Generating and classifying a unique threat actors dataset with cyber threat intelligence

With the increase in the presence of information technology and data in cyberspace, groups defined as advanced permanent threat actors emerge and commit crimes of industrial espionage, sabotage and theft. Organizations invest in cyber defense activities and defense technologies necessary for the fulfillment of these activities in order to improve cyber security processes in order to protect data assets. Cyber threat intelligence, on the other hand, is an area that they benefit from in order to strengthen more informed monitoring, detection and response steps within these defense activities. In this study, it is aimed to create a dataset of indicators obtained from threat intelligence and threat actors in order to increase the detection and prevention capabilities of organizations within the scope of defense activities. With the data set to be created by collecting harmful indicators of threat actors and cyberattacks over the Internet, it is aimed to extract similar cyberattack activities before. As a result of the study, it will be possible to extract the harmful indicators used by the cyberattack or threat actor related to the harmful indicator in previous attacks. It will enable to make inferences about the threat actor relationship between the created data set and the detected finding. For example, by looking at the IP address similarity relationship in the data set created with the service provider and IP block information about the IP address detected by the Incident response study, information about a cyberattack or threat actor can be obtained.