A Distributed Ledger for Non-Attributable Cyber Threat Intelligence Exchange
A Distributed Ledger for Non-Attributable Cyber Threat Intelligence Exchange
复制标题
用于无归属网络威胁情报交换的分布式账本
DOI：
10.1007/978-3-030-90019-9_9
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Li, Qinghua
中科院分区：
文献类型：
--
作者：
Huff, Philip;Li, Qinghua
网络威胁情报（CTI）共享通过更快地描述威胁、了解其策略、预测目标以及识别漏洞和缓解措施，为网络安全运营提供了优于对手的优势。然而，组织在共享威胁情报方面遇到了困难，部分原因是与潜在恶意软件活动或威胁组相关联的法律的和财务风险。希望共享威胁信息或获取有关特定威胁的信息的实体有可能成为威胁行为者的受害者，从而导致代价高昂的法律的纠纷、监管调查和声誉损害。因此，网络安全态势感知和漏洞缓解所需的威胁情报数据往往缺乏数量、质量和及时性。我们提出了一个分布式区块链分类账，以促进网络安全威胁信息的共享，并为实体提供一种机制，使其在威胁共享社区中具有不可归属的参与。从加密货币中的分布式匿名支付（DAP）方案中学习，我们使用一种新的基于令牌的身份验证方案用于许可区块链。匿名令牌认证允许半信任实体的联盟为了社区的合作利益而分担管理CTI的工作量。
Cyber threat intelligence (CTI) sharing provides cybersecurity operations an advantage over adversaries by more quickly characterizing the threat, understanding its tactics, anticipating the objective, and identifying the vulnerability and mitigation. However, organizations struggle with sharing threat intelligence due, in part, to the legal and financial risk of being associated with a potential malware campaign or threat group. An entity wishing to share threat information or obtain information about a specific threat risks being associated as a victim of the threat actors, resulting in costly legal disputes, regulatory investigation, and reputational damage. As a result, the threat intelligence data needed for cybersecurity situational awareness and vulnerability mitigation often lacks volume, quality, and timeliness. We propose a distributed blockchain ledger to facilitate sharing of cybersecurity threat information and provide a mechanism for entities to have non-attributable participation in a threat-sharing community. Learning from Distributed Anonymous Payment (DAP) schemes in cryptocurrency, we use a new token-based authentication scheme for use in a permissioned blockchain. The anonymous token authentication allows a consortium of semi-trusted entities to share the workload of curating CTI for the community’s cooperative benefit.