BloTISRT
Shen He, Jun Fu, Wen Jiang, Yexia Cheng, Jiake Chen, Zhihui Guo
Abstract
Computer and network technology is developing rapidly, meanwhile various cyber security incidents have occurred frequently. New vulnerabilities and many new security risks have emerged endlessly, which have caused serious threats to cyber security and business security. So the role and value of threat intelligence are increasing. However, there are still some problems of threat intelligence. The threat intelligence information can be tampered in the existing sharing mechanism. At the same time, there is no corresponding feedback mechanism for the quality of the threat intelligence information provided by the intelligence providers. There is a lack of credible judgment and corresponding incentive mechanism for threat intelligence providers. So, in order to solve these problems, a blockchain-based threat intelligence sharing and rating technology is proposed in this paper. Based on the characteristics of blockchain such as openness, consensus, autonomy and decentralization, trustlessness, non-tampering and traceability, the paper uses blockchain technology to build blocks of threat intelligence information, including IP address information, domain name information, URLs Information, security incident information, vulnerability information, threat intelligence source, user's evaluation, credibility of threat intelligence, contribution rate of threat intelligence, credibility of threat intelligence sources and contribution rate of threat intelligence sources. A threat intelligence sharing and rating system based on blockchain is designed in the paper, and the corresponding threat intelligence sharing method and rating method based on blockchain are given. It also proposes the smart contract for the threat intelligence sharing and rating in the paper. It can acquire and analyze the latest and most valuable threat intelligence information timely and effectively, so as to perform protection and emergency response timely, and promote the continuous and effective development of the closed loop of the entire threat intelligence ecosystem. The experimental environment and smart contract are designed, and its effectiveness is proved.