In the battle against ever-changing cyber threats, a new ally has joined in: Cyber Threat Intelligence. Evolved from historical blacklists and anti-virus, Threat Intelligence aims to protect and inform its clients against both nation state actors, as well as cyber criminals. Threat Intelligence comes in many shapes and sizes, and for a wide range of prices. For the average consumer of Threat Intelligence, it is unknown which form will fit their needs, nor which price range is suitable for them.

This mystery surrounding Threat Intelligence, caused by its prohibitively high pricing, shows in the limited amount of research that has been conducted on the topic. Bouwman et al. lifted a tip of the veil, interviewing professionals regarding their use of Threat Intelligence and presenting descriptive statistics of its contents. They found very limited overlap between Threat Intelligence sources and that acquisition is largely based on gut-feeling. However, it is still largely unknown if these findings generalize to the whole field of Threat Intelligence and if these findings on macro level translate to more granular levels, it is our goal to find this out.

In this study, a analysis was performed to analyze why there are differences in port configuration between IPv4 and IPv6. For this, the current state of adoption and implantation processes of IPv6 were researched. Currently, 4,8% of all dual-stack hosts have a different configuration in open ports on IPv4 and IPv6. To discover the reasoning behind these differences, thirteen interviews were performed with owners of presumed misconfiguration or network security experts. Discovered was that most of the configurations were unintentional and because of unawareness and adequate knowledge of IPv6. Furthermore, an analyzes was performed about the reasons behind the lack of knowledge and awareness and discovered that at the moment, there is no compelling reason to migrate from IPv4 to IPv6 in most western countries. The lack of knowledge and awareness could be a reason why there is a 4,8% difference in IPv4, IPv6 configuration. Furthermore, noticed was that there is no clear solution to the problem and that there is no central actor that can solve this problem.

Dit rapport is geschreven in het kader van de tweede fase van het vak ’Bachelor-eindproject’ van de bacheloropleiding Technische Bestuurskunde aan de Technische Universiteit Delft. Het rapport is geschreven naar aanleiding van het issue-paper dat ik voor de eerste fase van dit project geschreven heb over het bestrijden van financiële, economische en fiscale fraude met een cybercomponent. Het onderzoek betreft het ontwerp van een methode om de betrokkenheid van een land bij de handel op online anonieme markten in kaart te brengen op productniveau. Deze methode is ontworpen aan de hand van het proces voor Data Mining en maakt voor de analyse gebruik van machine learning technieken en methodes voor content-based geo-location estimation ontworpen voor social media platformen zoals Twitter. De toepasbaarheid en het resultaat van de methode is in de praktijk getest door de toepassing van de methode op de casus van de FIOD.