Data Analytics and Cyber Threat Intelligence

How Automation, Analytics, and Machine Learning Improve and Accelerate Threat Analysis

The cybersecurity industry is increasingly producing enormous amounts of raw threat data. The sheer volume of information threat researchers must sift through makes it difficult to collect, analyze, and research that data in a timely manner. This in turn limits their ability to understand what data is valid and useful and whether threat artifacts will result in legitimate threat indicators.

In fact, it has been estimated that it would take 8,774 analysts working full time for a year to process the same amount of security event data that machine analytics can process in that same time frame.

Even as new threat intelligence tools and services emerge, relatively few enterprises are able to use those tools effectively due to the way threat intelligence and technology evolve. Threat actors are continually changing their methods of attack, and so the threat intelligence that supports detection must take new forms all the time to remain up-to-date.

In addition, cloud technology, 5G, edge computing, and the explosion of IoT devices is fundamentally changing the nature of threats and how defenders protect enterprises against them. Threat intelligence researchers are clearly facing a big data problem.

This paper considers why collecting and analyzing raw threat data today requires advanced analytics and machine learning (ML), in addition to human intelligence, to efficiently and accurately evaluate and interpret the volume of data that analysts must sift through on a daily basis.

It will also consider the stages of threat analysis that can be used to quickly turn raw threat data into curated threat intelligence that is fed into a variety of security technologies where it can be operationalized, such as a threat detection and response platforms. High quality, global threat intelligence is among the most powerful tools an organization has to defend against adversaries.