Cyber Threat Intelligence (CTI) plays a crucial role in modern cybersecurity by providing actionable insights into attacker behavior, motives, and tactics. As the threat landscape evolves, so too do CTI models, each with its own strengths and weaknesses. This article presents a comparative analysis of various CTI models, such as Diamond Model, Extended Diamond Model, Cyber Kill Chain, Unified Cyber Kill Chain and MITRE ATT&CK Model, exploring their core functionalities, underlying methodologies, and suitability for different use cases. By understanding the nuances of each model, security professionals can make informed decisions about which CTI approach best suits their organizational needs.
• • • •
Strategic: it provides a high-level perspective on threat intelligence, considering financial impact, attack trends, and global implications. It focuses on long-term usability of gathered intelligence. In this context, analysts examine attack patterns across industries, changes in TTPs over time, malware usage, and data breaches. Strategic CTI informs executive decisions and guides long-term security planning. On the other hand, subtype CTI delves beyond technical risks, considering the motivations behind attacks. It takes into account who or which organization is behind the attacks, their objectives, and why they target specific entities. Subtype CTI serves as an early warning system for anticipated threats, aiding organizations in proactively establishing defences based on current attack trends, without necessarily revealing specific methods or codes.
Tactical: focuses on understanding threat actors’ methods of operation. It equips responders and defenders with knowledge to prepare alarms, defences, and investigations against the latest threats. Sources for tactical CTI include white papers, technical press, and interactions with other organizations and peers. Specifically, tactical CTI provides detailed information about attackers. This encompasses mapping out threat actor TTPs, defining their goals, and understanding their technical capabilities. Armed with this intelligence, organizations can proactively fine-tune their mitigation tactics and even simulate attacks to identify vulnerabilities in their security infrastructure.
Technical: it focuses on specific threat indicators, such as Indicators of Compromise (IoCs), relevant to SOC Staff. Aligned with operational intelligence, technical CTI helps identify signs of ongoing attacks. By leveraging threat intelligence platforms with AI, organizations can automatically scan for known indicators, including phishing email content, malicious IP addresses, and specific malware implementations. SOC and incident response teams can swiftly respond to this information, preventing potential damage to the organization. Analysts gather information about the attacker’s command and control (C2) infrastructure, tools, malware, and other technical resources used against the organization.
Operational: it focuses on specific threats against an organization, considering threat actor
motivations, vulnerability exploitation, past and current malicious activity, and the impact
of cyberattacks on confidentiality, integrity, and availability. It helps assess an organization’s
resilience against cyber threats. Operational CTI provides specialized information about
attacker identities, motivations, and methods. Automation through a cyber threat intelligence
platform enhances data collection efficiency [
High-level information on changing risk The board Details of a specific incoming attack
Defenders
For every subtype, there are also different methods for gathering information, such as OSINT (Open-Source Intelligence), CSINT (Closed Source Intelligence), HUMINT (Human Intelligence) and TECHINT (Technical Intelligence).
CTI models enable organizations to effectively organize and analyze CTI data, gaining a comprehensive understanding of the evolving threat landscape. To achieve all CTI goals, different Cyber Threat Intelligence models are used. Each CTI model offers unique perspectives and methodologies to analyze, understand, and mitigate these threats. At the same time, each model has advantages and disadvantages that cyber security specialists in organizations need to take into account.
There are a lot of CTI models available, and research was conducted regarding their use in CTI
systems. In [
Thus, the aim of this article is to analyze the most common Cyber Threat Intelligence models and provide full comparison regarding their usage in CTI systems.
The Diamond model represents a new concept for analyzing intrusions developed by cybersecurity
analysts. This model establishes the basic "atomic element" of any intrusion activity or cyber incident
consists of four main functions: adversary, infrastructure, capability, and victim that are shown on
Figure 2. Because of the shape formed by the relationships between all these elements, this model is
named as a Diamond [
When an event is detected, the vertices of the model are filled in automatically or with the help of analysts.
The vertices are connected by edges and highlight the natural connections between functions,
such as adversary-victim, adversary-infrastructure, victim-infrastructure and victim-capability [
Infrastructure
(Physical and/or
logical resources
used by adversary)
The Diamond model includes the next meta-features [
According to [
This scientific approach and simplicity results in improved analytical efficiency, productivity, and accuracy. After all, the Diamond Model provides the ability to integrate real-time vulnerability intelligence to protect networks, automate and correlate events, classify them by confidence level in adversarial campaigns, predict adversarial operations in planning, and develop cost reduction strategies.
The Extended Diamond Model has some additional features that complement the original model and
make it more informative for analysts. New features for Extended Diamond Model are socio-political
meta-features to determine the relationship between the adversary and victim as well as technology
meta-features for infrastructure and capabilities [
Considering both versions of this model, it is worth adding a few key aspects. First of all, it makes it simple for analysts to switch between different intelligence pieces, which either helps to reveal intelligence blind spots or complete the picture while acquiring intelligence. Tracking enemies, capabilities, infrastructure, and victims over time is the model's primary goal. An activity thread that links trends in attackers, TPPs, and infrastructure across assaults against several victims is used to display this activity. By outlining possible future directions that threat actors might go, the activity thread helps defenders and responders approach security pro-actively rather than reactively.
