# Collaborative Cybersecurity Using Blockchain: A Survey

Loïc Miller<EMAIL_ADDRESS>0000-0003-4717-641X IMT Atlantique,
Cyber CNI ChairRennesFrance and  Marc-Oliver Pahl  marc-oliver.pahl@imt-
atlantique.fr IMT Atlantique, Cyber CNI ChairRennesFrance

(2024)

###### Abstract.

Collaborative cybersecurity relies on organizations sharing information to
boost security, but trust management is a key concern. Decentralized solutions
like distributed ledgers, particularly blockchain, are crucial for eliminating
single points of failure. However, the existing literature on blockchain-based
collaborative cybersecurity is limited, lacking comprehensive insights.

This paper addresses this gap by surveying blockchain’s role in collaborative
cybersecurity from 2016 to 2023. It explores various applications, trends, and
the evolution of blockchain technology, focusing on access control, data
validation policies, underlying tech, and consensus mechanisms.

A key finding is the fragmentation of the field with no dominant research
group or venue. Many recent projects poorly select consensus protocols for
their blockchain. To aid researchers and practitioners, this paper offers
guidelines for choosing the right blockchain for specific purposes and
highlights open research areas and lessons learned from past blockchain
applications in collaborative cybersecurity, encouraging further exploration
in this field.

security, survey, distributed ledgers, blockchain, collaborative
cybersecurity, literature review

††copyright: acmcopyright††journalyear: 2024††doi: XXXXXXX.XXXXXXX††ccs:
General and reference Surveys and overviews††ccs: Security and privacy
Distributed systems security

##  1\. Introduction

Collaborative cybersecurity systems rely on sharing information among
potentially non-trusting organizations. This type of system is designed to
enable organizations to work together and share information such as threat
intelligence, in order to collectively improve their overall security and
defend against cyber attacks better. Collaborative cybersecurity systems can
help organizations to more effectively prevent, identify, monitor, and respond
to potential threats. They also provide a more comprehensive view of the cyber
threat landscape. By working together and sharing information, organizations
can improve their ability to protect against and respond to ongoing cyber
attacks.

One of the main concerns in those systems is how to manage trust. The
traditional way to solve this issue is to give a single node the sensitive
resources to protect. This centralized approach is cost-effective because only
one node requires protection, but this node becomes a single point of failure
in the system. If this node becomes compromised, the entire system is at risk.
Decentralized approaches provide an alternative, more costly but eliminating
the single point of failure. Distributed ledgers are one of those
alternatives.

Among distributed ledgers, the most used underlying structure is the
blockchain. Blockchain is a distributed ledger in which users append data to
existing records. It enables the storage of information without the need to
trust a single third party.

Even though the concept of blockchain predates its creation, the most famous
use of blockchain is Bitcoin (Nakamoto, 2008). However, blockchain has also
been used for other applications. For example, blockchain has been used to
solve traceability and non-repudiation issues in supply chains (Etemadi et
al., 2020), as well as security and privacy issues for health records (Akarca
et al., 2019).

Blockchain has received a lot of attention from both academia and industry.
Researchers have focused on the study of blockchain pertaining to specific
domains or applications. However, there are few surveys focusing on lessons
learned in general, concentrating instead on a specific application.
Additionally, there are no surveys focusing on the use of blockchain for
collaborative cybersecurity purposes. To draw conclusions about blockchain and
its use in this context, this paper analyzes several studies.

Our literature review provides an overview of the use of distributed ledgers
for collaborative cybersecurity, regardless of the application or the domain.
Furthermore, we identify general trends and analyze what blockchains are used
for.

The contributions of this paper are as follows:

  * •

A cross-domain literature review of 71 papers between 2016 and 2023 analyzing
how blockchain is used in collaborative cybersecurity systems.

  * •

The identification of key applications, and examination of trends in
blockchain in those systems.

  * •

The provision of guidance to researchers and practitioners in their choice of
blockchain.

  * •

The identification of open research issues and lessons learned to encourage
further works in the area.

Section 2 gives an overview on existing surveys, confirming our methodology
and showing the need for an additional survey. Section 3 describes the
methodology employed to realize this study. We give our research questions and
describe the methods used in this structured literature review. Section 4
gives background information on blockchain. Section 5 gives a detailed survey
on recent research developments in the domain to complement past use cases and
motivate future ones. We focus on the evolution of the research topic,
relevant venues, and active groups. Section 6 then gives lessons learned and
open research questions. Section 7 concludes the paper.

##  2\. Related Work

We identified the related work during the structured literature review
process. Some surveys were added during the recommendations phase (Dawit et
al., 2020; Lavaur et al., 2022), the others were identified via a structured
search (Lin and Liao, 2017; Hasanova et al., 2019; Taylor et al., 2020; Wang
et al., 2020; Dibaei et al., 2021; Kumar et al., 2021; Abdel-Basset et al.,
2022; Mathew et al., 2022; Vasilomanolakis et al., 2015; Meng et al., 2018;
Baiod et al., 2021; Krichen et al., 2022; Hakak et al., 2021; Gimenez-Aguilar
et al., 2021; Vance and Vance, 2019; Belchior et al., 2022; Liu et al., 2021b;
Zhuang et al., 2020; Leng et al., 2020; Etemadi et al., 2020; Zheng et al.,
2018; Wylde et al., 2022). We also considered relevant studies from research
groups and conferences known to work in this area. We argue that our set of
surveys is comprehensive because it was identified structurally during the
literature review process.

Many works exist on cybersecurity of the blockchain. They are only of marginal
relevance for this paper. Therefore, we point the interested reader to the
literature for further information (Lin and Liao, 2017; Hasanova et al., 2019;
Taylor et al., 2020).

Table 1 lists all surveys we considered in our literature review. Besides the
year, reference and number of citations, we characterize those studies by two
nominal discriminators:

  * •

Domain – General area of interest considered by the survey. A — signifies the
study does not pertain to a domain in particular.

  * •

Application – Application of interest considered by the survey. A — signifies
the study does not pertain to an application in particular.

We also differentiate those surveys by four ordinal discriminators. Each study
either completely ( ), partially ( ) or does not fulfill ( ) the
discriminator:

  * •

Trends analysis – The study completely fulfills this criteria if it analyzes
the evolution of their topic throughout the years in terms of venues, research
groups and blockchain, i.e. nature, technology and consensus. The study
partially fulfills this criteria if it analyzes at least one but not all of
those aspects. The study does not fulfill this criteria if no trend analysis
is done.

  * •

Area diversity – The study completely fulfills this criteria if it spans
multiple areas. The study does not fulfill this criteria if it focuses on a
single area.

  * •

Application diversity – The study completely fulfills this criteria if it
spans multiple applications. The study does not fulfill this criteria if it
focuses on a single application.

  * •

Trait coverage – The study completely fulfills this criteria if it analyzes
for each paper the following characteristics of the blockchain: access
control, data validation policy, technology and consensus. The study partially
fulfills this criteria if it analyzes at least one characteristic. The study
does not fulfill this criteria if it does not analyze those characteristics at
all.

Table 1. Surveys on blockchain and collaborative cybersecurity.

Year Reference Domain Application Trends analysis Area diversity Application
diversity Trait coverage Cited 2015 Vasilomanolakis et al. (Vasilomanolakis et
al., 2015) — Intrusion Detection 320 2018 Meng et al. (Meng et al., 2018) —
Intrusion Detection 440 2018 Zheng et al. (Zheng et al., 2018) — Cybersecurity
2806 2019 Vance and Vance (Vance and Vance, 2019) Critical Infrastructures
Cybersecurity 8 2020 Dawit et al. (Dawit et al., 2020) — Intrusion Detection
11 2020 Etemadi et al. (Etemadi et al., 2020) Supply chain Cybersecurity 7
2020 Leng et al. (Leng et al., 2020) Industry 4.0 Cybersecurity 101 2020
Zhuang et al. (Zhuang et al., 2020) Smart Grid Cybersecurity 80 2021 Baiod et
al. (Baiod et al., 2021) — — 14 2021 Dibaei et al. (Dibaei et al., 2021)
Vehicular Networks Cybersecurity 41 2021 Gimenez-Aguilar et al. (Gimenez-
Aguilar et al., 2021) — Cybersecurity properties 20 2021 Hakak et al. (Hakak
et al., 2021) — — 19 2021 Kumar et al. (Kumar et al., 2021) Vehicular Networks
Blockchain techniques 6 2021 Liu et al. (Liu et al., 2021b) — Cybersecurity 1
2022 Abdel-Basset et al. (Abdel-Basset et al., 2022) IIoT Intrusion Detection
1 2022 Belchior et al. (Belchior et al., 2022) Workflows Business Process
Management 1 2022 Krichen et al. (Krichen et al., 2022) — — 4 2022 Lavaur et
al. (Lavaur et al., 2022) — Intrusion Detection 1 2022 Mathew et al. (Mathew
et al., 2022) IIoT Intrusion Detection 0 2022 Wylde et al. (Wylde et al.,
2022) — Cybersecurity properties 4 2022 This work Global Global

More than a dozen surveys exist on the topics of distributed ledgers and
collaborative cybersecurity (Wang et al., 2020; Dibaei et al., 2021; Kumar et
al., 2021; Abdel-Basset et al., 2022; Mathew et al., 2022; Vasilomanolakis et
al., 2015; Meng et al., 2018; Dawit et al., 2020; Lavaur et al., 2022; Baiod
et al., 2021; Krichen et al., 2022; Hakak et al., 2021; Gimenez-Aguilar et
al., 2021; Vance and Vance, 2019; Belchior et al., 2022; Liu et al., 2021b;
Zhuang et al., 2020; Leng et al., 2020; Etemadi et al., 2020; Zheng et al.,
2018; Wylde et al., 2022). However, the majority of those surveys pertain to a
specific application, and/or domain. Some of the studies are concerned with
Vehicular Networks (Wang et al., 2020; Dibaei et al., 2021; Kumar et al.,
2021), some with IIoT (Abdel-Basset et al., 2022; Mathew et al., 2022), while
others only focus solely on Intrusion Detection (Vasilomanolakis et al., 2015;
Meng et al., 2018; Dawit et al., 2020; Abdel-Basset et al., 2022; Lavaur et
al., 2022; Mathew et al., 2022).

A few surveys (Baiod et al., 2021; Krichen et al., 2022; Hakak et al., 2021)
open beyond specific applications or areas. However, those surveys do not
identify general trends, and limit themselves to a simple listing of
applications and/or issues.

Closest to this study, some surveys extract general information on the topic
regardless of area or application. Baiod et al. (Baiod et al., 2021) consider
blockchain technology and its applications across multiple areas. They give a
general overview of blockchain as well as technology and issues surrounding
it. Contrary to us, they do not evaluate trends and identify open issues.
Hakak et al. (Hakak et al., 2021) explore recent advances in blockchain. More
specifically, they review the different blockchain platforms and compare
applications in different areas. They however do not consider the trends or
whether the use of blockchain is justified. Krichen et al. (Krichen et al.,
2022) determine the use of blockchain in several areas like finance,
healthcare and governmental services. They do not look at the underlying
blockchain technology and network, whether blockchain use is justified, and do
not analyze trends.

A subset of the surveys deal solely with intrusion detection. Vasilomanolakis
et al. (Vasilomanolakis et al., 2015) investigate collaborative intrusion
detection systems. Some of the considered systems use blockchain. Meng et al.
(Meng et al., 2018) review intrusion detection systems and blockchain. Dawit
et al. (Dawit et al., 2020) survey the suitability of blockchain for
collaborative intrusion detection systems. Abdel-Basset et al. (Abdel-Basset
et al., 2022) study both non-blockchain and blockchain solutions to achieve a
privacy-preserved intrusion detection system for the Industrial Edge of Things
(IEoT). Lavaur et al. (Lavaur et al., 2022) survey federated learning
solutions for intrusion detection systems. Some of those solutions make use of
blockchain to enable model sharing between the entities using federated
learning. Mathew et al. (Mathew et al., 2022) look at blockchain for
collaborative intrusion detection systems in the context of Industrial IoT
(IIoT). They identify three blockchain integration approaches and one trust
management approach. Contrary to those works, our study analyzes general
trends.

Another subset of the surveys deal with different areas – cybersecurity
(Gimenez-Aguilar et al., 2021; Liu et al., 2021b; Ivanov et al., 2023),
vehicular networks (Wang et al., 2020; Dibaei et al., 2021; Kumar et al.,
2021) and industrial applications (Zhuang et al., 2020; Vance and Vance, 2019;
Leng et al., 2020; Etemadi et al., 2020). Gimenez-Aguilar et al. (Gimenez-
Aguilar et al., 2021) investigate ways of achieving cybersecurity with
blockchain. In particular, they look at how researchers and industrial
initiatives achieve various cybersecurity properties, e.g. authentication,
non-repudiation and confidentiality. They also consider whether the use of
blockchain in those papers is justified or not. Liu et al. (Liu et al., 2021b)
look at how blockchain is used for cybersecurity, while Ivanov et al. (Ivanov
et al., 2023) look specifically at smart contracts.

Wang et al. (Wang et al., 2020) provide guidelines to further study the
application of blockchain in vehicular networks. Dibaei et al. (Dibaei et al.,
2021) investigate the different ways blockchain is used to secure vehicular
networks. Kumar et al. (Kumar et al., 2021) look at blockchain techniques used
to secure the Internet of Vehicles.

Zhuang et al. (Zhuang et al., 2020) study how blockchain can be used to secure
the Smart Grid. Vance and vance (Vance and Vance, 2019) look at the use of
blockchain to protect critical infrastructures. Leng et al. (Leng et al.,
2020) study how blockchain can be used to overcome challenges in smart
manufacturing in industry 4.0. Etemadi et al. (Etemadi et al., 2020) look at
blockchain use in the food supply chain.

