Integrating and utilizing cyber threat intelligence in security operation centers

This research focuses on the integration and utilization of cyber threat intelli-gence in security operation centers. As cyber threat intelligence continues to grow in significance for organizations to aid in defending against emerging threats, proper practical application models especially for secu...

Full description

Bibliographic Details
Main Author: Vainio, Laura
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Jyväskylän yliopisto, University of Jyväskylä
Format: Master's thesis
Language:eng
Published: 2025
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/102958
_version_ 1834494319142109184
author Vainio, Laura
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä
author_facet Vainio, Laura Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä Vainio, Laura Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä
author_sort Vainio, Laura
datasource_str_mv jyx
description This research focuses on the integration and utilization of cyber threat intelli-gence in security operation centers. As cyber threat intelligence continues to grow in significance for organizations to aid in defending against emerging threats, proper practical application models especially for security operation centers remain underdeveloped or non-existent. This master's thesis intends to answer the gap between the need for effective CTI implementation in SOCs and the lack of guiding models. The research methodology used in this thesis is design science research. The produced artifact is a process model for a secu-rity operation center to integrate and utilize cyber threat intelligence in their daily operational services. The developed process model combines the cyber threat intelligence life cycle loop with customization of its outputs for various security operation center services, easing the service delivery with the aid of CTI. Tämä tutkimus keskittyy kyberuhkatiedon integrointiin ja hyödyntämiseen tietoturvavalvomoissa. Kun kyberuhkatieto kasvaa yhä tärkeämmäksi osaksi organisaatioiden puolustusta suojaamaan uusilta kyberuhilta, asianmukaisia käytännön toteutusmalleja sen integroimiseksi ja hyödyntämiseksi erityisesti tietoturvavalvomoille ei ole tai ne ovat vielä alikehittyneitä. Tämä tutkimus pyrkii vastaamaan tarpeeseen opastavien mallien puutteesta tehokkaan kybe-ruhkatiedon implementointiin tietoturvavalvomoissa. Käytetty tutkimusme-netelmä on suunnittelutiede. Luotu artefakti on prosessimalli tietoturvaval-vomoille kyberuhkatiedon integrointiin ja hyödyntämiseen päivittäisissä ope-ratiivisissa tehtävissä. Kehitetty malli yhdistää kyberuhkatiedon tieduste-luelinkaaren ja tietoturvavalvomoiden päivittäiset tehtävät kustomoimalla ja tuottamalla uhkatietoa eri tehtäville helpottaen näiden suorittamista.
first_indexed 2025-06-02T20:00:55Z
format Pro gradu
fullrecord [{"key": "dc.contributor.advisor", "value": "Frantti, Tapio", "language": null, "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Vainio, Laura", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2025-06-02T11:52:33Z", "language": null, "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2025-06-02T11:52:33Z", "language": null, "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2025", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/102958", "language": null, "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "This research focuses on the integration and utilization of cyber threat intelli-gence in security operation centers. As cyber threat intelligence continues to grow in significance for organizations to aid in defending against emerging threats, proper practical application models especially for security operation centers remain underdeveloped or non-existent. This master's thesis intends to answer the gap between the need for effective CTI implementation in SOCs and the lack of guiding models. The research methodology used in this thesis is design science research. The produced artifact is a process model for a secu-rity operation center to integrate and utilize cyber threat intelligence in their daily operational services. The developed process model combines the cyber threat intelligence life cycle loop with customization of its outputs for various security operation center services, easing the service delivery with the aid of CTI.