The diamond model's capacity to create activity groups and activity-attack graphs is another
essential feature. Activity groups are collections of shared identifying behaviors, such as a specific
APT activity or a typical attack path that threat actors use to indicate a particular kind of attack.
Activity-attack graphs are visual depictions of real attacks that take place at various points along the
cyber death chain in the threat landscape. In order to create scenarios that a company would
encounter, this enables CTI analysts to monitor ongoing activity in the threat landscape and correlate
the MITRE ATT&CK TPPs to the cyber death chain. Security teams may create targeted threat hunt
scenarios and make sure their security stack defends against assaults encountered in the field by
using these attack graphs [
The Cyber Kill Chain (CKC) Model was developed in 2011 by the US company Lockheed Martin and
mainly focused on Advanced Persistent Threat (APT) attacks [
From the other side, here we cannot see the defender's part. If we present time scale correctly and name some steps according to defender side, the whole attack can be divided in the next phases: • • •
Preparation (Phase 1 Reconnaissance, Phase 2 Arming); Incident (Phase 3 Delivery, Phase 4 Intrusion, Phase 5 Installation);
Active Intrusion (Phase 6 C2, Phase 7 Action).
This model also has some problems. Firstly, it should be noticed that the flaw in this model lies
in its oversimplified portrayal of cyber-attacks as tidy and linear processes, which diverges from the
messier reality. Moreover, Cyber Kill Chain tends to focus solely on the immediate actor behind a
cyber-attack, disregarding the underlying motives or any potential insider collaboration. To enhance
the model’s effectiveness, it’s crucial to supplement it with knowledge about the attack’s sponsor,
drawing insights from real-world espionage cases [
Despite its limitations, this model remains valuable for organizations seeking to fortify their defenses by addressing vulnerabilities at each link in the chain, provided they have access to highquality intelligence on the adversary’s actions throughout the process.
The Cyber Kill Chain Model has been improved, the new approach was created and named Unified
Kill Chain (UKC) Model. The main idea of this model is to combine two existing models: the Lockheed
Martin' Cyber Kill Chain and the MITRE ATT&CK for Enterprise [
The MITRE ATT&CK Framework offers a comprehensive inventory of adversary tactics and techniques, while the Lockheed Martin Kill Chain offers a methodical view of an attacker's intrusion stages. By merging these frameworks, the Unified Kill Chain allows enterprises to evaluate their defenses from two different perspectives [22]: • • strategically, taking into account the stages of an attack; tactically, emphasizing particular attacker actions.
This combination enables organizations to assess their security posture holistically and adjust their defensive strategies as necessary.
The Unified Kill Chain consists of eighteen phases, or strategies, that a cyberattack could go through. Phases may be skipped, repeated, or executed out of order by any given attack. The scheme of this model is shown on Figure 5.
It is possible to combine several tactical phases of an attack to accomplish intermediate goals, like getting a first foothold in a targeted network, breaking into it to increase your level of access, and taking action against important assets.
All typical cyberattack activities, from the initial reconnaissance conducted by external attackers to the successful accomplishment of the attack's ultimate goals beyond the organizational perimeter, can be modeled using the Unified Kill Chain. The Unified Kill Chain relies on the expertise of industry leaders such as Lockheed Martin' Cyber Kill Chain and MITRE's ATT&CK for Enterprise model in order to cover such a wide range.
The MITRE Corporation developed the framework, data matrices, and assessment model known as
MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge) to assist organizations
in assessing their security readiness and identifying weak points in their defenses [23]. Most of all,
it is a hub for exchanging knowledge and information about cyberattacks with an emphasis on the
development and execution of TTPs, where tactics stand for the reasons behind the actions an
attacker takes to accomplish their goal, techniques for how the attacker carries out the actions, and
procedures for the specific steps involved in putting the techniques into practice [
The adversary's "technical objectives" are divided into 14 tactics categories within the framework: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact [24]. Each category includes techniques and sub-techniques (Figure 6).
It can be said that the matrix is basically a historical reference of what techniques and methods were popular among cybercriminals in the past, as well as a fresh look at the cyberthreat model through the prism of techniques that hackers are actively using now [25, 26]. But it is worth adding that in MITRE ATT&CK, one technique can be repeated in several columns of the matrix [27]. This is because attackers may have different goals, but may use the same means to achieve them.
The MITRE ATT&CK Matrix is looked at by security researchers from around the world. For analysts, it's a good source to help structure information about current attack techniques. Knowing how real APT groups operate allows you to formulate hypotheses for proactive threat hunting.
Despite of advantages of this model, it also has some disadvantages: • • •
It's huge and complicated.
There is a lot of data to be processed, and many organizations have not automated much of that data in terms of mapping it to their security infrastructure or to other data they have in their system.
There are various attack patterns that are constantly evolving, making it impractical to detect and map them against your security infrastructure.
