Ilmu Komputer & AI editorial
Open AccessOA2025
BlockIntelChain: A Blockchain-Based Cyber Threat Intelligence Sharing Architecture
A hybrid consensus and privacy-preserving framework for collaborative CTI sharing across distributed IoT networks
Alaa Tolah· Scientific Reports· 2025· DOI 10.1038/s41598-025-29152-6
The core problem
The rapid proliferation of Internet of Things (IoT) devices has expanded the attack surface for sophisticated cyber threats, exposing critical weaknesses in traditional Cyber Threat Intelligence (CTI) platforms. Existing CTI systems often rely on centralized architectures that suffer from trust deficits, privacy vulnerabilities, and single points of failure. These limitations hinder timely and secure sharing of threat intelligence across distributed IoT networks. To address these challenges, this paper introduces BlockIntelChain, a blockchain-based framework designed for secure, scalable, and collaborative CTI sharing. The proposed architecture leverages a hybrid consensus mechanism, a multi-layered privacy framework, and federated learning to enable real-time threat intelligence exchange while preserving data privacy and ensuring resilience against malicious actors. The primary objective is to overcome the shortcomings of centralized CTI platforms and provide a transformative solution for next-generation privacy-aware CTI ecosystems.
Innovation
Comprehensive evaluations were conducted using real-world Malware Information Sharing Platform (MISP) datasets. The performance metrics demonstrate BlockIntelChain's efficiency and scalability. At 500 nodes, the system achieved a throughput of 923 Transactions per Second (TPS) with a consensus success rate of 99.6%. The hybrid consensus mechanism proved resilient against 51% and Byzantine attacks, tolerating up to 33% malicious validators. Privacy analysis confirmed an optimized utility–privacy trade-off: with Differential Privacy at , data utility was preserved at 92%, while Zero-Knowledge Proofs achieved 94% verification accuracy. The Federated Learning models outperformed centralized baselines, reaching 96.4% accuracy for IoT malware classification, 94.7% for phishing detection, and 95.2% for network anomaly identification. Economic modeling validated the sustainability of the ecosystem, showing contributor growth from 156 to 1,245 within 12 months and improved contribution quality from 0.73 to 0.92. Comparative benchmarking against MISP, ThreatConnect, and IBM X-Force demonstrated BlockIntelChain's superiority in decentralization, privacy, and cost efficiency.
The rapid proliferation of Internet of Things (IoT) devices has expanded the attack surface for sophisticated cyber threats, exposing critical weaknesses in traditional Cyber Threat Intelligence (CTI) platforms. Existing CTI systems often rely on centralized architectures that suffer from trust deficits, privacy vulnerabilities, and single points of failure. These limitations hinder timely and secure sharing of threat intelligence across distributed IoT networks. To address these challenges, this paper introduces BlockIntelChain, a blockchain-based framework designed for secure, scalable, and collaborative CTI sharing. The proposed architecture leverages a hybrid consensus mechanism, a multi-layered privacy framework, and federated learning to enable real-time threat intelligence exchange while preserving data privacy and ensuring resilience against malicious actors. The primary objective is to overcome the shortcomings of centralized CTI platforms and provide a transformative solution for next-generation privacy-aware CTI ecosystems.
BlockIntelChain integrates several advanced technologies to achieve its goals. The core architecture is built on a permissioned blockchain that supports distributed IoT nodes. A hybrid consensus mechanism combines Proof-of-Stake (PoS) with reputation-based validator selection to enhance security and efficiency. The reputation system dynamically selects validators based on their historical behavior, reducing the risk of malicious participation. To ensure privacy, the framework employs a multi-layered approach: Differential Privacy (DP) adds noise to shared data, Zero-Knowledge Proofs (ZKP) verify data integrity without revealing sensitive information, Homomorphic Encryption allows computation on encrypted data, and Secure Multi-Party Computation (SMPC) enables collaborative analysis without exposing raw data. Additionally, Federated Learning (FL) is embedded to train machine learning models directly on IoT edge nodes, keeping raw threat telemetry local. The consensus process can be modeled as follows: validators are chosen with probability proportional to their stake and reputation score, and consensus is reached when a supermajority of validators agree on a block. The privacy-utility trade-off is quantified using differential privacy budget , where smaller provides stronger privacy but may reduce utility. The system's resilience is analyzed against 51% and Byzantine attacks, tolerating up to 33% malicious validators. The architecture is illustrated in the Mermaid diagram below:
Why it matters
The results indicate that BlockIntelChain effectively addresses the limitations of centralized CTI platforms. The hybrid consensus mechanism ensures high throughput and security, while the multi-layered privacy framework enables data sharing without compromising sensitive information. The integration of Federated Learning allows distributed model training on IoT edge nodes, eliminating the need to expose raw threat telemetry. The economic model incentivizes participation and improves contribution quality, fostering a sustainable CTI ecosystem. The framework's resilience against Byzantine attacks and its ability to tolerate up to 33% malicious validators make it suitable for adversarial environments. The comparative analysis highlights significant advantages over existing solutions: BlockIntelChain offers better decentralization, stronger privacy guarantees, and lower operational costs. The utility–privacy trade-off achieved with DP () and ZKP demonstrates a practical balance for real-world deployment. The system directly benefits Security Operation Centers and edge-deployed IoT systems by enabling real-time threat intelligence exchange with strong security, privacy, and efficiency. Future work may explore integration with emerging technologies such as 5G and edge computing to further enhance scalability and responsiveness.
Who should read this
CS practitioners and researchers
Opening member content…