{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T22:02:25Z","timestamp":1792792945596,"version":"4.5.0"},"reference-count":51,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2022,5,19]],"date-time":"2022-05-19T00:00:00Z","timestamp":1652918400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"ITEA3 European","award":["I3C4-17039\/FEDER-039238"],"award-info":[{"award-number":["I3C4-17039\/FEDER-039238"]}]},{"name":"National Funds","award":["PTDC\/CCI-INF\/29058\/2017"],"award-info":[{"award-number":["PTDC\/CCI-INF\/29058\/2017"]}]},{"name":"LASIGE Research Unit","award":["UIDB\/00408\/2020 and UIDP\/00408\/2020"],"award-info":[{"award-number":["UIDB\/00408\/2020 and UIDP\/00408\/2020"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2022,8,31]]},"abstract":"<jats:p>\n            Today\u2019s threats use multiple means of propagation, such as social engineering, email, and application vulnerabilities, and often operate in different phases, such as single device compromise, lateral network movement, and data exfiltration. These complex threats rely on advanced persistent threats supported by well-advanced tactics for appearing unknown to traditional security defenses. As organizations realize that attacks are increasing in size and complexity, cyber threat intelligence (TI) is growing in popularity and use. This trend followed the evolution of advanced persistent threats, as they require a different level of response that is more specific to the organization. TI can be obtained via many formats, with open-source intelligence one of the most common, and using threat intelligence platforms (TIPs) that aid organizations to consume, produce, and share TI. TIPs have multiple advantages that enable organizations to quickly bootstrap the core processes of collecting, analyzing, and sharing threat-related information. However, current TIPs have some limitations that prevent their mass adoption. This article proposes AECCP, a platform that addresses some of the TIPs limitations. AECCP improves quality TI by classifying it accordingly a\n            <jats:italic>single unified taxonomy<\/jats:italic>\n            , removing the information with low value, enriching it with valuable information from open-source intelligence sources, and aggregating it for complementing information associated with the same threat. AECCP was validated and evaluated with three datasets of events and compared with two other platforms, showing that it can generate quality TI automatically and help security analysts analyze security incidents in less time.\n          <\/jats:p>","DOI":"10.1145\/3530977","type":"journal-article","created":{"date-parts":[[2022,5,19]],"date-time":"2022-05-19T13:10:35Z","timestamp":1652965835000},"page":"1-39","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":27,"title":["Generating Quality Threat Intelligence Leveraging OSINT and a Cyber Threat Unified Taxonomy"],"prefix":"10.1145","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9957-1193","authenticated-orcid":false,"given":"Cl\u00e1udio","family":"Martins","sequence":"first","affiliation":[{"name":"Universidade de Lisboa, Campo Grande, Lisboa, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4478-8680","authenticated-orcid":false,"given":"Ib\u00e9ria","family":"Medeiros","sequence":"additional","affiliation":[{"name":"Universidade de Lisboa, Campo Grande, Lisboa, Portugal"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,5,19]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.is.2020.101586"},{"key":"e_1_3_2_3_2","doi-asserted-by":"crossref","unstructured":"Nolan Arnold Mohammadreza Ebrahimi Ning Zhang Ben Lazarine Mark Patton and Sagar Samtani. 2019. Dark-net ecosystem cyber-threat intelligence (CTI) tool. In Proceedings of the 2019 IEEE International Conference on Intelligence and Security Informatics (ISI\u201919) . 92\u201397.","DOI":"10.1109\/ISI.2019.8823501"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom\/BigDataSE.2019.00071"},{"key":"e_1_3_2_5_2","unstructured":"Matt Bromiley. 2016. Threat Intelligence: What It Is and How to Use It Effectively. Retrieved February 22 2022 from https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2017\/01\/SANS_Whitepaper_Threat_Intelligence__What_It_Is__and_How_to_Use_It_Effectively.pdf."},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-44885-4_5"},{"key":"e_1_3_2_7_2","unstructured":"CIRCL.lu. 2018. CIRCL Taxonomy\u2014Schemes of Classification in Incident Response and Detection. Retrieved February 22 2022 from https:\/\/www.circl.lu\/pub\/taxonomy\/."},{"key":"e_1_3_2_8_2","unstructured":"A. Cormack X. Jansen A. Moens and P. Peters. 2015. Incident Classification\/Incident Taxonomy According to eCSIRT.net \u2014Adapted . Retrieved February 22 2022 from https:\/\/www.trusted-introducer.org\/Incident-Classification-Taxonomy.pdf."},{"key":"e_1_3_2_9_2","unstructured":"CSIRTG. 2020. The FASTEST Way to Consume Threat Intelligence. Period. Retrieved February 22 2022 from https:\/\/csirtgadgets.com\/collective-intelligence-framework."},{"key":"e_1_3_2_10_2","unstructured":"Darknet. 