Cyber Threat Intelligence Teaching and Research at the University of Sannio

Overview of the teaching and doctoral research activities of Pietro Melillo, Ph.D. at the University of Sannio (Ph.D. in Information Technology for Engineering, 2026).

Teaching Activities

I deliver lectures within the Security of Networks and Software Systems course and serve as Cultore della materia, covering:

• the Cyber Threat Intelligence lifecycle and intelligence requirements;
• Indicators of Compromise (IoCs) and behavioral indicators (IoAs);
• OSINT and CLOSINT collection workflows;
• threat actor profiling and attack modeling;
• ransomware groups and extortion business models;
• CTI platforms and tools including MISP, Shodan, VirusTotal, IntelX, Have I Been Pwned, and dark web monitoring systems.

Doctoral Research

My Ph.D. dissertation (Ecosystem Dynamics and Structural Resilience of the Ransomware Economy: A Longitudinal, Multi-Method Analysis of the Observable Disclosure Surface (2020–2025)) was completed under the supervision of Prof. Corrado Aaron Visaggio (University of Foggia) and co-supervision of Prof. Andrea Di Sorbo (University of Sannio).

The research focuses on:

• longitudinal tracking of ransomware gangs and Data Leak Site disclosures;
• RaaS business models, affiliate churn, and structural resilience;
• Threat Intelligence Platform (TIP) engineering and OSINT/CLOSINT microservice pipelines;
• empirical and ML-assisted behavioral analysis of ransomware TTPs.

Research & Community Collaborations

• JanaraLab (University of Sannio cybersecurity research group)
• DarkLab (Red Hot Cyber CTI team, led by Pietro Melillo, Ph.D.)