An Ontology for Threat Intelligence

This paper describes the work done to build an ontology in support of cyber threat intelligence. The end goal is a system that helps threat intelligence analysts effectively organize and search both open source intelligence and threat indicators in order to build a comprehensive picture of the threat environment. The Lockheed Martin kill chain model serves as the basis for the ontology. Semantic Web technologies such as RDF, OWL, and SPARQL are used to leverage existing commercial off-the-shelf software and tools.