# A Methodology to Evaluate Standards and Platforms within Cyber Threat Intelligence
## 7 Conclusions and Future Work  
As the cyber security landscape is fundamentally changing and a new threat scenario is emerging, the development and investigation of more efficient defense mechanisms became a necessary task. In this work, an overview of the cyber threat intelligence scenario and existing standards and platforms of the threat intelligence spectrum was provided. Based on academic literature and official sites and documentations, a group of relevant standards and platforms were defined. Considering the scope of the research, a selection strategy was proposed and applied in order to determine the most popular and efficient standards and platforms that are free or open source. Then, the standards and platforms selected were evaluated based on a developed methodology that contemplates architectural and processual criteria. From the evaluation of TI standards, we concluded that STIX is the most consolidated standard in the area, mainly due to its holistic approach, which makes it applicable in a wide range of scenarios, and compliance with fundamental requirements for a standard, such as interoperability and machine readability. Concerning TI platforms, MISP and OpenCTI were considered the most complete and flexible platforms. Although there are sophisticated solutions available, there is none that addresses the entire CTI process. To conclude, even though some great solutions are available in the market, it is still a challenge to find a thoroughly and absolute solution for a defense based on threat intelligence, since the platforms have divergent focuses and consequently correspond to only a few stages of the threat intelligence production flow. Future work will address assessing and validating the methodology and results here presented by executing an experimental evaluation and running tests using data sets of cyber threat data. New research will be focused on evaluating the completeness of the CTI process that can be supplied by available platforms in a practical way, using the benefits of interoperability among platforms. Along the same lines, research is to focus on the integration between complementary platforms in order to provide a more complete solution to manage and use threat intelligence. Finally, the delineation of a standardized definition for the CTI concept and process to assist in the design of new and optimized threat intelligence systems capable of establishing an efficient defense model is still a research gap. A.d.M.e.S. provided the analysis of standard and platforms existing and developed the evaluation criteria of the platforms and standards, J.J.C.G., R.d.O.A. and L.J.G.V. reviewed the evaluation criteria and proposed the tabulation format of the results. All authors have read and agreed to the published version of the manuscript. Authors of this research received the following funding: R.d.O.A. research work was supported in part by CNPq - Brazilian National Research Council, under Grant 465741/2014-2 INCT in Cybersecurity, in part by CAPES - Brazilian Higher Education Personnel Improvement Coordination, under Grant 23038.007604/2014-69 FORTE, in part by FAP-DF - Brazilian Federal District Research Support Foundation, under Grant Grant 0193.001366/2016 UIoT and Grant 0193.001365/2016 SSDDC, and in part by the Institutional Security Office of the Presidency of Brazil under Grant ABIN 002/2017. Authors would like to thank CNPq - Brazilian National Research Council (Grant 465741/2014-2 INCT in Cybersecurity), CAPES - Brazilian Higher Education Personnel Improvement Coordination (Grant 23038.007604/2014-69 FORTE), FAP-DF - Brazilian Federal District Research Support Foundation (Grant 0193.001366/2016 UIoT and Grant 0193.001365/2016 SSDDC), the Institutional Security Office of the Presidency of Brazil under (Grant ABIN 002/2017), Cyber Security Laboratory and GigaCandanga. The authors declare that there are no conflicts of interest. Abbreviations used throughout the manuscript: