nucleation

LIT-083: Toward interoperable representation and sharing of disinformation incidents in cyber threat intelligence

3 min read

Properties5
StatusProposed — read in full 2026-09-25 (NOTE-028); a working, clearly described proof of concept for carrying disinformation incidents as CTI. It is an unreviewed preprint with a deliberately minimal mapping and no evaluation beyond "it ingests"; what would settle it is peer-reviewed publication plus evidence that analysts use the shared incidents, or a comparison with DAD-CDM, which the authors themselves name as the emerging standard.
Version2
Tagssociety-and-governance
Cited as “paper” byNOTE-028 — Disinformation incidents as cyber threat intelligence (DISINFOX)
Cited as “source” byTHEORY-1238 — Disinformation incidents carried in STIX 2.1 as the DISINFOX mapping carries them are an interoperable representation that survives exchange between organisations, and sharing them in this form improves analysts' correlation and exposure of incidents and their reuse of labels, THEORY-651 — Disinformation incidents labelled with DISARM techniques can be carried in standard STIX 2.1 without extending it, as an intrusion set that uses attack patterns, is attributed to a threat actor and targets locations; the DISINFOX mapping that moved 118 incidents into OpenCTI this way keeps only a name, a free-text description, a first-seen date and labels beside those three relationships, with no object or property for an incident's narratives, channels, evidence or countermeasures or for the confidence of its attribution

Graph View

Felipe Sánchez González, Javier Pastor-Galindo, José A. Ruipérez-Valiente (2025), arXiv preprint (cs.CR; the PDF footer says “Preprint submitted to Computer & Security”) — ARXIV-2502.20997

Key takeaways

  • Disinformation incidents can be carried in existing cyber-threat-intelligence infrastructure: DISARM TTP labels mapped to STIX 2.1 objects and served by an open-source exchange platform (DISINFOX). The authors validate this end to end with more than 100 real incidents ingested into OpenCTI.

Seeded from the abstract and a skim, before the reading in NOTE-028. What follows is what the work says about itself.

Cybersecurity has mature, standardised ways to model and exchange threat intelligence between organisations, but disinformation campaigns have no equivalent interoperable sharing. The authors propose an open-source framework with three parts. Incidents are modelled with DISARM, a MITRE ATT&CK-style taxonomy of disinformation tactics, techniques and procedures (TTPs). A custom mapping encodes DISARM-modelled incidents as STIX2 objects. A microservice exchange architecture, DISINFOX, stores the incidents centrally and serves them to CTI clients. The implementation is validated on more than 100 real-world incidents, and the authors claim it is the first academic and technical effort to bring disinformation into the CTI ecosystem.

Standing in the record

Filed from the survey of 2026-09-25 of work the anthology set aside as out of scope (tier B): 220 seconds of active reading over 5 sessions in the papers-feed tracker. It was filed Deferred, unread. NOTE-028 is the close reading of 2026-09-25, and it placed the work: Proposed — a working, clearly described proof of concept for carrying disinformation incidents as CTI. It is an unreviewed preprint with a deliberately minimal mapping and no evaluation beyond “it ingests”; what would settle it is peer-reviewed publication plus evidence that analysts use the shared incidents, or a comparison with DAD-CDM, which the authors themselves name as the emerging standard.

When seeded, before the reading in NOTE-028, the entry gave a priority for a deeper reading: medium — It is the one tier-B item in this batch and cleanly fileable, but the owner’s time on it was modest (t = 220 s), and the skim already captures the contribution (a framework comparison, a mapping and a platform). A deeper read would only add the details of the STIX mapping.

What the seeding asked a deeper reading to check (NOTE-028 is that reading):

  • It is a data-standards and systems paper, not an empirical study of disinformation. The validation shows that the pipeline works, not that sharing improves detection or response.
  • It pairs naturally with c02: the EEAS reports also encode FIMI incidents in STIX. Worth checking how closely DISINFOX’s mapping matches the EEAS/DISARM practice.
  • The future-work proposal (LLM-assisted TTP labelling) is the only ML hook, and it is unevaluated.
  • Tagging gap: society-and-governance covers information operations, but the vocabulary has no security or cyber-threat topic for the CTI half of the paper.

Access when seeded: Read the arXiv abs page (v1, 28 Feb 2025; no later version listed) and the full 36-page arXiv PDF. A Crossref title search on 2026-09-25 found no journal version, so the venue is unverified beyond the “submitted to” line. The keywords are the paper’s own.

Backlinks