Scholarlink

As cyber threats grow increasingly complex, cyber threat intelligence (CTI) sharing has become vital to strengthening collective defense. A key challenge in CTI-sharing ecosystems lies in distributing benefits fairly and efficiently, given the varying quality and impact of shared intelligence. Existing approaches often adopt game-theoretic models, particularly the Shapley value, to achieve fair distribution. While the Shapley value offers a principled solution, its exponential computational complexity limits its applicability in large-scale environments. To address this limitation, this study proposes CTI-Shapley—an enhanced algorithm that incorporates the ATT&CK framework into Shapley value computation. By structuring intelligence contributions into tactical-phase coalitions, CTI-Shapley captures the sequential nature of intelligence fusion. Experiments on real-world attack datasets show that CTI-Shapley outperforms traditional methods in both computational efficiency and practical applicability, offering a scalable solution for CTI-sharing platforms. These results position CTI-Shapley as a key advancement in CTI-sharing mechanisms, enabling fairer, more efficient benefit distribution across cybersecurity ecosystems.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

CTI-Shapley: An ATT&CK-Guided Enhanced Shapley Value Mechanism for Benefit Distribution in Cyber Threat Intelligence Sharing

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Xuanye Peng,
  • Guangxiang Dai,
  • Peng Wang

摘要

As cyber threats grow increasingly complex, cyber threat intelligence (CTI) sharing has become vital to strengthening collective defense. A key challenge in CTI-sharing ecosystems lies in distributing benefits fairly and efficiently, given the varying quality and impact of shared intelligence. Existing approaches often adopt game-theoretic models, particularly the Shapley value, to achieve fair distribution. While the Shapley value offers a principled solution, its exponential computational complexity limits its applicability in large-scale environments. To address this limitation, this study proposes CTI-Shapley—an enhanced algorithm that incorporates the ATT&CK framework into Shapley value computation. By structuring intelligence contributions into tactical-phase coalitions, CTI-Shapley captures the sequential nature of intelligence fusion. Experiments on real-world attack datasets show that CTI-Shapley outperforms traditional methods in both computational efficiency and practical applicability, offering a scalable solution for CTI-sharing platforms. These results position CTI-Shapley as a key advancement in CTI-sharing mechanisms, enabling fairer, more efficient benefit distribution across cybersecurity ecosystems.