Abstract:

With the increasing frequency and sophistication of cyberattacks, cyber threat intelligence (CTI) has gradually become an essential instrument for threat mitigation. Nevertheless, existing CTI is primarily disseminated through online platforms in standardized formats, whereas a substantial volume of unstructured intelligence remains scattered across blogs, forums, and personal websites without a unified quality assessment framework. To enable automated evaluation of large-scale fragmented intelligence, this paper proposed a threat intelligence quality assessment method based on the dynamic fusion of subjective and objective indicators. Specifically, twelve indicators were designed from the perspectives of statistical characteristics and content analysis; temporal modeling was employed to compute composite quality scores for intelligence sources across different time points; an autoencoder integrated with a Transformer architecture was used to derive indicator weights in an unsupervised manner; and a temporal smoothing mechanism was introduced to suppress abrupt score variations caused by short-term fluctuations. Extensive experiments were conducted to evaluate indicator correlation, model performance, and practical effectiveness on a dataset of 810911 articles collected from 347 websites. The results demonstrate that the proposed indicators exhibit strong discriminative power, enabling multi-dimensional quality assessment, and that the evaluation outcomes achieve high consistency with actual intelligence quality.

Key words: cyber threat intelligence, quality assessment, subjective and objective indicators, auto encoder