LUUNU — Blockchain, MISP, Model Cards and Federated Learning Enabled Cyber Threat Intelligence Sharing Platform

Cyber Threat Intelligence (CTI) is a process of threat data collection, processing, and analysis to understand a threat actor’s motives, targets, and attack behaviors. CTI involves highly sensitive data and any inadvertent access to it can harm the affected organization’s reputation. More importantly, CTI sharing has a dangerous outcome of inadvertently revealing the security weaknesses or vulnerabilities in an organization’s infrastructure. It is important that any proposed system of CTI sharing guarantees preserving the privacy and anonymity of the partnering organizations. In this paper, we propose “Luunu,” a blockchain, MISP, Model Cards and Federated Learning enabled CTI sharing platform, to provide enhanced privacy, transparency, traceability, anonymity, and data provenance in a scalable manner. The self-sovereign identity (SSI) capability of Luunu ensures the anonymity of the participants in the CTI sharing. Further, we propose a blockchain-based federated learning system to analyze the collected CTI data from the participating organizations.