Adjacent to collaborative cybersecurity, Belchior et al. (Belchior et al.,
2022) explore the use of blockchain on business process view integration.
Zheng et al. (Zheng et al., 2018) survey blockchain challenges and
opportunities. Wylde et al. (Wylde et al., 2022) review issues surrounding
cybersecurity, data privacy and blockchain.

##  3\. Research methodology

This section is intentionally detailed to ensure the study’s reproducibility
and adherence to sound research principles. It offers a better perspective on
the results of the study. We follow the guidelines of Keele et al. (Keele et
al., 2007) as well as Briner and Denyer (Briner and Denyer, 2012). Following
the latter method, we present next the following steps that were taken.
Section 3.1 identifies and defines the research questions we address. Section
3.2 shows how we obtain the relevant studies to answer our questions. Section
3.3 describes our method to identify the studies meeting our criteria. Section
3.4 explains how we extract and synthetize our findings.

###  3.1. Identify and define the research questions

The purpose of this paper is to analyze the place of blockchain in
collaborative cybersecurity systems. The main question is thus “How has
blockchain been used in collaborative cybersecurity systems?”. To answer this
question, we define a set of more refined questions, as follows:

  1. (1)

RQ1: What are the main use cases when it comes to collaborative cybersecurity
systems using blockchain?

  2. (2)

RQ2: In what domains has blockchain technology been used to achieve
collaborative cybersecurity?

  3. (3)

RQ3: What type of blockchain has been used to achieve collaborative
cybersecurity?

  4. (4)

RQ4: How has the area of collaborative cybersecurity systems using blockchain
evolved over time?

  5. (5)

RQ5: What lessons and open issues can we deduce from our findings?

Our study targets a diverse range of readers with varying interests.
Specifically, we are focusing on three main groups: collaborative
cybersecurity researchers, cybersecurity practitioners, and developers working
with blockchain technology. As such, each research question that we explore in
this study will likely appeal to different sets of readers. Namely, RQ1 and
RQ2 are relevant for collaborative cybersecurity researchers, interested by an
overview of collaborative cybersecurity applications and their domains. RQ3 is
more interesting for cybersecurity practitioners and blockchain developers,
which might gain an insight as to what type of blockchain they need to
consider for their specific use case. Finally, RQ4 and RQ5 are of interest to
a general audience which can gain a historical perspective of the topic as
well as a more complete understanding of the matter.

###  3.2. Determine and search the relevant studies

To determine and search the relevant studies, we follow the guidelines of
Keele et al. (Keele et al., 2007) on structured literature reviews. The
considered set of papers is composed of conference, workshop and journal
papers. Due to the huge amount of papers on one specific application of
blockchain in collaborative cybersecurity, the selection method for those
papers is slightly different than for the other applications.

We used Google Scholar to retrieve all manuscripts. The initial set of
considered papers is composed of recommendations that were given by coworkers,
as well as some papers found using intuitive search to get a first look at the
topic. We then added to this initial set of papers using structured search,
with the following query:

> (“distributed ledger” OR “blockchain”) AND (“collaborative cybersecurity” OR
> “cybersecurity”)

This query ensures that we capture a set of papers relevant to the matter,
even in different forms. To obtain more surveys related to the topic for our
related work, we complete our previous query to obtain the following:

> (“distributed ledger” OR “blockchain”) AND (“collaborative cybersecurity” OR
> “cybersecurity”) AND (“survey” OR “literature review”)

After this step, a total of 70 papers were retrieved.

###  3.3. Identify studies meeting our criteria

After retrieving this initial set of papers obtained by recommendations,
intuitive search and structured search, we carried out a manual review of the
papers. First, the title are abstract of each paper was used to discard those
that were not relevant when considering our research questions. We then
carried out a more thorough review of the papers we kept. After processing
each paper, we performed a backward and forward snowball, looking at the
papers in the references as well as the papers citing the processed paper. We
used this method to gain access to more relevant papers, which then underwent
the same process of filtering and snowballing.

Those steps yielded an additional 65 papers, which after filtering brought our
definitive sample to 91 papers. Out of those 91 papers, 20 are surveys related
to our topic which are described in the related work, but not a part of our
analysis. Our analysis was thus performed on a set of 71 papers — 35 journal
papers and 36 conference/workshop papers.

###  3.4. Extract and synthesize findings

The selected studies were all analyzed to answer the proposed research
questions. To this end, we classified the papers according to different
features. Namely, we characterized each proposal according to their mode of
publication, the venue they were published in, the research groups making the
research and the countries the authors were from. We also classified each
paper according to its application, as well as its domain. In the case a paper
fit more than one application or domain, it was counted for each one of them.
Finally, we characterized for each paper different aspects of their underlying
blockchain. Specifically, we looked at technology, consensus, access control
and permission.

##  4\. Background

We introduce in this section the foundations of blockchain technology. Section
4.1 outlines core concepts of distributed ledgers, namely Nature, Technology
and Consensus. To simplify the presentation of some concepts in the analysis,
Section 4.2 presents a general blockchain model.

###  4.1. Blockchain overview

Blockchain technology enables the creation of a decentralized ledger that
allows for the addition of data in a sequential manner (Nakamoto, 2008). Note
that the underlying linked list structure can be changed to other structures,
e.g. a graph (Wang et al., 2023). With blockchain, trust is distributed among
all participants. No central party is required. Therefore, maintaining and
updating the ledger requires that all (or a qualified portion of) participants
reach a consensus. The way to reach this consensus depends on the nature of
the blockchain and their underlying technology.

#### Nature

The nature of a blockchain is determined by two key factors: access control
and data validation policy (Gimenez-Aguilar et al., 2021).

Access control is a critical aspect of blockchain technology. The access
control mechanism of a blockchain determines who can access the network, and
can be classified into two categories: public and private. Public blockchains
are open to anyone who wishes to participate, without any restrictions on who
can join or access the network. In contrast, private blockchains have a
restricted access control mechanism where only selected members are allowed to
join and access the network.

Choosing between a public or private blockchain depends on the specific use
case and the requirements of the application. Public blockchains can offer
greater transparency and decentralization, as anyone can view transactions on
the network. They can also lead to a greater number of participants, and
therefore potentially increase the value a participant can extract from the
ledger. However, they also have limited privacy and security, which may not be
suitable for certain applications. In direct opposition, private blockchains
provide greater privacy and security by limiting access to selected members,
but they may lack the transparency and decentralization of a public
blockchain.

Data validation is another crucial factor that determines the nature of a
blockchain. The data validation policy determines who has the authority to
validate transactions and add blocks to the blockchain. Blockchains can be
categorized into two types based on their data validation policies:
permissionless and permissioned. In permissionless blockchains, anyone can
participate in the validation process and contribute to the consensus
mechanism that ensures the integrity of the blockchain. This means that all
nodes on the network are equal, and no specific user or group has special
privileges.