2020. OpenIOC\u2014Sharing Threat Intelligence. Retrieved February 22 2022 from https:\/\/www.darknet.org.uk\/2016\/06\/openioc-sharing-threat-intelligence\/."},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.3390\/fi12060108"},{"issue":"23","key":"e_1_3_2_12_2","article-title":"Open source intelligence and privacy dilemmas: Is it time to reassess state accountability?","author":"Eijkman Quirine","year":"2013","unstructured":"Quirine Eijkman and Daan Weggemans. 2013. Open source intelligence and privacy dilemmas: Is it time to reassess state accountability? Security and Human Rights23, 4 (April 2013), 1\u201312.","journal-title":"Security and Human Rights"},{"key":"e_1_3_2_13_2","volume-title":"Standards and Tools for Exchange and Processing of Actionable Information","year":"2015","unstructured":"ENISA. 2015. Standards and Tools for Exchange and Processing of Actionable Information. Technical Report. ENISA."},{"key":"e_1_3_2_14_2","volume-title":"Exploring the Opportunities and Limitations of Current Threat Intelligence Platforms","year":"2017","unstructured":"ENISA. 2017. Exploring the Opportunities and Limitations of Current Threat Intelligence Platforms. Technical Report. ENISA."},{"key":"e_1_3_2_15_2","unstructured":"European Commission. 2016. Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95\/46\/EC (General Data Protection Regulation). EUR-Lex . Retrieved February 22 2022 from https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj."},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.5220\/0007830400370048"},{"key":"e_1_3_2_17_2","volume-title":"Taking a Lean-Forward Approach to Combat Today\u2019s Cyber Attacks","year":"2013","unstructured":"FireEye. 2013. Taking a Lean-Forward Approach to Combat Today\u2019s Cyber Attacks. Technical Report. FireEye."},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2011.11.014"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2020.102715"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1080\/08850607.2014.900295"},{"key":"e_1_3_2_21_2","volume-title":"Threat Intelligence: Planning and Direction","author":"Kime Brian","year":"2016","unstructured":"Brian Kime. 2016. Threat Intelligence: Planning and Direction. SANS Institute\u2013InfoSec Reading Room."},{"key":"e_1_3_2_22_2","volume-title":"2020 SANS Cyber Threat Intelligence (CTI) Survey","author":"Lee Robert M.","year":"2020","unstructured":"Robert M. Lee. 2020. 2020 SANS Cyber Threat Intelligence (CTI) Survey. SANS Institute\u2014InfoSec Reading Room."},{"key":"e_1_3_2_23_2","unstructured":"Jerome Leonard. 2020. TheHive Project: Open Source Free and Scalable Cyber Threat Intelligence & Security Incident Response Solutions. Retrieved February 22 2022 from https:\/\/blog.thehive-project.org\/tag\/soltra-edge\/."},{"key":"e_1_3_2_24_2","volume-title":"Joint Intelligence (JP 2-0)","author":"Dempsey Martin E.","year":"2013","unstructured":"Martin E. Dempsey. 2013. Joint Intelligence (JP 2-0). Technical Report. U.S. Army."},{"key":"e_1_3_2_25_2","unstructured":"Cl\u00e1udio Martins and Ib\u00e9ria Medeiros. 2020. Additional Info on the Paper Submitted to ACM TOPS. Retrieved February 22 2022 from https:\/\/sites.google.com\/view\/siteaddinfo-tops."},{"key":"e_1_3_2_26_2","article-title":"Operational levels of cyber intelligence","volume":"27","author":"Mattern Troy","year":"2014","unstructured":"Troy Mattern, John Felker, Randy Borum, and George Bamford. 2014. Operational levels of cyber intelligence. International Journal of Intelligence and Counterintelligence 27, 4 (Dec. 2014), 702\u2013719.","journal-title":"International Journal of Intelligence and Counterintelligence"},{"key":"e_1_3_2_27_2","unstructured":"Amanda McKeon. 2016. Reduce Business Risk with an Effective Threat Intelligence Capability. Retrieved February 22 2022 from https:\/\/www.recordedfuture.com\/threat-intelligence-capability\/."},{"key":"e_1_3_2_28_2","unstructured":"Microsoft. 2018. Security Intelligence. Retrieved February 22 2022 from https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/intelligence\/."},{"key":"e_1_3_2_29_2","article-title":"A taxonomy of DDoS attack and DDoS Defense mechanisms","volume":"34","author":"Mirkovic Jelena","year":"2004","unstructured":"Jelena Mirkovic and Peter Reiher. 2004. A taxonomy of DDoS attack and DDoS Defense mechanisms. ACM SIGCOMM Computer Communication Review 34, 2 (May 2004), 39\u201353.","journal-title":"ACM SIGCOMM Computer Communication Review"},{"key":"e_1_3_2_30_2","unstructured":"MISP. 2020. MISP Taxonomies. Retrieved February 22 2022 from https:\/\/www.misp-project.org\/datamodels\/#misp-taxonomies."},{"key":"e_1_3_2_31_2","unstructured":"MISP. 2020. Open Source Threat Intelligence Platform & Open Standards for Threat Information Sharing. Retrieved February 22 2022 from http:\/\/www.misp-project.org."},{"key":"e_1_3_2_32_2","unstructured":"MITRE. 2020. CRITs: Collaborative Research into Threats. Retrieved February 22 2022 from https:\/\/crits.github.io\/."},{"key":"e_1_3_2_33_2","unstructured":"OASIS. 2020. Introduction to STIX. Retrieved February 22 2022 from https:\/\/oasis-open.github.io\/cti-documentation\/stix\/intro.html."