# Blockchain-Based Model for Incentivized Cyber Threat Intelligence Sharing
## 4 Experimental Evaluation and Discussion  
### Experimental Evaluation  
Hyperledger Fabric was chosen as a development platform. To configure the Hyperledger Fabric blockchain, the Fabric-SDK-Java toolkit was downloaded, and the Java language was used for the client interface programming, while the Golang language was chosen as the development language for smart contracts. The permissioned blockchain was developed on two virtual machines (VMs). Each VM had two virtual CPU cores, 8 GB of RAM, 10 GB of nonvolatile storage, and a physical machine with an Intel Core i7 and 16 GB of RAM. The Python Web3 Library monitored the behavior of the network. Several Docker containers were used for network entities such as membership service provider (MSP), orderer, peers, and clients. All of the data of the configuration were stored in a Docker compose file. Figure 7 shows the user interface of the designed application. The application's user interface is divided into three areas: CTI data producer, CTI data consumer, and CTI data user. These areas are implemented in separate panels. The view of the CTI data producer is presented in Figure 7. The interface of the CTI data producer enables the CTI file to be uploaded into IPFS, as well as the viewing and reading of a review of the uploaded file submitted by a CTI data consumer, and adding the review to the uploaded CTI file. This panel also includes a list of CTI data submitted by the current CTI data producer. The characteristics of the CTI data are shown in this list. The CTI data consumer panel enables the CTI file to be downloaded and the writing of a review for the downloaded file (Figure 8). The CTI data user panel presents a reputation  
Figure 7: The user interface of the designed application. score for the current year, a reputation score for a five-year period, and the level of the CTI data user. The reviewer's user interface (Figure 8) is divided into two areas: the left side for reading reviews, and the right side for writing and submitting reviews. To evaluate the ratio of subscription fees and reward scores for a one-year period, a simulation was performed. The goal of the simulation was to establish whether the algorithm for reward score calculation assigns the rewards in such a way that the CTI data producers and consumers are motivated to take part in the network to share CTI. The simulation was conducted in MATLAB. The initial values of the simulation parameters are provided in Table 2.  
Based on the initial values of the parameters, we conducted an evolutionary simulation [23] of the reward score values and the potential benefits of being an active participant in the CTI data-sharing process. During the evolutionary simulation, only the number of participants changed, as this is the most variable value and is not controlled by the proposed approach. We simulated the worst-case scenario for the process, as all of the rewards will be consumed:  
1. All participants demonstrate maximum activity. 2. All of the CTI data provided are of high quality. 3. All of the reviews are valid. A similar worst-case scenario for simulation was chosen in [12]. The simulation values are provided in Table 3. We chose EUR 500 as the basic value for the subscription fee. This value is only a small fraction, compared to the average ransom of USD 812,380 paid in 2022, according to a SOPHOS report [32]. Moreover, the value of ransom payments almost doubled to USD 1,542,333 in 2023. The global average cost of a data breach is even higher, according to an IBM report [33], which was USD 4.45 million in 2023 and demonstrated a 15% increase over the last 3 years. The value of the subscription fee is very important for the