In contrast, permissioned blockchains have a restricted set of users who are
authorized to validate the blockchain. These users are typically selected
based on their role or authority in the network, and they have a greater
responsibility to ensure the accuracy and security of the blockchain.
Permissioned blockchains are commonly used in enterprise applications, where
data privacy and security are critical, and a high level of trust among the
participants is necessary. The choice between these two types of blockchains
depends on the specific requirements of the application and the level of trust
among the participants.

The overall flavor of a specific blockchain is thus a combination of those two
factors, either public or private, and permissionless or permissioned. Most
public blockchains are permissionless, and most private blockchains are
permissioned, but particular use cases may have a need for private
permissionless or public permissioned blockchains.

#### Technology

Bitcoin, Ethereum and Hyperledger are the main technologies employed to
develop systems based on blockchain.

The first, Bitcoin, is a digital cryptocurrency that was created in 2008 by an
unknown person or group of person using the name Satoshi Nakamoto (Nakamoto,
2008). Bitcoin allows two parties to send transactions between each other
without the involvement of a third party. It is public and permissionless,
meaning that anyone can join and participate in the network without needing
permission or authorization. Transactions are verified by network nodes
through cryptography and recorded on the blockchain, which acts as a
permanent, transparent record of all transactions. Despite its early
controversies, Bitcoin has become a popular form of currency and store of
value, and its underlying blockchain technology has been adopted by numerous
industries for its secure and transparent nature.

Ethereum is a blockchain-based cryptocurrency that was launched in 2015. It is
notable for its smart contract functionality, which allows developers to
create decentralized applications (dApps) that can run on the Ethereum
network. Smart contracts are self-executing contracts with the terms of
agreement between buyer and seller being directly written into lines of code.
The Ethereum Virtual Machine (EVM) is a runtime environment that enables the
execution of smart contracts on the Ethereum network. The main Ethereum
network is public, meaning that anyone can participate in the network without
needing permission or authorization. Ethereum has become a popular platform
for building decentralized applications, and its blockchain technology is used
in various industries such as finance, healthcare, and gaming.

Hyperledger is an open-source collaborative effort that was established at the
end of 2015 by the Linux Foundation. It is a platform that allows developers
to create blockchain applications with a focus on scalability,
confidentiality, and security. Hyperledger hosts numerous blockchain
technologies, including Iroha, Fabric, Sawtooth, and many more. Among these
projects, Fabric is the most widely used and is designed to be a private
permissioned blockchain, which means that access to the network is restricted
to authorized participants. Hyperledger Sawtooth is another popular project
and is notable for its modular architecture that allows developers to
customize the consensus algorithms that underpin the network. Hyperledger also
provides a framework for building smart contracts, known as Chaincodes, which
are written in programming languages such as Go or Java. The platform is
gaining traction in a variety of industries, including finance, healthcare,
and supply chain management.

#### Consensus

The different technologies utilized in blockchain networks employ various
types of proofs to achieve consensus among the network participants.

Proof of Work (PoW) is most famously associated with Bitcoin as it was the
first and is the most widely known implementation of this consensus algorithm.
The PoW algorithm requires participants, also known as miners, to solve
complex mathematical problems to validate transactions and add blocks to the
blockchain. The miner who solves the problem first receives a reward in the
form of cryptocurrency. The PoW algorithm is designed to be resource-
intensive, requiring a significant amount of computational power and energy to
operate. This makes it a secure and reliable method of consensus, as it is
difficult for malicious actors to manipulate the network. However, the high
energy consumption required by PoW has led to concerns about its environmental
impact and sustainability. Despite these concerns, PoW remains the most widely
used consensus algorithms in blockchain technology, particularly in public
blockchains such as Bitcoin and Ethereum.

Proof of Stake (PoS) is a consensus algorithm that is increasingly being used
in blockchain networks as an alternative to Proof of Work (Vasin, 2014).
Unlike PoW, where participants validate transactions and add blocks to the
blockchain through computational work, PoS operates by having participants,
also known as validators, put up a stake in the form of cryptocurrency as
collateral. Validators are then randomly selected to validate transactions and
add new blocks to the blockchain based on the size of their stake. The
validators who are selected to add new blocks to the blockchain receive
transaction fees as a reward.

PoS is designed to be more energy-efficient than PoW, as it does not require
the same level of computational power and energy consumption. This makes it
more sustainable and environmentally friendly. PoS is also believed to be more
secure than PoW as it is harder for malicious actors to acquire a majority
stake in the network and manipulate the consensus mechanism (Buterin et al.,
2014). The PoS consensus algorithm is gaining traction in blockchain networks,
with notable implementations including Ethereum’s Casper and Cardano’s
Ouroboros. Note that Ethereum itself has also switched from PoW to PoS near
the end of 2022. However, there is also criticism that PoS may lead to
centralization of power in the hands of a few large stakeholders, potentially
compromising the decentralization that is fundamental to blockchain
technology.

Delegated Proof of Stake (DPoS) is a consensus algorithm that combines the
benefits of both Proof of Work and Proof of Stake. DPoS is a more democratic
version of PoS, where network participants, known as stakeholders, can vote
for delegates to validate transactions and create new blocks (Snider et al.,
2018). Delegates are responsible for maintaining the network and receiving
rewards for their participation, but they are also subject to being voted out
if they fail to perform their duties or act against the interests of the
stakeholders. DPoS is considered more efficient and scalable than both PoW and
PoS, and it also reduces the risk of centralization by giving stakeholders the
power to choose their delegates. DPoS is used in several popular blockchain
networks, including BitShares, EOS, and TRON.

Proof of Identity (PoI) is a consensus algorithm that verifies the identity of
network participants before allowing them to participate in the network (Liu
et al., 2020). PoI uses a combination of biometric authentication, digital
signatures, and other verification methods to ensure that only authorized
individuals can access the network. PoI is considered a more secure and
reliable alternative to other consensus algorithms because it eliminates the
risk of Sybil attacks, where an attacker can create multiple fake identities
to manipulate the network.

Proof of Authority (PoA) is a consensus algorithm that relies on the identity
of network participants to validate transactions and create new blocks (De
Angelis et al., 2018). In PoA, validators are known as authorities and are
selected based on their reputation, expertise, or other predefined criteria.
Authorities are responsible for maintaining the network and receive rewards
for their participation. Unlike PoW and PoS, PoA does not require
computational power or staked cryptocurrency, which makes it more energy-
efficient and scalable. However, it also requires a high degree of trust in
the authorities, and the network can become vulnerable to centralization if
the authorities collude. PoA is used in several blockchain networks, including
POA Network, Kovan, and Ethereum Classic.

