SavedAdd your journal

Journals / Güvenlik Stratejileri Dergisi / 2026 / Cilt: 22 Sayı: 53

Vulnerability-Based Enrichment of Türkiye-Specific Cyber Threat Intelligence: Proactive Threat Hunting and Critical Vulnerability Analysis with TR-CERT and Exploit-DB Integration

Türkiye’ye Özgü Siber Tehdit İstihbaratının Zafiyet Tabanlı Zenginleştirilmesi: USOM ve Exploit-DB Entegrasyonu ile Proaktif Tehdit Avcılığı ve Kritik Zafiyet Analizi

Hüseyin Parmaksız(BILECIK SEYH EDEBALI UNIVERSITY)0000-0001-8455-5625
Pages
155–184
Publication Date
2026-04-27
🏛️Bibliographic metadata and full text access for this article are provided via DergiPark.
DergiPark Record ↗
✨

AI Summary & Key Takeaways

AI Insight
⚡ TL;DR(Too Long; Didn't Read)

The findings underscore that integrating exploit-focused vulnerability intelligence into national cyber threat intelligence processes can significantly enhance the development of more effective and intelligence-driven cyber defense architectures in rapidly evolving threat environments.

📌 3 Key Takeaways

🎯
Objective & Hypothesis:This study introduces a framework for cyber threat intelligence aimed at enhancing Türkiye’s proactive cybersecurity capabilities, specifically addressing security vulnerabilities.
📊
Key Findings & Data:A geographic analysis involving 11,911 malicious IP addresses and 6,927 malicious URLs from the National Cyber Incident Response Center (TR-CERT) facilitated the formation of intelligence-driven geographic blocking firewall policies, thus reinforcing proactive network defense strategies.
💡
Conclusion & Impact:The findings underscore that integrating exploit-focused vulnerability intelligence into national cyber threat intelligence processes can significantly enhance the development of more effective and intelligence-driven cyber defense architectures in rapidly evolving threat environments.
🔬Design:Modeling & Simulation
📍Scope:Comprehensive Sample
⚙️Variables:Exploit-DB · Monte Carlo · OWASP

Abstract

This study introduces a framework for cyber threat intelligence aimed at enhancing Türkiye’s proactive cybersecurity capabilities, specifically addressing security vulnerabilities. A geographic analysis involving 11,911 malicious IP addresses and 6,927 malicious URLs from the National Cyber Incident Response Center (TR-CERT) facilitated the formation of intelligence-driven geographic blocking firewall policies, thus reinforcing proactive network defense strategies. The research correlated threat indicators from TR-CERT with exploit intelligence from the open-source Exploit-DB platform, establishing connections between Indicators of Compromise (IoCs) and security vulnerabilities. Risk calibration maps were developed to match these vulnerabilities with the Open Web Application Security Project (OWASP) Top 10 risk categories and validated against the National Vulnerability Database (NVD). This prioritization took into account vulnerability prevalence, Common Vulnerability Scoring System (CVSS) scores, exploitability levels, and potential impact. In addition, a dynamic risk scoring model based on Monte Carlo simulation was also used to estimate vulnerability risks, with exploitability serving as the probability parameter and CVSS scores as the impact parameter. The findings underscore that integrating exploit-focused vulnerability intelligence into national cyber threat intelligence processes can significantly enhance the development of more effective and intelligence-driven cyber defense architectures in rapidly evolving threat environments.