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "T\u00e4m\u00e4 tutkimus keskittyy kyberuhkatiedon integrointiin ja hy\u00f6dynt\u00e4miseen tietoturvavalvomoissa. Kun kyberuhkatieto kasvaa yh\u00e4 t\u00e4rke\u00e4mm\u00e4ksi osaksi organisaatioiden puolustusta suojaamaan uusilta kyberuhilta, asianmukaisia k\u00e4yt\u00e4nn\u00f6n toteutusmalleja sen integroimiseksi ja hy\u00f6dynt\u00e4miseksi erityisesti tietoturvavalvomoille ei ole tai ne ovat viel\u00e4 alikehittyneit\u00e4. T\u00e4m\u00e4 tutkimus pyrkii vastaamaan tarpeeseen opastavien mallien puutteesta tehokkaan kybe-ruhkatiedon implementointiin tietoturvavalvomoissa. K\u00e4ytetty tutkimusme-netelm\u00e4 on suunnittelutiede. Luotu artefakti on prosessimalli tietoturvaval-vomoille kyberuhkatiedon integrointiin ja hy\u00f6dynt\u00e4miseen p\u00e4ivitt\u00e4isiss\u00e4 ope-ratiivisissa teht\u00e4viss\u00e4. Kehitetty malli yhdist\u00e4\u00e4 kyberuhkatiedon tieduste-luelinkaaren ja tietoturvavalvomoiden p\u00e4ivitt\u00e4iset teht\u00e4v\u00e4t kustomoimalla ja tuottamalla uhkatietoa eri teht\u00e4ville helpottaen n\u00e4iden suorittamista.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2025-06-02T11:52:33Z\nNo. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2025-06-02T11:52:33Z (GMT). No. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "42", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": null, "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.title", "value": "Integrating and utilizing cyber threat intelligence in security operation centers", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-202506024767", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuuden maisteriohjelma", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Master's Degree Programme in Cyber Security", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.copyright", "value": "\u00a9 The Author(s)", "language": null, "element": "rights", "qualifier": "copyright", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "restrictedAccess", "language": null, "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.rights.accessrights", "value": "Tekij\u00e4 ei ole antanut lupaa avoimeen julkaisuun, joten aineisto on luettavissa vain Jyv\u00e4skyl\u00e4n yliopiston kirjaston arkistoty\u00f6semalta. Ks. https://www.jyu.fi/fi/osc/kirjasto/tyoskentelytilat/laitteet-ja-tilat#toc-jyx-ty-asema.", "language": "fi", "element": "rights", "qualifier": "accessrights", "schema": "dc"}, {"key": "dc.rights.accessrights", "value": "The author has not given permission to make the work publicly available electronically. Therefore the material can be read only at the archival workstation at Jyv\u00e4skyl\u00e4 University Library (https://www.jyu.fi/en/osc/library/workspaces/facilities-and-equipment#toc-jyx-workstation).", "language": "en", "element": "rights", "qualifier": "accessrights", "schema": "dc"}, {"key": "dc.description.accessibilityfeature", "value": "ei tietoa saavutettavuudesta", "language": "fi", "element": "description", "qualifier": "accessibilityfeature", "schema": "dc"}, {"key": "dc.description.accessibilityfeature", "value": "unknown accessibility", "language": "en", "element": "description", "qualifier": "accessibilityfeature", "schema": "dc"}]
id jyx.123456789_102958
language eng
last_indexed 2025-06-02T20:02:26Z
main_date 2025-01-01T00:00:00Z
main_date_str 2025
publishDate 2025
record_format qdc
source_str_mv jyx
spellingShingle Vainio, Laura Integrating and utilizing cyber threat intelligence in security operation centers Kyberturvallisuuden maisteriohjelma Master's Degree Programme in Cyber Security
title Integrating and utilizing cyber threat intelligence in security operation centers
title_full Integrating and utilizing cyber threat intelligence in security operation centers
title_fullStr Integrating and utilizing cyber threat intelligence in security operation centers Integrating and utilizing cyber threat intelligence in security operation centers
title_full_unstemmed Integrating and utilizing cyber threat intelligence in security operation centers Integrating and utilizing cyber threat intelligence in security operation centers
title_short Integrating and utilizing cyber threat intelligence in security operation centers
title_sort integrating and utilizing cyber threat intelligence in security operation centers
title_txtP Integrating and utilizing cyber threat intelligence in security operation centers
topic Kyberturvallisuuden maisteriohjelma Master's Degree Programme in Cyber Security
topic_facet Kyberturvallisuuden maisteriohjelma Master's Degree Programme in Cyber Security
url https://jyx.jyu.fi/handle/123456789/102958 http://www.urn.fi/URN:NBN:fi:jyu-202506024767
work_keys_str_mv AT vainiolaura integratingandutilizingcyberthreatintelligenceinsecurityoperationcenters