ThreatLens: desenvolvimento de API para o back-end

Abstract

This work presents the development of ThreatLens, a back-end application (REST API) responsible for centralizing, authenticating, and securely serving filtered and aggregated cyber threat intelligence messages already collected and classified by previous works developed at the School of Computer Science of the Federal University of Uberlândia (FACOM/UFU). To this end, a user authentication and management module was implemented based on JSON Web Token (JWT), with persisted, revocable refresh tokens, along with a module for querying messages (posts) collected from public Telegram channels, supporting filtering by source, relevance, category, and period, pagination, sorting, aggregated statistics, and word clouds. The multi-source data access layer was designed using the Strategy design pattern, allowing new sources to be incorporated without changes to the already implemented business logic. The functional evaluation, carried out through HTTP requests submitted to the implemented endpoints, confirmed compliance with the specified functional and non-functional requirements. As a result, the proposed architecture advances toward bridging the integration gap identified among the related works through a single, extensible API layer – although only the Telegram source is currently integrated, leaving the incorporation of new sources and integration with the alert module as directions for future work.