Özet

Bu çalışma, Türkiye’nin proaktif siber güvenlik yeteneklerini geliştirmeyi ve özellikle güvenlik açıklarını ele almayı amaçlayan bir siber tehdit istihbarat çerçevesi sunmaktadır. Ulusal Siber Olay Müdahale Merkezi’nden (USOM) alınan 11.911 kötü niyetli IP adresi ve 6.927 kötü niyetli URL’yi içeren coğrafi analiz, istihbarata dayalı coğrafi engelleme güvenlik duvarı politikalarının oluşturulmasını kolaylaştırarak proaktif ağ savunma stratejilerini güçlendirmiştir. Araştırma, USOM’dan alınan tehdit göstergelerini açık kaynaklı Exploit-DB platformundan elde edilen istismar istihbaratıyla ilişkilendirerek, tehdit göstergeleri (IoC’ler) ile güvenlik açıkları arasında bağlantılar kurmuştur. Bu güvenlik açıklarını Açık Web Uygulama Güvenliği Projesi (OWASP) Top 10 risk kategorileriyle eşleştirmek için risk kalibrasyon haritaları geliştirilmiş ve Ulusal Güvenlik Açığı Veritabanı ile karşılaştırılarak doğrulanmıştır. Bu önceliklendirme, güvenlik açığının yaygınlığı, Ortak Güvenlik Açığı Puanlama Sistemi (CVSS) puanları, istismar edilebilirlik seviyeleri ve potansiyel etkiyi dikkate almıştır. Ayrıca, Monte Carlo simülasyonunu kullanan dinamik bir risk puanlama modeliyle, istismar edilebilirliği olasılık parametresi ve CVSS puanlarını etki parametresi olarak kullanarak güvenlik açığı risklerini tahmin edilmiştir. Bulgular, istismara odaklı güvenlik açığı istihbaratının ulusal siber tehdit istihbarat süreçlerine entegre edilmesinin, hızla gelişen tehdit ortamlarında daha etkili ve istihbarat odaklı siber savunma mimarilerinin geliştirilmesini önemli ölçüde artırabileceğini vurgulamaktadır

🔖

Cite This Article

Parmaksız, H., *, H. P. (2026). Vulnerability-Based Enrichment of Türkiye-Specific Cyber Threat Intelligence: Proactive Threat Hunting and Critical Vulnerability Analysis with TR-CERT and Exploit-DB Integration. Güvenlik Stratejileri Dergisi, Cilt: 22 Sayı: 53, 155–184. https://doi.org/10.17752/guvenlikstrtj.1792238

📄 Full Text PDF Viewer

📄

PDF görüntüleyici hazırlanıyor...

References (45)