Practical Byzantine Fault Tolerance (PBFT) is another consensus algorithm (Li
et al., 2020a) using a three-phase protocol. In the first phase, the primary
node broadcasts a proposal for a new transaction. In the second phase, the
other nodes validate the proposal and send a response back to the primary
node. In the third phase, the primary node broadcasts the final decision based
on the responses received from the other nodes. PBFT is considered more secure
and reliable than other consensus algorithms, but it also requires a higher
level of communication and computational power. PBFT is used in several
blockchain networks, including Hyperledger Fabric and Ripple.

Proof of Elapsed Time (PoET) is a consensus algorithm that relies on a trusted
execution environment (TEE) to ensure that network participants are selected
to create new blocks in a random and fair manner (Chen et al., 2017). In PoET,
network participants compete to win a random wait time within the TEE, and the
participant with the shortest wait time is selected to create the next block.
This process is repeated for each new block, ensuring that all network
participants have an equal chance of being selected. PoET is used in several
blockchain networks, including Hyperledger Sawtooth and Quorum.

We point the interested reader to the literature for further information about
consensus protocols (Xu et al., 2023).

###  4.2. Blockchain model

The update and use of a blockchain involve several entities and elements, each
with a specific role to play. We refer here to the model presented by Gimenez-
Aguilar et al. (Gimenez-Aguilar et al., 2021). Figure 1 represents a general
model for blockchain. The first entity is the set of nodes in charge of
keeping the blockchain information itself. These nodes, known as Blockchain
nodes (BCN), cooperate to update blockchain data based on a consensus
algorithm. Consensus is typically reached among a subset of BCNs called
miners, which are responsible for validating and adding new blocks to the
blockchain.

Figure 1. Blockchain model.

Apart from BCNs, there is another entity that comes into play – Blockchain
Users (BCUs). BCUs are those who are willing to insert information into the
blockchain. They might do this for various reasons, such as recording a
transaction or recording data that will be shared with others.

Blockchain Observers (BCOs) are individuals who benefit from the information
stored in the blockchain without contributing to it by adding new data. They
retrieve data from the blockchain by observing it and do not have the ability
to update it. Even though they do not directly participate in adding data,
their retrieval might be recorded in the blockchain through a transaction or
an interaction with a smart contract.

Since only BCNs have direct access to the blockchain, BCUs and BCOs must trust
that the information they retrieve or exchange is accurate. However, no single
BCN is considered inherently trustworthy, and the blockchain’s underlying
consensus protocol or access control/permission mechanisms prevent any attempt
to alter the information. To further increase security and prevent mistrust,
BCNs rely on incentives such as rewards for successfully adding transactions
to the ledger. These incentives encourage BCNs to act honestly and promote the
best interests of the blockchain community.

##  5\. Blockchain for Collaborative Cybersecurity

We analyzed 71 papers from 2016 to 2023. Regarding the use of blockchain for
collaborative cybersecurity, Figure 2 shows the number of papers published for
each year. Overall, the number of papers has been going up, with the most
papers published in the year 2019, closely followed by 2020. The launch of
Ethereum and Hyperledger in 2015 might give a partial explanation as to the
lack of papers on the topic before 2016. Those projects introduce smart
contracts and chaincodes respectively, making it easier to implement
collaborative cybersecurity systems, which may also explain why we see an
increase in the number of papers related to the topic after the launch of
these technologies. Of the 71 papers, 36 were published in conferences, and 35
were published in journals. The two most popular venues, with five and four
papers respectively, are IEEE Access and the IEEE Internet of Things Journal.

Figure 2. Number of papers per year.

To obtain more information about each individual paper on each of the
dimensions described below, refer to the tables in Appendix A. Specifically,
Table 2 contains information on the application, the domain and the number of
citations. Table 3 on the other hand contains information about the nature of
the blockchain, namely technology, consensus, access control and data
validation policy. A reader looking for a collaborative application using a
specific blockchain nature will find great use of those tables.

###  5.1. Applications

Here, we explore the various applications of blockchain for collaborative
cybersecurity purposes. Representing 38 out of 71 papers, we find that the
majority of papers are on the topic of intrusion detection. The second most
represented application is Distributed Denial of Service (DDoS) defense, with
fifteen papers on the subject. Eleven papers use blockchain in their
respective domains to share data securely without a single point of failure,
with some doing so out of privacy concerns.

The use of blockchain in different applications has evolved over the years.
Figure 3 details this evolution of application per year. While the number of
papers on DDoS defense has been steadily decreasing, the number of papers on
intrusion detection has been increasing. Some less prevalent applications can
also be found in the figure, such as honeypot, forensics or trust management.

Figure 3. Approaches per application per year.

In the following paragraphs, we provide a description of each application, as
well as an explanation of how blockchain technology is utilized in these
applications for collaborative cybersecurity purposes.

#### Distributed Denial of Service Defense

Distributed Denial of Service attacks aim to overwhelm a network with traffic,
rendering it unavailable to users. There are several ways to defend against
DDoS attacks, which can be broadly categorized into four categories (Peng et
al., 2007): attack prevention, attack detection, attack source identification,
and attack reaction. Attack prevention involves taking measures to prevent
DDoS attacks from occurring in the first place, such as implementing firewalls
and filtering traffic. Attack detection involves identifying when a DDoS
attack is occurring, typically by analyzing traffic patterns or anomalies.
Attack source identification involves identifying the source of the attack,
which can be done through various techniques such as tracing the IP address or
using honeypots. Attack reaction involves taking action to mitigate the impact
of the attack, such as diverting traffic to other servers or blocking certain
traffic.

There are several methods used for mitigating DDoS attacks (Miller and
Pelsser, 2019). Proactive techniques include:

  * •

Designing protocols with reduced amplification factors to minimize the impact
of DDoS attacks.

  * •

Reducing the number of amplifiers, such as open DNS resolvers and NTP servers,
that can be exploited.

  * •

Implementing rate limiting, UDP session management, and spoofed packet
filtering to control and validate incoming traffic.

Reactive techniques involve:

  * •

Traffic scrubbing to filter out malicious traffic before it reaches the
target.

  * •

BGP blackholing to discard malicious traffic (Kumari and McPherson, 2009).

  * •

Blockchain signaling.

A big advantage of blockchain signaling compared to the other techniques is
that DDoS mitigation can be achieved in a collaborative fashion, which we
argue leads to better mitigation prospects than individually. On top of this,
blockchain signaling leverages existing infrastructure to minimize costs and
system bloat, as the parties taking part in the mitigation do not have to
manage and/or create a system to handle trust between collaborating parties.

We identified three main archetypes for blockchain signaling in DDoS
mitigation. We call those archetypes consortium, contractual, and aggregator.

In the consortium archetype, two or more participants share malicious IP
addresses for later mitigation. An example scenario can be found in Figure 4.
This example depicts three Autonomous Systems (AS), which can be defined as
one or more networks under the control of a single entity (e.g. Hurricane
Electric). The server in AS20 is the victim of a DDoS attack. To mitigate this
attack with the consortium approach, AS 20 will first identify the malicious
IP addresses responsible for the attack, and push them to the blockchain.
Then, other ASes belonging to the consortium, here AS 10 and AS 30, will
mitigate the attack in any way they see fit.

