# TrustShare: Secure and Trusted Blockchain Framework for Threat Intelligence Sharing
## 2 Background
### Cyber Threat Intelligence Overview  
While conventional security tools such as antivirus software and endpoint detection and response solutions exhibit a degree of effectiveness, their capability falters in identifying emerging threats like zero-day attacks [1]. The escalating threat landscape emphasizes the growing significance of cyber threat intelligence, providing insightful analysis on both potential and existing threats to generate valuable intelligence information. Sharing this information elevates defense systems from passive and active to a proactive approach through collaborative efforts [2].  
Cyber threat intelligence refers to the collection, analysis, and production of structured data and intelligence information about potential cyber threats and then disseminating it among trusted organizations. Threat intelligence encompasses insights into potential cyber threats and risks to an organization's information systems, infrastructure, and data [3].  
CTI involves gathering information from various sources to convert raw data into information and then into actionable intelligence. These sources often include internal logs, external threat feeds, open-source intelligence (OSINT), dark-web monitoring, security incidents, and event management systems [4; 5].  
Data gathered by cyber threat intelligence is analyzed to identify patterns, trends, and possible risks. Following that, this intelligence is disseminated among security communities in order to enhance collaborative activities intended to improve overall security.  
Figure 2 illustrates the CTI lifecycle stages. The threat intelligence lifecycle involves  
1. Data collection from different sources.
2. Processing and analysis.
3. CTI production.
4. Dissemination among trusted users and a feedback loop.  
Effective CTI, which requires the expertise of skilled analysts, the utilization of advanced technologies, and a strong emphasis on collaboration, enables organizations to proactively identify and mitigate risks, thereby enhancing their overall security postures [3].  
The purpose of cyber threat intelligence is to enable organizations to make informed decisions and take proactive measures to prevent and mitigate cyber attacks. It plays a crucial role in cybersecurity by providing valuable insights into emerging threats, helping organizations to stay one step ahead of adversaries [6; 7; 8].  
CTI is categorized into different levels, including actionable intelligence, tactical intelligence, and strategic intelligence, each serving distinct purposes, as illustrated in Table 1[2; 9].  
The growing capabilities of CTI platforms play a significant role in enhancing information consumption and analysis. This, in turn, facilitates the seamless sharing of threat information within the cybersecurity community [10]. Unstructured text processing, particularly in incident-related information from OSINT and cybersecurity forums, is crucial for identifying tactics, techniques, and procedures (TTPs) and detecting dark web forums or sources where attacks are explained [11]. This holistic approach allows for the effective detection of attacks, understanding shared information networks, and identifying associated threat actor groups.  
In summary, cyber threat intelligence is of utmost importance in today's rapidly evolving cyber threat landscape. CTI sharing empowers organizations to proactively protect their assets by providing actionable insights and helping in risk assessment, incident response, and proactive defense strategies.