  1. Akkanat, U. (2025). The impact of e-government applications on countries’ cybersecurity (Master’s thesis, Istanbul Aydin University, Türkiye).
  2. Allodi, L., & Massacci, F. (2017). Security events and vulnerability data for cybersecurity risk estimation. Risk Analysis, 37(8), 1606-1627. https://doi.org/10.1111/risa.12864
  3. Bıçakcı, S., Ergun, F. D., & Çelikpala, M. (2015). Türkiye’de siber güvenlik. Ekonomi ve Dış Politika Araştırma Merkezi (EDAM) Siber Politika Kağıtları Serisi, (1), 1-35.
  4. Brundage M., Avin S., Clark J., Toner H., Eckersley P., Garfinkel B., Dafoe A., Scharre P., Zeitzoff T., Filar B., Anderson H., Roff H., Allen G. C., Steinhardt J., Flynn C., hÉigeartaigh S. Ó, Beard SJ, Belfield H., Farquhar S., Lyle C., Crootof R., Evans O., Page M., Bryson J., Yampolskiy R. & Amodei D. (2018). The malicious use of artificial intelligence: Forecasting, prevention, and mitigation. arXiv. https://doi.org/10.48550/arXiv.1802.07228
  5. Burgess, J. (2022). Malware and exploits on the dark web. arXiv. https://doi.org/10.48550/arXiv.2211.15405
  6. Canadian Centre for Cyber Security. (2024). Cyber security readiness goals: Securing our most critical systems. Accessed: 22 December 2025, https://www.cyber.gc.ca/en/cyber-security-readiness/cybersecurity-readiness-goals-securing-our-most-critical-systems
  7. CISA. (2023). Cyber hygiene services and threat intelligence sharing. U.S. Cybersecurity and Infrastructure Security Agency. Accessed: 11 September 2025, https://www.cisa.gov
  8. Creemers, R. (2023). Cybersecurity law and regulation in China: Securing the smart state. China Law and Society Review, 6(2), 111-145. https://doi.org/10.1163/25427466-06020001
  9. CTC. (2025). Key cyber threat intelligence sources you should know. Accessed: 23 December 2025, https://cybertechconnection.com/key-cyber-threat-intelligence-sources-you-should-know/
  10. Çakır, H., & Taşer, M. (2023). Türkiye’de yapılan siber güvenlik faaliyetlerinin ve eğitim çalışmalarının değerlendirilmesi. Gazi University Journal of Science Part C: Design and Technology, 11(1), 1-11. https://doi.org/10.29109/gujsc.1165131
  11. Çiçek, A. E. (2025). Türkiye’nin yapay zeka tabanlı siber güvenlik stratejisi: Ulusal güvenliği güçlendirmek ve küresel siber yönetişime yön vermek. Yönetim Bilimleri Dergisi, 23(56), 993-1012. https://doi.org/10.35408/comuybd.1584175
  12. Çifci, H. (2024). Cybersecurity Maturity of Turkey: An Assessment with ENISA’s National Capabilities Assessment Framework (NCAF). Savunma Bilimleri Dergisi, 20(2), 191-210. https://doi.org/10.17134/khosbd.1450078
  13. Darıcılı, A. B. (2019). Türkiye’nin siber güvenlik politikalarının analizi; Türkiye’nin siber güvenlik modeli için öneriler. TESAM Akademi Dergisi, 6(2), 11-33. https://doi.org/10.30626/tesamakademi.613517
  14. ENISA. (2022). National cybersecurity strategies - State of implementation in the EU. European Union Agency for Cybersecurity. Accessed: 22 September 2025, https://www.enisa.europa.eu/topics/stateof-cybersecurity-in-the-eu/national-cybersecurity-strategies
  15. Offensive Security. (2025). The Exploit Database is maintained by OffSec, an information security training company offering various certifications and penetration testing services. OffSec. Accessed: 24 September 2025, https://www.exploit-db.com/
  16. EXPLOIT DB Git REPOSITORY. (2025). This official repository of The Exploit Database, sponsored by Offensive Security, provides access to exploits and shellcodes. Accessed: 24 September 2025, https://gitlab.com/exploit-database/exploitdb/-/blob/main/files_exploits.csv
  17. Gündoğdu, S. (2023). Uluslararası politikada bir etki aracı olarak siber güvenlik ve Türkiye’nin siber güvenlik politikası uygulaması: Ulusal Siber Olaylara Müdahale Merkezi (USOM). Fırat University Journal of Social Sciences, 33(3), 1325-1337. https://doi.org/10.18069/firatsbed.1261707
  18. Halisdemir, E. (2021). National cybersecurity organisation: Turkey. NATO Cooperative Cyber Defence Centre of Excellence.
  19. Hekim, H., & Başıbüyük, O. (2013). Siber suçlar ve Türkiye’nin siber güvenlik politikaları. Uluslararası Güvenlik ve Terörizm Dergisi, 4(2), 135-158.
  20. INFOSECWRITEUPS. (2025). OWASP Top 10 2025: What to expect. Accessed: 27 September 2025, https://infosecwriteups.com/owasp-top-10-2025-what-to-expect-22b8ede0c428
