IT security community is recently facing a change of trend from closed to open working groups and from restrictive information to full information disclosure and sharing. One major feature for this trend change is the number of incidents and various Indicators of compromise (IoC) that appear on a daily base, which can only be faced and solved in a collaborative way. Sharing information is key to stay on top of the threats. To cover the needs of having a medium for information sharing, different initiatives were taken such as the Open Source Threat Intelligence and Sharing Platform called MISP. At current state, this sharing and collection platform has become far more than a malware information sharing platform. It includes all kind of IoCs, malware and vulnerabilities, but also financial threat or fraud information. Hence, the volume of information is increasing and evolving. In this paper we present implemented distributed data interaction methods for MISP followed by a generic scoring model for decaying information that is shared within MISP communities. As the MISP community members do not have the same objectives, use cases and implementations of the scoring model are discussed. A commonly encountered use case in practice is the detection of indicators of compromise in operational networks.
@cite_19: 
@cite_6: The scale and dynamicity of social media, and interaction between traditional news sources and online communities, has created challenges to information retrieval approaches. Users may have no clear information need or be unable to express it in the appropriate idiom, requiring instead to be oriented in an unfamiliar domain, to explore and learn. We present a novel data-driven visualization, termed Eventscape, that combines time, visual media, mood, and controversy. Formative evaluation highlights the value of emotive facets for rapid evaluation of mixed news and social media topics, and a role for such visualizations as pre-cursors to deeper search.
@cite_7: Security incidents occur at an alarming rate with malicious software (malware) involved in a large number of these incidents. Current malware evaluation and handling practices in organizations are unstandardized and intelligence regarding threat levels often comes from vendors and peers, who lack a unified threat metric system. This paper explores a method to quantify malware threats systematically and proposes a quantitative malware threat metric system. The proposed method makes communicating the level of threat more effective and efficient, particularly for information sharing organizations.
@cite_11: There is a requirement for improved information sharing and automation in the cyber security domain. Current practices and supporting technologies limit the ability of organizations to take full advantage of their staff's expertise and the trust relationships they have established with each other in their efforts to secure their communication and information systems. Limitations include the lack of interoperable standards, the absence of mechanisms to govern and control the use of sensitive information, and problems validating data quality. While centralized repositories, distribution lists and web services have been adopted in an attempt to address the requirement, the underlying needs are only partly met by these approaches, which do not deliver the required efficiency and effectiveness. Analysis of the specific constraints applicable in the cyber security domain led to definition of the Cyber Security Data Exchange and Collaboration Infrastructure (CDXI) capability. CDXI provides a knowledge management tool for the cyber security domain whose objectives are to facilitate information sharing, enable automation, and facilitate the generation, refinement and vetting of data through burden-sharing collaboration or outsourcing. The capability is defined through a set of high-level requirements that are both necessary and sufficient. This paper describes the high-level requirements and provides a brief description of the work performed to develop the CDXI concept to date as well as planned future work.
In @cite_11 , the facility to share information, automate information sharing and the ability to generate, refine and control data is discussed by redefining these problems into a concept of knowledge management for the area of cyber security by adding user needs. This leads to the fact of the veracity of information and also to false positives. In @cite_7 , an assessment approach for malware threat levels is introduced, based on scores and weighting factors. Article @cite_19 refers to a data mining approach using similarity metrics to identify statistical relations in shared information. In @cite_6 is described a data-driven approach to evaluate and visualize mixed content from news and social media content based on emotive facets to give value to content.