Cyber-threat score generation using machine learning and reflecting quality of sources

A cyber-security analysis system, comprising:

• at least one processor;
• and
• a memory operably coupled to the at least one processor and storing instructions that, when executed, cause the at least one processor to:
• receiving a training data set including an unlabeled first plurality of threat indicators and a first plurality of verdicts, each verdict from the first plurality of verdicts determined by a corresponding source from a plurality of sources and associated with and classifying a corresponding threat indicator from the first plurality of threat indicators;
• the training data set further including a pre-labeled second plurality of threat indicators and a plurality of reliable labels, each label from the plurality of labels associated with and classifying a corresponding threat indicator from the second plurality of threat indicators;
• training a machine learning (ML) model to produce a trained ML model based on the training dataset, the first plurality of verdicts, and the labels of the plurality of labels to classify the first plurality of threat indicators, wherein each verdict and each label serves as a vote for the corresponding threat indicator;
• receiving, from a subset of the plurality of sources, a new threat indicator;
• identifying, for each source from the subset of the plurality of sources, a verdict serving as a vote associated with the new threat indicator, to define a second plurality of votes;
• generating by executing the trained ML model on the new threat indicator, a cyber-threat score for classifying the new threat indicator;
• the cyber-threat score reflecting qualities of the sources in providing verdicts;
• and
• send a signal to cause at least one of display via a graphical user interface (GUI) or storage of the threat score;
• and
• wherein the training of the ML model further includes analyzing vote data indicating, with respect to each threat indicator of the first plurality of threat indicators at least one of agreements among the votes from the first plurality of verdicts or disagreements among the votes from the first plurality of verdicts;
• generating quality metrics for each of the sources based on the analyzing of the vote data;
• and using the generated quality metrics as learned quality metrics associated with the sources in further training the ML model;
• and
• wherein generating the cyber-threat score comprises computing a probability serving as the cyber-threat score by weighting the vote of the corresponding source of the plurality of sources by the learned quality metrics for the corresponding source to form a weighted value, and aggregating the weighted values associated with the plurality of sources.