## 2 Background and Related Works
### Cyber Threat Intelligence  
Cyber threats have become a significant, enduring threat to nations. Targeted cyberattacks disrupt critical services, causing severe complications on many levels. Breach investigations prove that victims have been compromised long before initial attack detection [1]. Cyber threat intelligence provides the necessary knowledge and means to protect, detect, and respond to cyber threats. It provides the means to change organizations' cybersecurity behavior from reactive to proactive [33]. It strives to balance the knowledge asymmetry between attackers and defenders by gathering and analyzing information about cyber adversaries. Multiple models and platforms are emerging to produce and disseminate cyber threat intelligence information. The cyber Kill Chain [34] is established to identify and model adversaries' cyberattacks. The Diamond model [35] is an intrusion analysis approach used by information security experts to track cyber threats in each attack attempt. It underlines four components: adversary, capability, infrastructure, and victim. The Pyramid of Pain [36] classifies the types of indicators to identify threat actors. This model emphasizes focusing on threat characteristics that are difficult to modify to detect cyberattacks. The MITRE ATT&CK framework [37] is a matrix of tactics, techniques, procedures, and sub-procedures used to model adversaries' behavior, classify attacks, and assess risks. STIX [38] is a standard language for expressing cyber threat intelligence data and their corresponding observables. TAXII [39] is a standard that defines the format to share threat-related information via services and message exchanges. OpenCTI [40] is an open-source threat intelligence platform that manages threat intelligence data, gathers real-time threat intelligence information, and exchanges intelligence information between organizations. MISP [41] is an open-source platform for collecting, analyzing, and exchanging cyber threat intelligence indicators. The main process phases of producing cyber threat intelligence information are [42]:  
1. Planning and direction: In this foundational phase, the definition of the overall objective of the threat intelligence process not only sets the stage for subsequent activities but also establishes a strategic framework essential for informed decision-making. 2. Collection: This data acquisition phase, characterized by the comprehensive gathering of raw data from diverse sources such as network traffic, system logs, clear and dark web forums, and more, exemplifies a diverse approach to intelligence gathering, vital for constructing a threat landscape. 3. Processing and exploitation: Within this transformative phase, the intricate conversion of raw data into actionable information represents a critical juncture, emphasizing the importance of data refinement to unlock its true potential in subsequent analytical endeavors. 4. Analysis and production: In this pivotal phase, information is analyzed to evolve into intelligence that might be of the following types: 1. Strategic: This high-level intelligence, focusing on threats and their motives within the organization's threat landscape, is for strategic decision-making, providing crucial insights for management executives and organizational board members. 2. Tactical: Offering granular insights into threat actors' tactics, techniques, and procedures, this intelligence category is an indispensable tool for architects and system administrators to enhance the organization's defenses against evolving attack vectors. 3. Operational: This intelligence category, revealing specific details about incoming attacks, motives, timings, and nature, empowers security managers and defenders with actionable information to proactively safeguard the organization's assets. 4.