Figure 4. DDoS mitigation using the consortium archetype.

The creator of the smart contract, here AS 20, is the one managing who is
allowed to participate in the consortium. As such, this archetype makes use of
a private blockchain. There are no requirements on the data validation policy,
so the consortium can either be permissioned or permissionless. Note that all
approaches in the literature following this archetype use a private
permissioned blockchain. This approach was originally developed by El Houda et
al. (Abou El Houda et al., 2018, 2019a, 2020a, 2020b), but was later improved
to include the possibility of sharing whitelists of trusted IP addresses. El
Houda et al. later combined their approach with intra-domain DDoS mitigation
in a scheme they name Cochain-SC (Abou El Houda et al., 2019b). In the paper
they propose multiple intra-domain DDoS mitigation techniques, and coordinate
mitigation between multiple SDN domains using blockchain. Yeh et al. (Yeh et
al., 2019) also take the consortium approach, but ensure data confidentiality
and integrity using Elliptic Curve Cryptography.

A potential problem with this approach is the lack of incentives to mitigate
the DDoS attacks targeting other ASes. Why should an AS spend precious
resources to mitigate the attack of another? Papers using this archetype do
not discuss such incentives. We argue that a potential incentive is that even
though an AS might not be the target of an attack, attack traffic may still
pass through their AS, taking up bandwidth and resources anyway, so there is
an incentive to block the mitigate the attack as soon as possible in terms of
hops. Another incentive may be that an AS will mitigate attacks for others,
since it trusts those other ASes will mitigate a potential later attack
targeting it.

The second archetype is contractual. In this archetype, a smart contract is
established between two participants which are typically the victim of the
attack and the mitigator. After the establishment of the contract, the victim
shares the malicious IP addresses with the mitigator and pays it for the
service. Figure 5 depicts the same example as Figure 4, but with contractual
mitigation. AS 20 establishes a smart contract between itself and AS 10, which
is the mitigator. After pushing the malicious IP addresses to the blockchain,
AS 10 mitigates the attack. Note that the attack traffic coming from AS 30 is
not mitigated, since AS 20 made no contract with it. Once the attack is
mitigated, AS 20 pays AS 10.

Figure 5. DDoS mitigation using the contractual archetype.

Rodrigues et al. (Rodrigues et al., 2017b, a) first came up with this
approach, naming it “Blockchain Signaling System (BloSS)”. They later
conducted a performance evaluation of their method (Rodrigues et al., 2019),
and demonstrated it with hardware (Rodrigues and Stiller, 2019). Later
extensions added a reputation system, with the possibility for the victim to
rate the service of the mitigator, and for the mitigator to rate the
reputation of the victim (Rodrigues et al., 2020). Such systems include the
possibility of refunds if the mitigation was not satisfactory, even though
proof of mitigation might be difficult to achieve. Yeh et al. also contributed
using the contractual approach (Yeh et al., 2020). They point out the lack of
incentive mechanisms in previous works, as well as the lack of discussion of
incentive mechanisms in general. In this contribution, they propose a
decentralized DDoS data exchange platform called SOChain, which uses a
DDoS_coin token to generate incentive to mitigate attacks. Chiu et al. equally
propose to mitigate DDoS attacks using FolketID, a system designed to reward
participants mitigating DDoS attacks with cryptocurrency (Chiu et al., 2022).

The third and final archetype, aggregator, sees the victim sharing traffic
features among two or more participants. The participants then collectively
aggregate and process a defense digest, which they use to mitigate the DDoS
attack. Figure 6 shows the same example as before, but with aggregator
mitigation. AS 10, 20 and 30 share traffic features of the attack with each
other using the blockchain. By aggregating this shared data, each AS processes
a defense digest which is then pushed to the blockchain. This defense digest
is used to mitigate the attack.

Figure 6. DDoS mitigation using the aggregator archetype.

Guo et al. (Guo et al., 2022) introduce this archetype. These systems are
designed to process large volumes of data quickly, which can be useful in
identifying and mitigating DDoS attacks. By analyzing traffic patterns in
real-time using MapReduce, these systems can quickly identify and respond to
DDoS attacks, reducing the impact on target servers. As a side-note, they also
complement their approach with a DDoS attack tracing scheme using data in the
blockchain (Guo et al., 2021).

#### Intrusion Detection Systems

Blockchain has also been used a lot in Intrusion Detection Systems (IDS).
Intrusion Detection Systems come in many forms.

HIDS (Host-based Intrusion Detection Systems) and NIDS (Network-based
Intrusion Detection Systems) are two distinct strategies for detecting
intrusion attempts. HIDS operate on individual host devices such as servers
and workstations, monitoring system logs, processes, and file system activity
to detect intrusions and other irregular behavior. This method enables the
identification and prevention of attacks originating from within the host, as
well as those that are externally based. In contrast, NIDS focus on monitoring
network traffic to identify suspicious patterns and signs of intrusion. By
analyzing data packets and communication between devices, NIDS can detect
anomalies and malicious activities that traverse the network infrastructure.
While both systems are essential for comprehensive security, HIDS excel at
detecting and mitigating attacks on specific devices, whereas NIDS provide a
broader, network-wide perspective for identifying threats and potential
vulnerabilities.

There is another aspect that can be distinguished regarding the detection of
attacks, which relates to the method used to identify them. There are two main
ways schemes, Signature-based intrusion detection systems (SIDS) and anomaly-
based intrusion detection systems (AIDS), the latter sometimes being called
misuse detection. SIDS primarily rely on a database of known attack patterns
called signatures to detect intrusions. This approach is effective in
identifying and mitigating known threats; however, it is limited in its
ability to detect novel or emerging attacks, as it requires constant updates
to stay relevant. On the other hand, AIDS leverage machine learning algorithms
to establish a baseline of normal network behavior, and subsequently, identify
any deviations from this established norm. This allows for the detection of
unknown or zero-day attacks, as well as subtle anomalies that may otherwise go
undetected. While anomaly-based systems offer greater adaptability and the
potential for identifying novel threats, they may suffer from higher false-
positive rates due to the inherent challenge of differentiating between benign
irregularities and malicious activity.

Lastly, Collaborative Intrusion Detection Systems (CIDS) offer an advanced
approach to network security by leveraging the collective intelligence of
multiple IDS nodes. By sharing threat information and detection patterns, CIDS
can enhance the overall accuracy and efficiency of intrusion detection. This
collaborative effort enables the system to adapt more quickly to emerging
threats, minimizing the likelihood of false positives and negatives.
Furthermore, CIDS can effectively counteract sophisticated attacks that
exploit the limitations of isolated IDS deployments.

On the topic of AIDS and CIDS, blockchain is sometimes used in support of
federated learning to enhance the security and privacy of the system.
Federated learning is a decentralized machine learning approach where multiple
devices or nodes collaboratively train a global model. Blockchain is favored
to fill in this role, because it can be used to store and verify the integrity
of the model and training data, as well as to ensure that the participating
nodes are trustworthy.

