# Blockchain-Based Model for Incentivized Cyber Threat Intelligence Sharing
## 2 Related Work  
We consider various incentive approaches for CTI data sharing on decentralized platforms. The scope of our investigation is limited to the scientific literature, excluding gray literature given that the situation is changing as many established projects on decentralized platforms are becoming part of the academic community and the results are published in journals and conference proceedings. The papers are discussed in chronological order of their appearance. [PERSON] et al. [11] proposed a trust enhancement framework, TITAN, for threat intelligence (TI) sharing. However, the keyword \"cyber\" was not used. Nevertheless, the provided definition of TI corresponds to CTI. Trust is established using a shared reputation system. The main component of reputation is the quality of the information provided, which is assessed by a third-party assessor. The other components for representing reputation can be used as well, and the reputation value is stored with every peer. Ethereum blockchain was used to implement the framework. The type of blockchain, either permissioned or permissionless, was not defined. The use of a third-party assessor is the main drawback of the presented approach, since a centralized entry is introduced into a decentralized network, and this centralized entry is a target for attacks as it creates a single point of failure. [PERSON] et al. [12] presented an incentivized model for CTI exchange based on tokens. The goal of the model was to enhance motivation for sharing CTI data. With this purpose in mind, three new roles were introduced in addition to the traditional roles of CTI data provider and CTI data consumer, namely investor, owner, and donor. Token-based incentives were proposed to motivate the participants of the network, implemented on the public Ethereum blockchain. However, trading sensitive CTI data is risky and, as the reputation of CTI data producers is not considered, there is no trust in the CTI data provided. Moreover, [PERSON] et al. [12] recognized that public Ethereum blockchain provides no privacy. [PERSON] and [PERSON] [13] proposed an incentivized framework, BLOCIS, for CTI data sharing. The goal of the framework was to improve trust in the contents of CTI data. Three types of participants are involved in the network: contributors, consumers, and feeds. Feeds are intermediaries between contributors and consumers and govern the process of CTI data sharing. Feeds collect CTI data from contributors, assess their validity, and then either assign a reward value or penalty term to contributors depending on the provided CTI data before distributing the data to the requesting consumers. The contributor, through providing CTI data, pays a deposit, and the accumulated reward value indicates the reliability of the data. Consumers pay for access to CTI data. The proposed framework has several similarities to the one presented by [PERSON] et al. [11]. Both frameworks use a centralized entry to assess the validity of the provided CTI data and are implemented on the public Ethereum blockchain. [PERSON] et al. [14] proposed an architecture for sharing CTI to increase trust in the provided data. Trust is achieved using five reputation levels. The reputation level is used for both the sharing of CTI data and for the validation of the data shared by other users. By sharing CTI data, users can obtain a certain reputation level. The validation of CTI data is performed by trusted peers. Through sharing more reliable CTI data, the users move up the reputation levels. The proposed architecture was implemented on Hyperledger Fabric blockchain. Initially, a single control channel was implemented, which was used for communication among all users. New channels corresponding to particular topics could then be opened, and the CTI data would be submitted to these specific channels. [PERSON] et al. [15] suggested a protocol based on verifiers and token-based incentives to induce the fair sharing of CTI data. The authors emphasize the use of the term \"fair\" throughout the paper.