# TrustShare: Secure and Trusted Blockchain Framework for Threat Intelligence Sharing
## 3 Materials and Methods
### Materials
#### 3.1.2 Structured Threat Information eXpression (STIX)  
STIX is a standardized language and framework for sharing structured threat intelligence across different organizations and security systems [8; 48]. It enables the collection, analysis, and sharing of valuable information about threats, vulnerabilities, and related data [6; 49; 50]. This exchange of intelligence helps organizations to enhance their situational awareness, improve incident response, and collaborate effectively to mitigate security risks. By facilitating the sharing of threat intelligence, STIX aims to create a more unified and proactive defense against cyber threats [51]. The STIX Architecture offers a robust framework for sharing and expressing security threat intelligence. It comprises three main elements: the foundational STIX Core, which structures threat data; the standardized vocabulary of the STIX Language for consistent communication; and the STIX Cyber Observable Object (CybOX), which captures technical observables of cyber threats [8]. This architecture enables effective sharing and analysis of threat intelligence, improving detection and response to security incidents. Furthermore, it fosters interoperability among security tools, automating the exchange of threat intelligence across the cybersecurity ecosystem. The STIX Data Model is a structured framework for sharing cybersecurity information in a standardized format. It uses a hierarchical structure with entities like indicators and threat actors, connected through relationships. Each entity has specific properties detailing its attributes. This standardized model ensures consistency and interoperability across security tools, allowing organizations to efficiently share, analyze, and act on threat intelligence for enhanced asset and network protection. STIX proves effective in cybersecurity through various use cases [52]. Organizations collaborate to share threat information, indicators, and incident details, enhancing collective defense. Integration with security tools enables automated analysis, ensuring quicker detection and response to emerging threats. Large Language Models (LLMs) represent a significant advancement in AI technology, offering powerful tools for communication and threat data analysis. These models are used for understanding context, enhancing security, and ensuring proper threat formatting (STIX-TAXII). We proposed the use of Private LLMs to understand the content of threat sharing and to learn from each agency's specific context, whereby we use the Llama dataset and our own data synthesis to enhance datasets and maintain the privacy of our data. This approach can automate the formatting and protection of shared data, enhancing both efficiency and security. STIX supports proactive threat hunting, allowing analysts to search for potential threats across diverse sources, empowering teams to identify and counter advanced persistent threats [53]. These use cases underscore STIX's value in promoting information sharing, automated analysis, and proactive defense strategies in the cybersecurity community. Expanding our arsenal for a robust threat intelligence sharing framework within Hyperledger Fabric, we introduce STIX Threat File Sharing. STIX, the globally recognized language for cyber threat information, joins our ensemble to standardize and streamline threat communication. This integration enhances collaboration, breaking down organizational and technological silos for a more universally understood and shared cybersecurity landscape. In conclusion, Structured Threat Information eXpression (STIX) offers a standardized framework for representing and sharing cyber threat information. Through a common data model, STIX enables structured and machine-readable exchange of threat intelligence. Key concepts like indicators, threat actors, and TTPs allow for consistent and detailed threat representation, enhancing analysis and defensive measures.