The potential of Cyber Threat Intelligence analytical frameworks in research on information operations and influence operations

Abstract

The article’s aim is to evaluate the utility of using the Cyber Threat Intelligence (CTI) approach in analysing information and influence operations. The study was carried out by a comparative method based on the technique of desk research. The point of comparison for the CTI methodology were methods originated in communicology, which are relatively popular in the study of propaganda. The authors try to answer the question of what methodological contribute to the study of the discussed phenomena – and thus to the practical potential of the analyst’s workshop – is the adoption of a paradigm for the analysis of information operations and influence operations based on models of tactics, techniques, and procedures (TTPs) recognition and taxonomy of ICT incidents or typification of CTI threat actors. The central focus of the study is a critical analysis of English-language publications discussing the use of CTI in disinformation analysis. The main conclusion from the analysis includes a thesis about the limited methodological benefits of CTI based methods, while using their technical and organisational strengths to research elements of information operations and influence operations in which cyberspace is used.