# Quality Dimensions for Automatic Assessment of Structured Cyber Threat Intelligence Data
## 1 Introduction  
Cyberattacks are part of our digital world. They disturb the normal functioning of the digital world. The effects of cyberattacks can cause great damage to participating organizations. To prevent cyberattacks, organizations share information available on the cyberattacks. A regular analysis of shared cyber threats must be performed since cyber threats are constantly evolving. The result of this analysis is called cyber threat intelligence (CTI). Sharing of CTI is very important because organizations cannot protect themselves in isolation from the changing landscape of cyber threats [1]. It also provides an opportunity for small organizations that do not have the resources to build an independent cyber threat intelligence program [2]. Analysis of shared CTI and proactive implementation of appropriate defensive measures can help to reduce the effects of cyberattacks. A large number of sources providing information on emerging cyber threats are available to CTI consumers. These sources vary from open and commercial data feeds to open-source cyber threat intelligence platforms, e.g., the Malware Information Sharing Platform (MISP) [3, 4, 5]. The variety of cyber threat intelligence sources continues to grow, but the quality of the provided data remains in question since CTI can be posted online by anyone. Several studies [6, 7, 8, 9] have highlighted that CTI data quality is one of the most common barriers to beneficial CTI exchange. The quality of the CTI data has a direct impact on the time required to respond to an incident [10]. Additionally, when the amount of available CTI increases, human analysts are not able to cope with it. There is a need to provide automatic assessments of CTI data quality. Rapid assessment of CTI data quality would help security experts to concentrate their attention on the CTI actually relevant to their interests. Appropriately structured data and machine-readable formats are necessary for automatic assessment of data. Structured Threat Information Expression (STIX) is the most well-known language used to represent CTI in such a format [11]. The STIX format was proposed by [PERSON] in 2012 [12]. Two versions of STIX are currently available. STIX 1 is represented in Extensible Markup language (XML), while STIX 2 is represented in JavaScript Object Notation (JSON). STIX 2 is easier to use and it is preferred by the producers of CTI [13]. The latest available version of STIX is STIX 2.1. STIX 2.1 includes 18 different STIX Domain Objects (SDOs) and two different STIX Relationship Objects (SROs), which are used to express relationships between different SDOs [14]. In comparison to STIX 2, STIX 2.1 is complemented by numerous STIX Cyber Observable Objects (SCOs), which were previously represented in a different standard language called Cyber Observable Expression (CybOX). SDOs classify each piece of CTI with specific attributes to be populated. SCOs provide more technical details, such as IP or URL addresses. The methodological approach employed in this article consists of a systematic literature review (SLR) followed by derivation of a set of literature-based quality dimensions. This work makes a contribution to measuring structured CTI data quality automatically. We present an approach to assessing relevant CTI data quality dimensions in a standardized data format. For this purpose, we perform a thorough literature review and derive relevant literature-based CTI data quality dimensions. The dimensions are then adjusted to the STIX 2.1 format as their automatic calculation relies on its structure. The distinguishable contributions of this paper are as follows:  
* Providing a systematic literature review of CTI data quality dimensions;
* Defining separate calculations of CTI data quality for technical and tactical levels of using CTI.