◇ OpenCyber Academy
Doctoral research · Chapter 2 · English

Chapter 2 — Threat intelligence and OSINT: research frontier

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Threat intelligence and OSINT: research frontier

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Three models, three claims"]
  N2["2.2 Open problems"]
  N3["2.3 OSINT method frontier"]
  N4["2.4 Writing the gap"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Three models, three claims"]
  N2["2.2 Open problems"]
  N3["2.3 OSINT method frontier"]
  N4["2.4 Writing the gap"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Three models, three claims]
    |
    v
[2.2 Open problems]
    |
    v
[2.3 OSINT method frontier]
    |
    v
[2.4 Writing the gap]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) map the main open problems in CTI method; (2) distinguish models (kill chain, Diamond, ATT&CK) by what they claim; (3) identify where evidence in the literature is thin; (4) write a gap statement that a reviewer cannot dismiss as a literature summary.

2.1 Three models, three claims

Hutchins, Cloppert and Amin (2011) proposed the intrusion kill chain — reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives — and argued that defenders win by breaking any link and by analysing campaigns rather than single incidents. Caltagirone, Pendergast and Betz (2013) proposed the Diamond Model: every event has adversary, capability, infrastructure and victim, and analysts pivot along the edges. MITRE ATT&CK is a curated knowledge base of observed tactics, techniques and groups. The first is a defensive strategy, the second an analytic ontology, the third an empirical catalogue. Research that treats them as interchangeable will confuse its own claims.

2.2 Open problems

Several questions remain weakly evidenced: how well confidence language in reports predicts later confirmation; how much indicator sharing actually reduces harm (NIST SP 800-150 describes how to share, not how much benefit results); how reproducible attribution is between independent teams; and how to measure the value of strategic intelligence for decision-makers. Each is researchable with careful design and synthetic or consented data.

Tomas's thesis takes the first question. The others suit different designs: harm reduction from sharing would need outcome data from organisations, and reproducibility of attribution would need independent teams working on the same artefacts, which is why they appear as follow-on work rather than in his proposal.

2.3 OSINT method frontier

Open-source investigation has grown faster than its validation. Questions include geolocation error rates, the reliability of archived web captures, and the privacy costs of aggregating individually harmless public facts. Doctoral work here must weigh research value against the harm of building aggregation tools.

Tomas's corpus deliberately avoids this frontier: it uses reports, not people, and the forum corpus was dropped. A thesis that geolocated images or linked public profiles would need a far heavier ethics file, because each step of aggregation can create a profile of a person that no single public fact revealed.

2.4 Writing the gap

A good gap statement has three parts: what is known (with citations), what is not known (stated precisely), and why it matters to a decision. "Little research exists on CTI" is not a gap; "no published study measures calibration of estimative language in vendor CTI reports against later confirmation" is.

Tomas's own statement follows the three parts: the norm is known, since ICD 203 requires expressing uncertainty and Kent proposed an estimative vocabulary; no measurement of calibration in commercial CTI appeared among the 40 papers and reports he reviewed; and it matters because SOC teams decide whether to block on the strength of those phrases.

Worked example

Tomas reviews 40 papers and reports. He finds many descriptions of ICD 203's requirement to express uncertainty and of Kent's estimative-probability vocabulary, but no measurement of calibration in commercial CTI. His gap statement names that absence, cites Kent and ICD 203 for the norm, and links it to SOC decision-making about blocking.

Synthetic case. Tomas's review count and gap statement are invented.

Errors and limits

Vendor blogs are evidence of practice, not peer-reviewed findings; label them. Frontier enthusiasm does not justify building surveillance tooling.

Exercises

Synthesis

Know what each model claims, find gaps that are precise and decision-linked, and weigh OSINT research value against aggregation harm.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →