CLEVER: Crafting Intelligent MISP for Cyber Threat Intelligence

Cyber Threat Intelligence (CTI) is crucial for modern cybersecurity because it provides the knowledge and insights needed to defend against a wide range of cyber threats. However, there are issues associated with incomplete and inconsistent CTI data that can lead to inaccurate threat assessments, increasing the risk of both false alarms and undetected threats. This paper introduces CLEVER, an extended version of the Malware Information Sharing Platform (MISP) platform that includes machine learning (ML) models to support the management and processing of CTI data. The models are designed to address specific challenges such as (i) prioritizing and ranking Indicators of Compromise (IoCs) based on severity and potential impact, (ii) classifying IoCs by attack type or threat, and (iii) aggregating similar IoCs into clusters. The effectiveness of the ML models employed in CLEVER has been thoroughly tested on three public CTI datasets, and the results provide encouraging outcomes in enhancing CTI management and analysis.