# Quality Dimensions for Automatic Assessment of Structured Cyber Threat Intelligence Data
## 3 Proposed Automated CTI Data Quality Assessment Method
### Definition of the Formulae for the Dimensions
\begin{array}{l}1,\;if\;value\;of\;o(p_{i})\;is\;valid\\ 0,\;in\;the\;opposite\;case\end{array} \right. \tag{10}\]  
\[AC(o_{i})=\frac{\sum_{i=1,no}AC(p_{i})}{n} \tag{11}\]  
\[AC(v_{t})=\frac{\sum_{o_{i}\in O}AC(o_{i})}{|O|} \tag{12}\]  
For example, if the _Description_ property is either empty or absent, it is not filled in correctly. The Bundle object is not part of the SDOs in STIX. However, the Bundle object is recommended to be used when using CTI to join the provided objects into a single unit. Therefore, if the Bundle object is not present in the CTI, syntactic accuracy is lower by 10%. _Reliability_ (_RB_). Reliability means the reputation of data. The reliability dimension is less popular in research studies than the accuracy dimension. Moreover, the term \"reliability\" is used just in [26] from all the reviewed works. The terms \"credibility\" [16; 32], \"believability\" [15; 24], \"source authority\" [19], and \"veracity\" [33] were used to define the reliability of CTI in other works. The experts [38] were saying that the most important dimensions of CTI are timeliness and credibility. The importance of the timeliness dimension is recognized by the absolute majority of research studies considered in our review. However, the popularity of the reliability dimension is half as popular as the timeliness dimension. We presume that the main reason for the lesser popularity of the reliability dimension is that the reliability of CTI cannot be measured objectively [24]. Nevertheless, we and the other authors [27; 28; 39] recognize the importance of the reliability of CTI. The reliability of CTI can be expressed indirectly by the reputation of CTI providers [27; 28; 39]. The reputation of the provider is only a guarantee of the reliability of CTI. Consequently, our CTI system will accumulate the reputation of the provider and use it in the quality assessment of CTI. _Relevance_ (_RL_). Relevance must express the extent to which data are applicable and helpful for the specific user. This is an important aspect of the assessment, since this dimension shows the usefulness of CTI for the particular user. An incident which happens in a specific sector of an industry is likely to be less relevant to other industry sectors. Therefore, in contrast to all other dimensions, this dimension depends on the particular user. This dimension must be evaluated dynamically. The value of this dimension depends on the \(PV_{C}\) properties possessed by the consumer, on the \(PV_{P}\) properties possessed by the provider, and on the \(PV_{O}\) properties of CTI. The properties of the consumer must coincide with the properties of the provider and the properties of CTI. Two cases are defined for the relevance dimension: basic case (Equation (13)) and augmentation of the value of the basic case if a sighting object is present (Equation (14)). The coefficients to join the two cases are presented in Equation (15). The presence of sighting objects is not a common case; therefore, 10% only are assigned the \(w_{2}\) coefficient. Basic case:  
\[RL_{basic}(v_{t})=\frac{\left|PV_{c}\cap\left(PV_{p}\cup PV_{O}\right)\right| }{\left|\left(PV_{p}\cup PV_{O}\right)\right|} \tag{13}\]  
_Sighting object case._ Sighting objects are used to express a belief that something in CTI was seen. This fosters an assessment that frequently seen objects might indicate their versatility and applicability to different sectors of industry. Therefore, the value of relevance must be increased if a sighting object is present. \[RL(v_{t})=w_{1}\times RL_{basic}(v_{t})+w_{2}\times\frac{\left|SO\right|}{ \left|SDO\right|}\text{, }w_{1}\text{ and }w_{2}\text{are weight coefficients} \tag{14}\]  
\[w_{1}=90\%,\text{ \ }w_{2}=10\% \tag{15}\]  
_Reputation_ (_provenance_ (_provider_)) (_RP_). The reputation of a user is accumulated in the system. To make the value fractional the dimension sets the value of reputation of the current provider in relation to the maximal available reputation value of the user in the system (Equation (16)).