A Reputation-Based Approach Using Consortium Blockchain for Cyber Threat Intelligence Sharing

Abstract

The CTI (Cyber Threat Intelligence) sharing and exchange is an effective method to improve the responsiveness of the protection party. Blockchain technology enables sharing collaboration consortium to conduct a trusted CTI sharing and exchange without a centralized institution. However, the distributed connectivity of the blockchain-based CTI sharing model proposed before exposes the systems to byzantine attacks. The compromised members of partner organizations will further decrease the accuracy and trust level of CTI by generating false reporting. This paper proposes a new blockchain-based CTI model to address the unbalance issues of performance in speed, scalability, and security, which combines consortium blockchain and distributed reputation management systems to achieve automated analysis and response of tactical threat intelligence. In addition, the novel consensus algorithm of consortium blockchain that is fit for CTI sharing and exchange is introduced in this paper. The new consensus algorithm is called “Proof-of Reputation” (PoR) consensus, which meets the requirements of transaction rate and makes the consensus in a creditable network environment through constructing a reputation model. Finally, the effectiveness and security performance of the proposed model and consensus algorithm is verified by experiments.

A Systematic Literature Review on Cyber Threat Intelligence for Organizational Cybersecurity Resilience

“…Sharing and exchanging CTI through blockchain technology can enhance protection measures, but existing models are susceptible to attacks and false reporting. Zhang et al [ 34 ] proposed a novel blockchain-based CTI paradigm that integrates consortium blockchain and distributed reputation management systems for automated analysis and reaction to threat intelligence to overcome these problems. “Proof-of-Reputation” (PoR) consensus, a novel consensus method, satisfies the demand for a high transaction rate while establishing a reputation model for reliable network consensus.…”

“…“Proof-of-Reputation” (PoR) consensus, a novel consensus method, satisfies the demand for a high transaction rate while establishing a reputation model for reliable network consensus. Experimental testing of the suggested model and consensus process revealed that it is safe and effective [ 34 ].…”

“…K-CTIAA/BERT analysis An open-source APT [34] The authors of this paper present a collaborative cyber threat intelligence-sharing scheme to allow many enterprises to collaborate on the design, training, and evaluation of a powerful ML-based network intrusion detection system.…”

Cyber Threat Intelligence on Blockchain: A Systematic Literature Review

“…Zhang et al [65] introduce a blockchain-based CTI model addressing performance issues in terms of speed, scalability, and security. The model combines consortium blockchain and distributed reputation management systems to enable automated analysis and response to tactical threat intelligence.…”

“…Additionally, the dimension of reputation plays a pivotal role in enabling trust-based architectures within CTI and blockchain integration [32,33,41,65,74]. Reputation mechanisms within the blockchain ecosystem can enhance the reliability of participants and the information they share.…”