# Blockchain-Based Model for Incentivized Cyber Threat Intelligence Sharing
## 1 Introduction  
Cyberattacks are constantly expanding to new domains of the public and private sectors. No organization with access to the internet is safe from cyberattacks. In the SANS annual report of the 2023 CTI survey [1], a notable increase was observed in the diversity of fields that contributed to the CTI survey. These fields included civil engineering, construction, agriculture, mining, health, law, and gaming. Such a diversity of fields means that cyberattacks are expanding their horizons. However, not only are more organizations involved in the reality of the digital world, but new technological artifacts are also coming into use, thus opening up new opportunities for cyberattacks. A cyber threat analysis must be performed on a constant basis to keep up to date with the changing landscape of cyberattacks. Cyber threat intelligence (CTI) is the result of cyber threat analyses. CTI can be divided into four levels in decreasing hierarchical order: strategic, tactical, technical, and operational [2, 3]. A CTI data-sharing system plays an important role, as organizations cannot defend themselves in isolation from emerging threats [4]. Stakeholders and practitioners are not keen on sharing CTI data due to the risk of exposing their private data and potentially losing value on the market. Trust is one of the main factors in sharing CTI. In their systematic review on using blockchain for sharing CTI, [PERSON] and [PERSON] [4] found that trust and privacy are predominantthemes in this research field. However, the privacy of information and trust are not the only hurdles encountered when sharing CTI; other attributes of intelligence also play an important role, [5], including accuracy, timeliness, usability, completeness, precision, and dependability. These attributes characterize various aspects of the quality of CTI data. Achieving all of these attributes together is usually impossible due to competing demands. Therefore, the trust and quality of shared CTI are essential factors in persuading stakeholders and practitioners to allow their private data to be made available to the interested parties. Thus, CTI data sharing raises a tremendous necessity to create a trusted system that would possess the characteristics of validity, security, privacy, and traceability [6]. With a system that possesses the aforementioned characteristics, CTI users can produce automated and meaningful reports detailing existing threats. Analyzing such reports and proactively implementing appropriate measures can help to reduce the risk of potential cyber threats. Traditional network systems for information sharing often follow a centralized approach and, thus, have a single point of failure that can be targeted by malicious actors. Meanwhile, a decentralized system is able to prevent the problems of a centralized system. Blockchain is a prominent representative of decentralized systems. Blockchains can operate in permissioned/permissionless and public/private modes [4]. A permissioned blockchain restricts access to the network to a predefined set of participants, who are known and trustworthy participants. Permissioned blockchains are appropriate applications when higher levels of control and confidentiality are required. Such a blockchain possesses the following attractive features for CTI data sharing: immutability, transparency, and traceability. These features are not related to the operation mode of the blockchain. However, the blockchain possesses features that are not attractive for CTI data sharing: a lack of scalability, latency, privacy issues, and limited data storage. The problem of limited data storage is usually solved using an Interplanetary File System (IPFS), when the storage of data is accomplished off-chain [7]. IPFS contributes to improving scalability as well. A private blockchain enables enhanced privacy and trust, as the blockchain grants access to trustworthy participants.