When looking at the literature, there are basically two ways to use blockchain
for Intrusion Detection Systems. Participants can either share the data, or
can share the models. Sharing models is particularly useful when data privacy
is a concern.

Figure 7 represents intrusion detection systems collaborating. What they share
using the blockchain is either the data used for the detection of the attacks,
or their models directly.

Figure 7. Intrusion detection systems sharing data or models to train a global
collaborative model.

Several papers share data to achieve their CIDS. Tug et al. propose to use the
blockchain to share the signatures used in a SIDS, in a scheme they name
CBSigIDS (Tug et al., 2018). In their paper, they show blockchain enhances the
effectiveness and robustness of Signature-based IDSs under adversarial
scenarios. In a later study, Tug et al. evaluate the performance of CBSigIDS
under different scenarios (Li et al., 2019a). Kolokotroniset al. propose a
packet-filtering mechanism based on CIDS and blockchain (Kolokotronis et al.,
2019). They propose a consensus protocol which combines Proof of Work and
Proof of Stake. They later propose their CIDS for the Internet of Medical
Things (Kolokotronis et al., 2022). Alexopoulos et al. propose a generic
architecture to incorporate blockchain in CIDS, and discuss about design
decisions for such systems (Alexopoulos et al., 2018). After discussing design
decisions, they present TRIDEnT (Alexopoulos et al., 2019, 2020), a
collaborative platform aiming to incentivize parties to exchange data. TRIDEnT
enables entities in potentially competitive positions to selectively share,
market, and obtain security notifications. Alexopoulos et al. then introduce a
game-theoretic model for alert sharing, and demonstrate that collaboration
will inevitably happen. Yenugunti and Yau present an approach using a trust
score as a reputation system, with the goal of sharing logs (Yenugunti and
Yau, 2020). Fan et al. build a prototype using smart contracts and IPFS (Fan
et al., 2020). They use this scheme to efficiently share and distribute
detection signatures in real-time. Kumar and Singh propose utilizing the cloud
as a support to a blockchain-based CIDS (Kumar and Singh, 2020). Alkadi et al.
propose a framework to enable CIDS for protecting IoT and Cloud networks
(Alkadi et al., 2020). Liu et al. work on adding an SGX component to their IDS
(Liu et al., 2021a), while Saveetha and Maragatham use deep learning (Saveetha
and Maragatham, 2022). Alevizos et al. build their CIDS within a zero-trust
architecture (Alevizos et al., 2022). Abdel-Basset et al. use a CIDS for the
Industrial Edge of Things, and test their proof of concept using two public
datasets (Abdel-Basset et al., 2022).

Some papers share their models to achieve a collaborative IDS. Preuveneers et
al. propose a federated learning AIDS scheme, where they consider an adversary
trying to poison one of the local machine learning models with malicious data
(Preuveneers et al., 2018). They use a blockchain to support the machine
learning process, providing them with full transparency and a way to hold the
adversary accountable. Golomb et al. propose CIoTA, an AIDS using the
blockchain to perform distributed and collaborative anomaly detection for
devices with limited resources in the IoT (Golomb et al., 2018). Some papers
use blockchain to achieve a Snort-based IDS (Ujjan et al., 2019; Gurung et
al., 2022). In a more specific context, Li et al. propose a challenge-based
CIDS using blockchain to enhance the robustness of said challenges (Li et al.,
2019b). In another paper, they defend against advanced insider attacks and
evaluate their approach in both a simulated and real network environment (Meng
et al., 2020). They evaluate their approach with an alarm aggregation system.
Li et al. then later use their challenge-based CIDS as a test case to describe
a general framework for CIDS in SDN (Li et al., 2020b, 2021, 2022). Rathore et
al. propose a CIDS to share Signature-based IDS models between parties in the
context of IoT networks (Rathore et al., 2019). Santin et al. use random
forests as well as a secure execution environment to achieve their CIDS
(Santin et al., 2022).

Some data-sharing CIDSs concentrate on a domain in particular. Demertzis
proposes a CIDS for smart cities (Demertzis, 2021). A few papers concentrate
on power systems (Pahlevan et al., 2021; Ramanan et al., 2021). Aljuhani
focuses on the Internet of Medical Things (Aljuhani, 2022). Likewise, some
model-sharing CIDSs concentrate on a specific domain. For example, Zhang et
al. use a blockchain-based CIDS in the context of the Industrial IoT (Zhang et
al., 2020). Here, they use their system to detect device failures. Adhikari
and Davis on the other hand propose the use of CIDS for aviation cybersecurity
(Adhikari and Davis, 2020). Liu et al. develop their CIDS in the context of
vehicular edge computing (Liu et al., 2021b). Closely related, He et al. give
their approach for unmanned aerial vehicles (He et al., 2022). Like Aljuhani
(Aljuhani, 2022), Ashraf et al. consider the Internet of Medical Things, but
use a model-sharing approach (Ashraf et al., 2022).

Lastly, several papers study the suitability of blockchain for Intrusion
Detection Systems (Dawit et al., 2020; Diro et al., 2021). In relation,
Winanto et al. design a consensus algorithm specifically for collaborative
SIDS (Winanto et al., 2021). At the frontier of IDS and DDoS defense, Kumar et
al. propose to use a CIDS to detect DDoS attacks in IoT networks (Kumar et
al., 2022). Blockchain offers several benefits for intrusion detection
systems, such as full transparency and traceability. This allows participants
to oversee data being shared. Participants can also track who shares what
data, meaning a reputation system can be created to remove bad actors.
Unrelated to Intrusion Detection, blockchain has also been used in other
federated learning applications (Wang et al., 2022; Singh et al., 2023; Tang
et al., 2022).

Overall, the archetypes of blockchain usage for intrusion detection systems
are quite simple. What varies greatly in the papers using blockchain to do
intrusion detection is the context they are applied in, and, when applicable,
the machine learning models.

#### Secure Data Sharing

Data sharing is often considered the primary and most common use case for
blockchain technology, serving as a decentralized record management system.
Compared to the two previous use cases which also securely share data, here we
focus on the more general case. Blockchain enables secure data sharing by
providing robust authentication, confidentiality, and accountability measures.
By utilizing blockchain for data sharing, organizations can enhance their
cybersecurity efforts while maintaining full control over their sensitive
information. Figure 8 depicts different entities using blockchain as a
decentralized record management system.

Figure 8. Entities using blockchain as a decentralized record management
system.

Azaria et al. propose to use blockchain to handle the access to medical
records (Azaria et al., 2016). This enables patients to easily access their
medical data, as well as an immutable log of access. The paper paves the way
to medical data economics, giving researchers access to the data, and patients
the choice the release it. Akarca et al. also consider medical records,
detailing the kind of blockchain to use (Akarca et al., 2019).

