# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 3 Background  
In this section, we explain the main topics that are used to approach our proposal for secure operation in big data environments. Blockchain technology serves as a tool to store the different data that will be used in managing the state of the ecosystem, as well as to analyze and respond to incidents that occur. Hence, the inherent characteristics of this type of technology will be used to guarantee the immutability and traceability of the data, thus increasing the security of the big data ecosystem. In addition, our proposal does not attempt to manage the entire operation of the big data ecosystem (including aspects such as system performance), but rather seeks to secure the environment during its operation phase. Normally, this type of action is carried out through an incident response process. In this section, the main incident response standards are explained. It is also important to recognize that big data ecosystems are often very complex, with a large number of technologies available for the implementation of different requirements. In order to make our proposal useful for any type of organization in any context, it is necessary to have a global perspective of what defines a big data ecosystem. In that sense, the reference architectures (RAs), and more specifically the security reference architectures (SRAs), have proven to be valuable guides in defining different environments [27; 28]. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline \multirow{2}{*}{**Proposals**} & **Incident** & **Methodological** & **Security** & **Blockchain** & **Machine** \\  & **Response** & **Approach** & **Aspects** & **Technologies** & **Learning** \\ \hline Big data with & & & & & \\ blockchain [16; 17] & & & & & \\ Big data operation & & & & & \\ monitor [18; 19] & & & & & \\ Machine learning & & & & & \\ for security [20; 21; 22; 23] & & & & & \\ Machine learning & & & & & \\ for incident & & & & & \\ response [24; 25] & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of the related work. The components specified by the SRA will be used in our proposal to guide us in covering all the characteristics of a big data ecosystem. Blockchain is a fault-tolerant, peer-to-peer node network that operates on the principle of transactional agreement and with no central entity. For this operation to work, all parties validate each other's transactions using an agreed consensus algorithm and aggregate them into blocks, building the structure of the block chain [29]. The uses of blockchain technology are varied, and range from the creation of smart contracts to supply chain auditing. In addition, the integration of blockchain technology in big data ecosystems allows there to be an increase in the security and value of the data in the system. This is because the data it handles are more reliable and valuable, as they cannot be accessed, modified, or eliminated without the operation being stored in blockchain; traceability of the operations performed is therefore possible [30]. In comparison with traditional technologies, such as logs (even if implemented as append-only) or relational databases, the main difference between their use and blockchain lies in the addition of new capabilities beyond data storage. It enables at the protocol level the use of cryptography or smart self-executable contracts that help ensure the immutability of digital assets and traceability of data. In addition, the use of consensus algorithms can secure data integrity for all nodes participating in the distributed network [31]. There are several proposals from the scientific community that use blockchain technologies to improve the security of distributed systems in various ways. These include maintaining digital evidence of operations carried out in a system [32] to improve the security of their communications [33], in the effort to preserve personal data from unauthorized access [34].