  21. ITU. (2017). Final report, World Telecommunication Development Conference (WTDC-17), Buenos Aires, Argentina, 9-20 October 2017. Accessed: 23 December 2025, https://www.itu.int/en/ITU-D/Conferences/WTDC/WTDC17/Documents/WTDC17_final_report_en.pdf
  22. Jacuch, A. (2021). Comparative analysis of cybersecurity strategies: European Union strategy and policies, Polish and selected countries strategies. Online Journal Modelling the New Europe, 37, 102-120.
  23. Karasoy, H. A., & Babaoğlu, P. (2021). Türkiye’de siber güvenlik: Yasal ve kurumsal altyapı. Yasama Dergisi, 44, 123-155.
  24. Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019). Survey of intrusion detection systems: Techniques, datasets and challenges. Cybersecurity, 2(1), 1-22. https://doi.org/10.1186/s42400-019-0038-7
  25. KISA. (2024). Korea’s 2024 national cybersecurity white paper. Korea Internet & Security Agency. Accessed: 25 September 2025, https://www.kisa.or.kr/EN/302
  26. Kushwaha, A. S. (2026). AI-Based Threat Intelligence Sharing on Decentralized Networks. Scientific Journal of Artificial Intelligence and Blockchain Technologies, 3(1), 45-56.
  27. MaxMind. (2025). GeoLite2 country, city, and ASN databases. Accessed: 23 September 2025, https://github.com/P3TERX/GeoLite.mmdb
  28. Melek, A., & Öztürk, C. (2024). Bakan Uraloğlu: 97 binin üzerinde zararlı bağlantı tespit ederek erişimlerini engelledik. Demirören Haber Ajansı. Accessed: 20 September 2025, https://www.dha.com.tr/politika/bakan-uraloglu-97-bininuzerinde-zararli-baglanti-tespit-ederek-erisimlerini-engelledik-2519631
  29. Nawrocki, M., & Kołodziej, J. (2024). Vulnerabilities of web applications: Good practices and new trends. Applied Cybersecurity & Internet Governance, 3(2), 122-143. https://doi.org/10.60097/ACIG/199521
  30. NVD. (2025). National Vulnerability Database vulnerability search. Accessed: 26 September 2025, https://nvd.nist.gov/vuln/search#/nvd/home?resultType=records
  31. OWASP Foundation. (2025). Open Web Application Security Project. Accessed: 26 January 2026, https://owasp.org/www-project-top-ten
  32. PENTA SECURITY. (2025). OWASP Top 10 2025 prediction: AI, API, cloud, and supply chain risks. Penta Security Blog. Accessed: 26 September 2025, https://www.pentasecurity.com/blog/owasp-top-10-2025-prediction/
  33. Rid, T., & McBurney, P. (2012). Cyber-weapons. The RUSI Journal, 157(1), 6-13. https://doi.org/10.1080/03071847.2012.664354
  34. Scarfone, K., & Mell, P. (2007). Guide to intrusion detection and prevention systems (IDPS). NIST Special Publication, 800(2007), 94.
  35. Sertçelik, A. (2015). Siber olaylar ekseninde siber güvenliği anlamak. Medeniyet Araştırmaları Dergisi, 2(3), 25-42.
  36. Seymour, J., & Tully, P. (2016). Weaponizing data science for social engineering: Automated E2E spear phishing on Twitter. Black Hat USA (Vol. 37, pp. 1-39).
  37. Sharma, M. (2020). India and China: Warnings ignored? National cyber emergencies (pp. 60-75). Routledge.
  38. Skopik, F. (Ed.). (2017). Collaborative cyber threat intelligence: Detecting and responding to advanced cyber attacks at the national level. CRC Press.
  39. Soldatov, A., & Borogan, I. (2015). The red web: The struggle between Russia’s digital dictators and the new online revolutionaries. Hachette UK.
  40. USOM. (2025). The USOM API provides continuous access to malicious IPv4, IPv6, IPv6net, URL, and domain addresses. Türkiye Ulusal Siber Olaylara Müdahale Merkezi. Accessed: 24 September 2025, https://www.usom.gov.tr/api/
  41. Ünver, M. (2023). Türkiye’de siber güvenlik.
  42. Vance, T. R. (2023). Examination of applications of artificial intelligence in cybersecurity: Strengthening national defense with AI. International Journal of Computer Science and Information Technology Research, 11(3), 77-90. https://doi.org/10.5281/zenodo.8210374
  43. Wilhelm, T. (2025). Professional penetration testing: Creating and learning in a hacking lab. (pp. 401-446). Elsevier.
  44. Zetter, K. (2015). Countdown to zero day: Stuxnet and the launch of the world’s first digital weapon. Crown.
  45. Zhao, B. Z. H., Ikram, M., Asghar, H. J., Kaafar, M. A., Chaabane, A., & Thilakarathna, K. (2019, July). A decade of mal-activity reporting: A retrospective analysis of internet malicious activity blacklists. Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security (pp. 193-205). https://doi.org/10.1145/3321705.3329834