Method for Selecting Indicators of Data Compromise

This work is devoted to the consideration of the use of indicators of compromise at the process of cyber intelligence. When used correctly, lists of indicators of compromise (feeds) can reveal malicious activity in the infrastructure. Nevertheless, to achieve their effective implementation is not easy-there are certain limitations and subtleties. The paper proposes a method for generating a set of indicators of compromise applicable to the infrastructure, and an experiment is carried out. Its results indicate that a set of feeds and indicators must be selected for each infrastructure, depending on its composition and tasks set during the implementation of the cyber threat intelligence process.