Re: [cti] Current status on Confidence, Intel Note, and Opinion

[Alexandre Dulaunoy <Alexandre.Dulaunoy@circl.lu>]

On 30/03/17 20:19, Patrick Maroney wrote:
> .02: 
> 
> Re: Subjective Measures
> 
> Since we evidently have consensus on the 0-100 scale for confidence, we should adopt this representation for all subjective measures, assertions, etc.   We should be able to apply consistent methods to process these mathematically/statistically.  

We are also already in-line with the various MISP taxonomies representation with the 0-100 scale.

This is pretty much what we had in mind when we faced a similar decision. Ultimately we ended up using a similar 0-100 scale as described here:	

https://github.com/MISP/misp-taxonomies/blob/master/misp/machinetag.json#L40

We strongly favour this consensus too.

> 
> Example:
> 
> An "opinion" is an assertion by an entity.  Like all subjective  measures, one might want/need to assign a weight/scaling factor to an "opinion" on the basis of the receiving entities rating for this source (or sources in the aggregate).
> 
> Therefore, if we adopt a common scale and numeric representation for all of these subjective types of measures and representations, we can easily calculate  (e.g., sum, average, std deviation), weight, aggregate, etc.

True.

Cheers.

-- 
Alexandre Dulaunoy
CIRCL - Computer Incident Response Center Luxembourg
41, avenue de la gare L-1611 Luxembourg
info@circl.lu - www.circl.lu