cyberaCTIve: a STIX-based Tool for Cyber Threat Intelligence in Complex Models

TL;DR

cyberaCTIve is a tool designed to improve STIX-based cyber threat intelligence modeling for complex cyber-physical systems like smart grids, enabling better representation and sharing of intricate threat models.

Contribution

the paper introduces cyberaCTIve, a novel tool that enhances STIX-based modeling for complex CPS threat intelligence where simple sub-projects are insufficient.

Findings

enables detailed modeling of complex CPS threats

improves sharing of intricate threat information

supports real-world cyber-physical system analysis

Abstract

Cyber threat intelligence (CTI) is practical real-world information that is collected with the purpose of assessing threats in cyber-physical systems (CPS). A practical notation for sharing CTI is STIX. STIX offers facilities to create, visualise and share models; however, even a moderately simple project can be represented in STIX as a quite complex graph, suggesting to spread CTI across multiple simpler sub-projects. Our tool aims to enhance the STIX-based modelling task in contexts when such simplifications are infeasible. Examples can be the microgrid and, more in general, the smart grid.