Method for collecting cyber threat intelligence data and system thereof

A management server for collecting cyber threat intelligence (CTI) data provided from an open source intelligence (OSINT) providing source, the server comprising:

• an environment configuring unit configured to determine agent configuration values associated with the OSINT providing source;
• an external communications interface configured to transmit the agent configuration values to an agent and to receive data collection status information and the CTI data from the agent;
• a distributed processing determining unit configured to determine a workload for the OSINT providing source based on the data collection status information and to determine whether to perform distributed processing of a data collection task for the OSINT providing source based on the workload;
• and
• a distributed processing performing unit configured to determine agent configuration values so that the agent performs the distributed processing if it is determined to do so.

A method for collecting cyber threat intelligence (CTI) data provided from an open source intelligence (OSINT) providing source, the method comprising:

• determining agent configuration values associated with the OSINT providing source;
• performing a data collection task for collecting the CTI data based on the agent configuration values;
• acquiring data collection status information indicative of a progress of the data collection task;
• and
• logging the CTI data into a threat information database and the data collection status information in a system database.

A computer program stored in a non-transitory computer-readable storage medium, wherein instructions of the computer program, when executed by a data collection system, cause the system to perform:

• determining agent configuration values associated with an open source intelligence (OSINT) providing source;
• performing a data collection task for collecting a cyber threat intelligence (CTI) data based on the agent configuration values;
• acquiring data collection status information indicative of a progress of the data collection task;
• and
• logging the CTI data into a threat information database and the data collection status information in a system database.