Publication Details
Abstract
Organizations in the current digital environment have to deal with more sophisticated and advanced cyber risks that are becoming difficult to control using conventional risk management strategies and strategic planning. Business analysts are the most crucial group of people filling the gap between technical threat intelligence and their organization strategy by interpreting cyber security data into business intelligence in an organization. The empirical study aims at studying the NLP-based cyber security dataset that contains 1,100 individual threat intelligence reports enriched with the features of natural language processing to aid in the comprehensive threat intelligence (CTI) examination. The dataset contains both structured data, i.e., threat types, attack paths, threat agents, geographies, scores of severity, the level of risk, and suggested defense measures, and unstructured textual information with the enriched NLP-based features such as clean threat text, keywords identification, named entity recognition labels (NER), sentiments, topic modeling labels, and word frequencies. The methodological tool of data processing, pre-processing, and cleaning is Python, and Tableau shall be utilized as an interactive visual analytical tool and to create dashboards, whereas exploratory data analysis and tabular representation of the data depend on using Excel. The outcomes provide clear patterns and trends with an important significance to strategic decision-making. Practical results show that phishing and malware comprise the largest possible threat types, and email and web are used as the main attack methods. Particular threat actors, especially APT-28 and Lazarus Group, are identified as major contributors of the high-level severity and high-level risk cases, meaning that monitoring and profiling the actors should be actor-specific. Geographical analysis found a wide gap between the level of threats and risk forecasting among regions, which justifies the need to set mitigation strategies to regional-based conditions. Sentiment analysis based on the hacker forums gives more indicators of the upcoming threats, and NLP-augmented features such as key words and named entities give a more meaningful context and can be used to detect influential actors, tools, and weaknesses. Tableau allows the visualization of such relationships, which helps to make threat intelligence more convenient and usable to business analysts and decision-makers. This study shows how the use of NLP-based analytics combined with attractive visualizations can enable business analysts to analyze complicated cyber security data, evaluate the prospective business implications, and orchestrate security spending to match business aims. The operationalization of threat intelligence discussed above, allows business analysts to achieve a higher level of resilience, informed resource prioritization, and elaborated business continuity in the long run. This study shows how threat intelligence can be presented as a critical element of organizational policy in preventing cyber risks through the practical observation and representation, being not only a technical activity but also a significant part of an organizational strategic program.