Web3-based Privacy-Preserving and Incentive Threat Intelligence Sharing Mechanism with Non-False-Positive-based Double Filter

Distributed Denial of Service (DDoS) attacks have emerged as a significant concern for numerous platforms, websites, and servers in recent years. Employing a blacklist access control mechanism stands out as a viable defense strategy against such attacks. However, there exists a hesitation among some Security Operation Centers (SOC) engaged in gathering threat intelligence to share their knowledge, primarily due to a lack of incentives. Therefore, advocating for a fair and effective method of sharing threat intelligence emerges as a promising research area. In this paper, we put forth a proposal for a Web3-based mechanism, outlining a threat intelligence sharing scheme that incorporates incentives while ensuring transparency through the maintenance of exchange records on smart contracts for fair reward. To uphold data confidentiality, the suggested system incorporates a proxy re-encryption scheme, which maintains data in an encrypted form during exchange, thereby preventing data leakage to unauthorized persons. Additionally, our innovative scheme incorporates a novel non-false-positive-based double filter that operates without generating false positives. This advancement serves to amplify the efficiency of data requesters, enabling them to seamlessly search for pertinent information while effectively excluding irrelevant data sets and safeguarding data privacy. According to our simulation results, the execution time of proxy re-encryption in our proposed scheme demonstrates a significant improvement of approximately 65%-70% compared to other existing schemes. This enhancement underscores the efficiency and robustness of our proposed approach in mitigating the impact of DDoS attacks.