. This is achieved by counting the instances of the different SDO, SCO, and SRO types within a report. The dimension sets the number of existing different SDO, SCO, and SRO types in a given STIX report in relation to the total number of existing objects for this report (Equation (22)). \[AD(v_{t})=\frac{|\{\textit{Types }\in O\}|}{|O|} \tag{22}\]  
_Actionability (AT)_. According to the European Union Agency for Cybersecurity, CTI's actionability is related to timeliness, accuracy, completeness, ingestibility, and relevance to the recipient [41]. We suppose that the ingestibility dimension, which was not found in the research works, can be replaced by the understandability dimension. Experts [26] were suggesting inclusion of the actionability dimension in CTI quality assessment. However, the actionability becomes less critical on a tactical or strategic level [42]. Therefore, to accommodate different requirements of CTI categories, we suggest calculating two values of actionability, for a technical level and for a tactical level. The formula of actionability for both levels is the same (Equation (23)). The difference is in the values of the weight coefficients. A trade-off is needed between timeliness and both completeness and accuracy [38; 41; 43]. For the technical level, priority is afforded to timeliness versus completeness and accuracy (Equation (24)). In order for CTI data to be useful, they must be relevant. So, the highest value is assigned to the relevance of the information. Next, the CTI data must be delivered in a timely manner. Information about security incidents older than several hours can be considered irrelevant due to rapid changes in threat characteristics. As a consequence, 28% are assigned to timeliness and 28% are divided in two for completeness and accuracy. For the tactical level, priority is assigned to completeness and accuracy versus timeliness (Equation (25)). \[AT=w_{TM}\times TM+w_{cm}\times CM+w_{AC}\times AC+w_{RL}\times RL+w_{UN}\times UN \tag{23}\]  
\[w_{TM}=28\%,\ \ w_{CM}=14\%,\ \ w_{AC}=14\%,\ \ w_{RL}=38\%,\ \ \ \ \ w_{UN}=6\% \tag{24}\]  
\[w_{TM}=12\%,\ \ w_{CM}=22\%,\ \ w_{AC}=22\%,\ \ w_{RL}=38\%,\ \ \ \ \ w_{UN}=6\% \tag{25}\]  
_Concise representation (CR)_. This dimension is devoted to the measurement of similarity within the report (Equation (26)). Despite the fact that this dimension was not popular among researchers, the dimension of concise representation is important, since it considers the inner consistency of the report. The application of methods for semantic similarity is needed. The _Simhash_ algorithm is one way to approach this problem. An object \(o_{1}\) is considered unique in a set of objects \(O\) if its _similarity_ to any other object \(o_{2}\in O\) is below a threshold \(t_{CR}\) (Equation (27)). In the course of the experimentation, the value of \(t_{CR}\) (Equation (27)) was chosen to be equal to 0.3. The value of concise representation for the report is calculated according to Equation (28). The lower the value of concise representation, the better the report is presented. Therefore, we apply negation (subtraction) in Equation (28). \[AC(v_{t})=\frac{\sum_{o_{i}\in O}AC(o_{i})}{|O|} \tag{12}\]0\[CR(o_{i})=\left\{