},{"key":"e_1_3_2_34_2","unstructured":"OASIS. 2020. Introduction to TAXII. Retrieved February 22 2022 from https:\/\/oasis-open.github.io\/cti-documentation\/taxii\/intro.html."},{"key":"e_1_3_2_35_2","unstructured":"Bank of England. 2016. Understanding Cyber Threat Intelligence Operations. Retrieved February 22 2022 from https:\/\/www.bankofengland.co.uk\/-\/media\/boe\/files\/financial-stability\/financial-sector-continuity\/understanding-cyber-threat-intelligence-operations.pdf."},{"key":"e_1_3_2_36_2","first-page":"300","article-title":"Cyber threat intelligence: A product without a process?","author":"Oosthoek Kris","year":"2020","unstructured":"Kris Oosthoek and Christian Doerr. 2020. Cyber threat intelligence: A product without a process? International Journal of Intelligence and CounterIntelligence 34, 2 (2020), 300\u2013315.","journal-title":"International Journal of Intelligence and CounterIntelligence"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2965257"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.3390\/electronics9050824"},{"key":"e_1_3_2_39_2","unstructured":"Robert M. Lee. 2016. Intelligence Defined and Its Impact on Cyber Threat Intelligence. Retrieved February 22 2022 from https:\/\/www.robertmlee.org\/intelligence-defined-and-its-impact-on-cyber-threat-intelligence\/."},{"key":"e_1_3_2_40_2","unstructured":"C. Sabottke O. Suciu and T. Dumitras. 2015. Vulnerability disclosure in the age of social media: Exploiting Twitter for predicting real-world exploits. In Proceedings of the 24th USENIX Security Symposium . 1041\u20131056."},{"key":"e_1_3_2_41_2","doi-asserted-by":"crossref","unstructured":"A. Saini Manoj Gaur and Vijay Laxmi. 2014. A taxonomy of browser attacks. In Handbook of Research on Digital Crime Cyberspace Security and Information Assurance . IGI Global 291\u2013313.","DOI":"10.4018\/978-1-4666-6324-4.ch019"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2017.1394049"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/3409289"},{"key":"e_1_3_2_44_2","article-title":"Threat intelligence sharing platforms: An exploratory study of software vendors and research perspectives","author":"Sauerwein C.","year":"2017","unstructured":"C. Sauerwein, C. Sillaber, Andrea Mussmann, and R. Breu. 2017. Threat intelligence sharing platforms: An exploratory study of software vendors and research perspectives. Wirtschaftsinformatik und Angewandte Informatik 2017 (2017), 1\u201315.","journal-title":"Wirtschaftsinformatik und Angewandte Informatik"},{"key":"e_1_3_2_45_2","unstructured":"SWIFT. 2019. The Evolving Cyber Threat to the Global Banking Community. Retrieved February 22 2022 from https:\/\/www.swift.com\/pt\/node\/147646."},{"key":"e_1_3_2_46_2","volume-title":"Advanced Persistent Threats: A Symantec Perspective","author":"Headquarters Symantec World","year":"2011","unstructured":"Symantec World Headquarters. 2011. Advanced Persistent Threats: A Symantec Perspective. Technical Report. Symantec."},{"key":"e_1_3_2_47_2","volume-title":"Threat Intelligence Platforms. Everything You\u2019ve Ever Wanted to Know But Didn\u2019t Know to Ask","year":"2019","unstructured":"ThreatConnect. 2019. Threat Intelligence Platforms. Everything You\u2019ve Ever Wanted to Know But Didn\u2019t Know to Ask. ThreatConnect."},{"key":"e_1_3_2_48_2","volume-title":"What is cyber threat intelligence and how is it evolving? In Cyber-Vigilance and Digital Trust: Cyber Security in the Era of Cloud Computing and IoT. John Wiley & Sons, 1\u201349.","author":"Tounsi Wiem","year":"2019","unstructured":"Wiem Tounsi (Ed.). 2019. What is cyber threat intelligence and how is it evolving? In Cyber-Vigilance and Digital Trust: Cyber Security in the Era of Cloud Computing and IoT. John Wiley & Sons, 1\u201349."},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.09.001"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1145\/2994539.2994542"},{"key":"e_1_3_2_51_2","volume-title":"Threat Intelligence: What Is It, and How Can It Protect You from Today\u2019s Advanced Cyber-Attacks","year":"2014","unstructured":"Webroot. 2014. Threat Intelligence: What Is It, and How Can It Protect You from Today\u2019s Advanced Cyber-Attacks. Technical Report. Gartner."},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2018.8587336"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3530977","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3530977","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T18:09:27Z","timestamp":1750183767000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3530977"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,19]]},"references-count":51,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2022,8,31]]}},"alternative-id":["10.1145\/3530977"],"URL":"https:\/\/doi.org\/10.1145\/3530977","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,5,19]]},"assertion":[{"value":"2020-12-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-01-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-05-19","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}