QOI: Assessing Participation in Threat Information Sharing
Jemon Park, Hisham Alasmary, Omar Alibrahim, Charlies Kamhoua, Kevin Kwiat, Laurent Njilla, Aziz Mohaisen · 2018
We introduce the notion of Quality of Indicator (QoI) to assess the level of contribution by participants in threat intelligence sharing. We exemplify QoI by metrics of the correctness, relevance, utility, and uniqueness of indicators. We build a system that extrapolates the metrics using a machine learning process over a reference set of indicators. We compared these results against a model that only considers the volume of information as a metric for contribution, and unveiled various observations, including the ability to spot low-quality contributions that are synonymous to free-riding.