Threat Intelligence Sharing Model and Profit Distribution Based on Blockchain and Smart Contracts

The new generation of cyber threat attacks has gradually shifted to APT attacks. The attack technology is complex and changeable. The sharing of threat intelligence can improve network defense capabilities. However, privacy issues, trust issues, and sharing mechanisms make the sharing process inefficient. The characteristics of decentralization, anonymity, and non-tamperability are suitable for solving problems in threat intelligence sharing. In this paper, we propose a new threat intelligence sharing model based on the alliance chain in blockchain technology: CITAShare, which includes a distributed architecture database, and the update of data relies on the consensus algorithm. We build the model to implement the process of sharing threat intelligence through smart contracts and solved the privacy issues in the sharing process consequently. Additionally, we find that current intelligence sharing platforms often lack an effective incentive mechanism, so we propose a profit distribution method based on improved Shapley value to motivate the sharers. Our scheme guaranteed rationality in the operational perspective by using the smart contract in the specific distribution process.