TEMPORAL DECAY DYNAMIC SCORING MODEL FOR INDICATORS OF COMPROMISE VIA STIX 2.1 EXTENSION

Abstract

This article proposes a temporal decay dynamic scoring model (TDDS) for indicators of compromise (IoC), formalized as an extension of the STIX 2.1 standard using the Extension Definition mechanism. The model is based on a composite mathematical formula that combines four components: an initial relevance score, determined by the indicator type according to the Pyramid of Pain (PoP) hierarchy, source reputation, and the degree of corroboration; an adaptive decay coefficient, which depends on the characteristic half-life for the respective indicator type, a scaling factor derived from the source reputation, and the campaign context; a sighting-based decay-slowing function; and an enrichment adjustment term derived from Open-Source Intelligence (OSINT) data. Using the STIX 2.1 extension mechanism, the paper formalizes a data structure that enables the transfer of TDDS model parameters between cyber threat intelligence (CTI) systems. Unlike existing implementations such as MISP and OpenCTI, where decay-related parameters remain part of the platform's internal logic and are not preserved during export, the proposed approach encapsulates computed model parameters and intermediate calculation results directly within the STIX 2.1 object structure. This enables autonomous IoC relevance evaluation by receiving systems without dependence on the infrastructure of the originating platform.