The Diamond Model and the Extended Diamond Model have different approaches than other models. In this case, we can compare these models regarding their focuses, granularities, and applications. These characteristics provide a full understanding of each model and their use in CTI (Table 1).
Despite the fact that CKC, UKC, and MITRE ATT&CK are providing a lot of useful information for incident response, attribution of a cyberattack to a threat actor is a complicated procedure that the Diamond Model and the Extended Diamond Model excel at through all their features (both nonmeta and meta). In fact, attribution should not be solely based on the analysis of an adversary’s use of TTPs alone.
By combining models that have different approaches, security teams will be able to get a complete picture of cyber threats, how to protect their organization, and how to respond to incidents more effectively [28–31].
Extended Diamond Model emphasizes attacker motivations and capabilities Model offers a broader perspective Model is useful for threat intelligence and threat hunting
The cyber threat landscape is complex and constantly changing. Each CTI model offers unique perspectives and methodologies for analyzing, understanding, and mitigating these threats.
The Diamond Model/Extended Diamond Model is used only to analyze cyberattacks (intrusions), to formalize them in order to answer the questions "who", "why" and "how" implemented the cyberattack, provides IoCs of cyberattacks for further examination, but this model does not reflect the stages of attacks.
Models such as CKC, UKC, and MITRE ATT&CK take into account the stages of cyber attacks, with UKC covering more stages than the other two models. At the same time, MITRE ATT&CK serves as a broad knowledge base of intruder’s TTPs and provides a full understanding of threat actor behavior. However, these models do not answer the question of what to do when an attack is successful, nor do they pay attention to intrusion prevention.
Combining multiple models or frameworks often results in a more holistic and effective approach to cybersecurity, enabling organizations to proactively defend against a variety of cyber threats. Continuously evolving and adapting these models is essential to staying ahead in the ongoing battle against cyber adversaries.
[22] J. Garrett, The Unified Kill Chain: Your Tool for Actively Evaluating Your Cyber Defenses, 2022.
URL: https://www.opkalla.com/articles/the-unified-kill-chain-your-tool-for-activelyevaluating-your-cyber-defenses. [23] Understanding Cyber Kill Chain, MITRE ATT&CK Framework and Unified Kill Chain, 2023.
URL: https://medium.com/@wintersoldiers/understanding-cyber-kill-chain-mitre-att-ckframework-and-unified-kill-chain-f306ceca19be. [24] MITRE ATT&CK, 2023. URL: https://attack.mitre.org. [25] Y. Averyanova, et al., UAS cyber security hazards analysis and approach to qualitative assessment, In: S. Shukla, A. Unal, J. Varghese Kureethara, D.K. Mishra, D.S. Han (Eds.), Data science and security, volume 290 of Lecture Notes in Networks and Systems, Springer, Singapore, 2021, pp. 258–265. doi: 10.1007/978-981-16-4486-3_28. [26] M. Zaliskyi, et al., Heteroskedasticity analysis during operational data processing of radio electronic systems, in: S. Shukla, A. Unal, J. Varghese Kureethara, D.K. Mishra, D.S. Han (Eds.), Data science and security, volume 290 of Lecture Notes in Networks and Systems, Springer, Singapore, 2021, pp. 168–175. doi: 10.1007/978-981-16-4486-3_18. [27] R. S. Odarchenko, S. O. Gnatyuk, T. O. Zhmurko, O. P. Tkalich, Improved method of routing in UAV network, in: Proceedings of International Conference Actual Problems of Unmanned Aerial Vehicles Developments (APUAVD), IEEE, Kyiv, Ukraine, 2015, pp. 294–297. doi: 10.1109/APUAVD.2015.7346624. [28] M. Zaliskyi, R. Odarchenko, S. Gnatyuk, Y. Petrova, A. Chaplits, Method of traffic monitoring for DDoS attacks detection in e-health systems and networks, CEUR Workshop Proceedings 2255 (2018) 193–204. URL: https://ceur-ws.org/Vol-2255/paper18.pdf. [29] V. Kharchenko, I. Chyrka, Detection of airplanes on the ground using YOLO neural network, in: Proceedings of 17th International Conference on Mathematical Methods in Electromagnetic Theory (MMET), IEEE, Kyiv, Ukraine, 2018, pp. 294–297. doi: 10.1109/MMET.2018.8460392. [30] O. Sushchenko, et al., Airborne sensor for measuring components of terrestrial magnetic field, in: Proceedings of IEEE 41st International Conference on Electronics and Nanotechnology (ELNANO), IEEE, Kyiv, Ukraine, 2022, pp. 687–691. doi: 10.1109/ELNANO54667.2022.9926760. [31] O. Solomentsev, M. Zaliskyi, O. Kozhokhina and T. Herasymenko, Efficiency of data processing for UAV operation system, in: Proceedings of 4th International Conference Actual Problems of Unmanned Aerial Vehicles Developments (APUAVD), IEEEб Kiev, Ukraine, 2017, pp. 27–31. doi: 10.1109/APUAVD.2017.8308769.