# Blockchain-Based Model for Incentivized Cyber Threat Intelligence Sharing
## 3 Proposed Solution
### Implementation of the Model in the Blockchain  
The functionality of the model is implemented using smart contracts. The data structures used in the smart contracts are presented in Figure 3.  
In the figure, \"CTIData\" represents a single entry, and \"Points\" denotes a rating score for the CTI data. These points are determined by the reviewers after the entry is uploaded, meaning that the score is not assigned to the CTI data instantly. However, the reward score is assigned instantly to the CTI data producer to encourage them to share the data. The reward score for the CTI data producer can be either increased or decreased, depending on the reviews provided by the CTI data consumers.  
\"UserData\" includes a collected rating score (Points) for user activity and user subscription for CTI data.  
\"ReviewData\" refers to the permission for users to submit reviews for CTI data entries, specifying the user ID and CTI data ID. Predefined quality indicators of CTI data are included in ReviewData. Optional review text can also be provided.  
The general process of uploading and retrieving CTI data is depicted in Figure 4.  
Figure 4 does not include the operation for client registration with the blockchain, as these operations are generic for any kind of permissioned blockchain. We can observe that the numbers assigned to the operations show their sequence. The process starts by uploading new CTI data into the off-chain file storage IPFS. The operation is accomplished by the CTI data producer. We can also observe that the STIX data format is preferred for CTI data. The operation of uploading CTI data is detailed in Figure 5.  
Figure 2: View of Hyperledger Fabric network and client.  
Figure 5 shows that the advanced encryption standard (AES) algorithm is used to encrypt CTI data before uploading it into IPFS. After uploading the CTI data, the CTI data producer registers it with a blockchain. The CTI data consumers are informed, and they start to query the blockchain and download new CTI data.  
Figure 4: The general process of uploading and retrieving CTI data.  
Figure 3: Data structures used in smart contracts.  
Figure 6 presents the activities related to the review of CTI data. These activities are numerated in order of appearance. The labels to be read are as follows:  
1. The CTI data consumer submits a review to the Hyperledger Fabric blockchain.
2. The CTI data producer retrieves the review from the Hyperledger Fabric blockchain.
3. The CTI data producer assesses the review. If the review is valid, the producer informs the Hyperledger Fabric blockchain.
4. If the review is valid, the CTI data producer uploads the review next to the CTI data into IPFS.
5. IPFS returns a new hash for the CTI data, since the content of the data has changed.  
When a CTI data consumer submits a review of CTI data to the blockchain, the CTI data are assigned a score. The CTI data consumer also obtains a score for the provided review. Then, the producer of the CTI data downloads the review from the blockchain and  
Figure 5: The process of uploading CTI data into IPFS.  
Figure 6: Workflow of review of CTI data.  
assesses the validity of the review. If the review is valid, the CTI data producer informs the blockchain. The CTI data consumer obtains an additional score for the valid review. Then, the CTI data producer uploads the review next to the CTI data into IPFS. The CTI data producer is awarded a score for this action. Finally, the IPFS returns a new hash for the CTI data, which must be registered with the blockchain.