TraceBlock: Cyberattack Traceback System Based on Blockchain

With the continuous development of cyberattack techniques, attack provenance graph has become an important tool for network defense decision-making. Although existing research has made progress in the logical representation and automatic generation of provenance graphs, the provenance graphs constructed by single organization cannot support collaborative traceability. This paper proposes a blockchain-based cyberattack traceback system called TraceBlock to enable the sharing of graphs across multiple organizations. In TraceBlock system, alert records, which are raw data for contracting, are generated by hosts, securely transmitted by oracle, and filtered by CTI filter. The CTI filter uses a pre-trained model to identify critical threat intelligences (CTIs) and uploads CTIs to the blockchain network. Three smart contracts are deployed on the blockchain network, respectively responsible for CTI verification, provenance graph construction, and subgraph extraction. We conduct simulations using an open-source blockchain platform and the DARPA 1999 dataset. The results demonstrate the feasibility of the proposed system.