# Blockchain-Based Model for Incentivized Cyber Threat Intelligence Sharing
## 2 Related Work
The term \"verifiers\" is introduced, which is new in this context. However, the same function was performed by feeds in [13]. The use of token-based incentives is not new, as they were proposed by [PERSON] et al. [12] one year earlier. Moreover, the use of token-based incentives was more elaborated in [12], since new roles of investors, donors, and owners were introduced there. The protocol is implemented on the public EOS blockchain. The CTI data are stored off-chain using an Interplanetary File System (IPFS). The EOS blockchain enables much higher performance, in comparison to the Ethereum blockchain; however, the EOS blockchain is public, and sensitive CTI data cannot be shared on this platform. [PERSON] and [PERSON] [16] introduced a decentralized platform to allow participants to share CTI data anonymously, such that the shared data would not be attributable to the CTI data producer. The platform was implemented on a permissioned Hyperledger Fabric blockchain. A cryptocurrency incentive was proposed in order to improve the quantity and quality of the CTI data. In this approach, human analysts are incentivized to work with the CTI data provided. The work of human analysts includes not only validation of the provided CTI data, but also the annotation or attribution of certain knowledge. However, very little is mentioned regarding cryptocurrency incentives, and the mechanism of functioning of such incentives is not defined. All of the attention is concentrated on techniques to provide non-attributable CTI data. Unconditional anonymity can undermine trust in CTI data, but techniques to manage trust are not considered. [PERSON] and [PERSON] [17] proposed a reputation-based model for CTI data sharing. The model includes three roles: CTI feeds; validators, whose selection is based on their previous reputation; and consumers. The validators evaluate the sources supplied by CTI feeds using a proposed Proof-of-Quality consensus algorithm. This evaluation is used to rate the CTI feeds. The reputation of validators is evaluated according to their performance, and this reputation plays an important role in the whole process. The model should be implemented on a permissionless blockchain. An extension of the work was presented in [18], although only a simulation of the proposed model was provided. [PERSON] et al. [19] introduced an incentivized framework for CTI data sharing in industrial control systems. The goal of this framework is to motivate better engagement for CTI data sharing. The framework involves the following user roles: CTI Consumer, CTI Contributor, Authority, Insurer, Industry CERTs, CTI Verifier, and Analytics. However, the increased number of roles adds a considerable amount of complexity to the organizational processes of the network. Registration and periodic subscription fees are used to monetize the incentives. A discount is given to verifiers and contributors for their next subscription. The use of the Traffic Light Protocol (TLP) was also introduced, as suggested in [20]. The concept of the TLP [20] was enhanced through adding a white channel, where data were made freely available to entities outside the network. The plan was that the implementation of the framework would consist of three main components: (1) the IPFS for off-chain storage, (2) the Hyperledger Fabric network, and (3) an application based on Node.JS. However, the proposed framework was not implemented, and only use-case scenarios were considered. [PERSON] et al. [21] introduced a CTI data-sharing model that combines consortium blockchain and distributed reputation management to solve the issues of trust. Furthermore, a new consensus algorithm, \"Proof-of Reputation\", was proposed to increase the transaction rate in comparison with the Practical Byzantine Fault Tolerance (PBFT) algorithm. The peer nodes of the network can be in one of four states: leader, candidate, follower, and supervisor. The states of the node are dependent on the reputation score of the node. The supervisor node assesses the validity of the shared CTI data.