Trusted Threat Intelligence Sharing in Practice and Performance Benchmarking through the Hyperledger Fabric Platform

Abstract

Historically, threat information sharing has relied on manual modelling and centralised network systems, which can be inefficient, insecure, and prone to errors. Alternatively, private blockchains are now widely used to address these issues and improve overall organisational security. An organisation’s vulnerabilities to attacks might change over time. It is utterly important to find a balance among a current threat, the potential countermeasures, their consequences and costs, and the estimation of the overall risk that this provides to the organisation. For enhancing organisational security and automation, applying threat intelligence technology is critical for detecting, classifying, analysing, and sharing new cyberattack tactics. Trusted partner organisations can then share newly identified threats to improve their defensive capabilities against unknown attacks. On this basis, organisations can help reduce the risk of a cyberattack by providing access to past and current cybersecurity events through blockchain smart contracts and the Interplanetary File System (IPFS). The suggested combination of technologies can make organisational systems more reliable and secure, improving system automation and data quality. This paper outlines a privacy-preserving mechanism for threat information sharing in a trusted way. It proposes a reliable and secure architecture for data automation, quality, and traceability based on the Hyperledger Fabric private-permissioned distributed ledger technology and the MITRE ATT&CK threat intelligence framework. This methodology can also be applied to combat intellectual property theft and industrial espionage.

Cyber Threat Intelligence on Blockchain: A Systematic Literature Review

“…Ali et al [49,50] introduce a system that ensures privacy and trust through the utilization of distributed ledger technology. The system employs smart contracts for secure decentralized operations and establishes a privacy-preserving ecosystem dedicated to the storage and sharing of threat information related to the MITRE ATT&CK framework.…”

“…Ensuring high-quality CTI not only enhances the efficacy of threat detection and response but also reinforces the foundation of trust by promoting a shared understanding of the threat landscape. Along with quality, other significant factors that are increasingly explored are the scalability and performance of the proposed solutions [36,39,40,42,50,57,71]. Scalability ensures that the system can accommodate a growing volume of CTI transactions effectively.…”

Cybersecurity for Sustainable Smart Healthcare: State of the Art, Taxonomy, Mechanisms, and Essential Roles

“…Threat intelligence in smart healthcare refers to the collection, transformation, observation, analysis, and interpretation of any information or knowledge about cyber threats or attacks that will assist healthcare providers in taking appropriate action to protect their healthcare systems and networks [183]. Zhang et al [184] and Ali et al [185] define threat intelligence sharing as a proactive approach in which security experts in healthcare organizations collaborate to share insights and information about suspicious activities, potential cyber threats, attack patterns, and threat incidents with only trusted partners to enhance the entire security of the SHS and network. Threat intelligence information is gathered from internal network logs, security tools, open-source intelligence, commercial threat intelligence feeds, and industry-specific sharing networks such as information sharing and analysis centers.…”

“…The blockchain stores verified medical data that cannot be edited or removed randomly. The shared ledger protects blockchain blocks using cryptographic methods, ensuring medical data integrity, transparency, and privacy[110][185]. Blockchain improves the interoperability of existing medical records by using an immutable database and masking user identity via public key transactions.…”

Securing Medical Data Exchange: A Decentralized Approach Based on the e-IPGPChain Framework

“…Additionally, the performance aspect faces challenges, particularly in preserving high availability resources while maintaining low latency and scalability. For a comprehensive overview, Table 1 outlines different related works leveraging the benefit of using emergent technologies including Permissioned "Private Blockchain" or Permissionless "Public Blockchain" [20], IPFS, and encryption techniques in comparison to our proposed model which defines a new approach that incorporates emergent technologies to build and lightweight solution to provide medical services with high performance efficiency while preserving a maximum security measure to protect personal user's data over the network.…”