Optimizing Cyber Threat Intelligence: A Multi-Objective Approach to Feed Selection

Abstract

In modern cybersecurity operations, threat intelligence feeds provide critical Indicators of Compromise (IoCs) to track malicious activity. However, organizations often ingest multiple overlapping feeds from various Cyber Threat Intelligence (CTI) providers, leading to redundant data, irrelevant noise, and increased false positives. This data overload severely strains both automated detection systems and human analysts. To mitigate this issue, this thesis introduces an NP-hard, multi-objective optimization challenge aimed at selecting a minimal subset of feeds that guarantees complete coverage of required IoCs while minimizing unneeded noise and feed ingestion costs.