Blockchain and Self-Sovereign Identity Empowered Cyber Threat Information Sharing Platform

Cyber threat information (CTI) sharing involves processes of the collection, analysis and sharing of cyber threat information among multiple organizations. CTI is highly sensitive and inadvertent access can harm an organisation’s reputation. Moreover, CTI sharing may also inadvertently advertise a vulnerability that may be present in the organisation’s infrastructure. Therefore, preserving the privacy and anonymity of the CTI participants is critical. This paper proposes "Siddhi", a blockchain and Self-Sovereign Identity(SSI) enabled CTI platform that will realize traceability, anonymization and data provenance in a scalable fashion. Siddhi is equipped with SSI-enabled mobile wallet to ensure anonymous reporting of threat information and supports TAXII and STIX standards for exchanging the threat information between participants in the blockchain network.

1. Introduction

Cyberthreat information (CT) is shared to assist organizations in identifying, assessing, monitoring, and responding to cyberthreats [1]. The collecting and analysis of attack patterns, IDs, malware, attackers, and tactic-technique-procedures are all part of CTI sharing (TTP). The most widely used CTIdata expression language is STIX [2], [3], and the data communication protocol for exchanging data expressed as STIX is TAXII. The STIX language is used to express the analyzed CTI data, which is subsequently exchanged using the TAXII protocol [4]. To proactively minimize cyber dangers, data must be shared quickly and efficiently.