As we have discussed before, threat scoring forms a very important part of threat intelligence. There are usually millions of collected IOCs and they usually contain lots of false positives. If this information is directly fed to the SIEM tool, it will result in massive false positive alerts. In order to solve this problem, we have made an attempt to write an algorithm that works on top of the MISP-collected IOCs and associates a threat score to each. The idea is that an IOC with a score of five or more on a scale of 10 is more likely to be a genuinely malicious IOC and should be fed to the SIEM. The criteria of threat scoring on which this algorithm works is shown here:
- Date: The date of the IOC is given 30% of the weight. If an IOC is one to three months old, it gets the entire 100% of the 30%, which is three points. If it's four months old, it gets 90%...