Christidis and Devetsikiotis on the other hand explore the use of blockchain
for IoT, mostly for process automation (Christidis and Devetsikiotis, 2016).
Abdulkader et al. propose a scheme involving edge computing to scale the
blockchain for the IoT (Abdulkader et al., 2019). Neureither et al. leverage
the blockchain to manage a trust relation graph for trust relationships in the
IoT (Neureither et al., 2020). Close to the IoT, Ossamah considers the use of
blockchain as a means to enhance drone cybersecurity (Ossamah, 2020). Lee and
Kwon use distributed watchdogs enhanced with blockchain to securely manage
software updates in the industrial IoT (Lee and Kwon, 2021).

Blockchain can also be useful for supply chain management, where parties need
to collaborate and share information about products and deliveries. Mylrea and
Gourisetti for example examine how blockchain can help meet compliance
standards and cybersecurity for the power grid (Mylrea and Gourisetti, 2018).
Gürcan et al. on the other hand apply blockchain to energy performance
contracts, used for energy conservation measurements (Gürcan et al., 2018).
They store predictive models and data in the blockchain, to ensure
transparency for auditing. Likewise, Cali et al. leverage blockchain for
renewable energy certificates (Cali et al., 2021). Demirkan et al. look at the
impact of blockchain for business and accounting, namely in terms of
cybersecurity and auditing (Demirkan et al., 2020).

Closer to cybersecurity, Brotsis et al. consider the use of blockchain to
store forensic evidence metadata (Brotsis et al., 2019). Shi et al. make a
distributed honeypot, which is a decoy system designed to attract and trap
malicious actors (Shi et al., 2019). In this paper, Shi et al. use the
blockchain to store port access data. Hu et al. on the other hand use
blockchain to collect user behavioral data, with the purpose of computational
trust (Hu et al., 2020).

###  5.2. Blockchain

In this section, we take a look at blockchains used in collaborative
cybersecurity systems. In particular, we explore underlying technologies,
consensus methods, access control and data validation policies. We find that,
surprisingly, a lot of papers in the literature do not use the best possible
blockchain for their use cases.

#### Technology

Surprisingly, a lot of the papers do not specify any particular technology,
even when they implemented a proof of concept. Twenty-one papers out of 71
seem to think of and use blockchain more as a conceptual object than as an
actual technology. One reason possibly explaining this is that the paper might
not need a specific technology, but rather a general-purpose blockchain, and
that as such, the technology can be any kind of blockchain.

Ethereum is the most used technology with 27 papers. This is not surprising
considering the frequent use of smart contracts in the implementations. Ten
papers use custom-made blockchains, and six papers use Hyperledger Fabric. The
use of Hyperledger is to be expected considering the availability of
chaincodes for implementation purposes. Papers using custom-made blockchains
are for the most part more concerned with developing a proof of concept than
an actual implementation on a prominent platform.

The use of blockchain in different technologies has evolved over the years.
Figure 9 shows that the use of Ethereum is dwindling in favor of other
technologies like Hyperledger Fabric. Note the presence in 2022 of FISCO BCOS,
which is the largest and most active consortium blockchain ecosystem in China
(FISCO BCOS, 2023).

Figure 9. Number of approaches per technology per year. Ethereum usage is
decreasing while Hyperledger Fabric usage is increasing.

As one can see, a lot of technologies have been used over the years. While
Ethereum was more prevalent in earlier years, the field has fragmented, with
competing solutions being used in its stead.

#### Consensus

On the side of consensus, most of the papers once again do not specify any
particular consensus method. 33 out of 71 papers do not specify a consensus
method. This ties in to the same remark as for technology; a specific kind of
consensus might not be needed for the purposes of the paper. Note that when a
paper does not specify a blockchain technology, it will also most of the time
not specify a consensus method as well, solidifying that their use of
blockchain is very conceptual.

Figure 10 shows the number of approaches per type of consensus per year. A lot
of different consensus methods have been used over the years, with no clear
solution rising above the others. Even more so than with technology, the
research community does not seem to agree on what the best consensus algorithm
is for collaborative cybersecurity applications.

Figure 10. Number of approaches per type of consensus per year.

Here, we need to make a distinction between public and private blockchains.
Since the assumption of trust in the participants in public blockchains is
lower, public blockchains should use a more robust consensus algorithm, like
Proof of Work or Proof of Stake. Private blockchains on the other hand have a
better idea of who is participating in the network, since access is restricted
by definition. This means private blockchains can afford a lower trust
assumption than public blockchains. As such, applications using private
blockchains should use a consensus protocol primarily as a fault-tolerant
means of achieving global consistency by inducing a tamper-proof record
(Ramanan et al., 2021).

#### Access control

When looking at access control, we can see that most papers use a private
blockchain. Out of 71 papers, 58 use a private blockchain, which is
understandable since collaborative cybersecurity systems usually look to
involve a reduce, private set of participants, and where not just anyone can
join. Figure 11 shows just that.

Figure 11. Approaches per access control mode per year.

Some attempts at using public blockchains have been made, but overall they are
way less prevalent. This is understandable, because it presents itself as a
risk to collaborative cybersecurity systems. On the one hand, they can gain
access to more data, or participants to increase the security of the overall
system. On the other, they risk introducing malicious actors into the system,
or even participants which will decrease the overall quality of the data
shared on the blockchain. On top of that, there is always the risk of giving
sensitive insights to unwanted parties. This is relevant in the case of DDoS
defense, where attackers could see the blocked IP addresses. It is also
relevant for intrusion detection systems, since an attacker could learn about
the systems used to keep him out by learning about the model.

Once again for this characteristic, nine papers do not specify any kind of
access control method. Out of those, some papers just use blockchain as a
concept, while others simply omit the fact they use a private blockchain,
which we can gather from the application and context of the papers.

#### Data validation policy

On the side of data validation policy, we can see that most papers prefer
using a permissioned blockchain. 55 out of 71 papers use permissioned
blockchains. This is illustrated in Figure 12. For the same reasons as the
prevalent use of private blockchains over public blockchains, most papers
prefer to limit the data validation process to just a few actors using the
blockchain. Unsurprisingly, most private blockchains are also permissioned,
whereas most public blockchains are permissionless.

Figure 12. Approaches per permission mode per year.

Like with access control, nine papers do not specify any kind of data
validation policy. For the same reasons as before, some papers just use
blockchain as a concept, while others simply omit the fact they use a
permissioned blockchain.

###  5.3. Field fragmentation

The last sections show that the field of blockchain for collaborative
cybersecurity is still very fragmented. This is probably due at least partly
to the freshness of blockchain. Even though the first use of a decentralized
blockchain dates back to 2008, it was not until 2015 that smart contracts were
introduced. Moreover, it was not until 2019 that blockchain started really
picking up pace, and that the research community started to use this
technology for collaborative cybersecurity applications.

The following paragraphs explore additional aspects of the surveyed papers in
order to demonstrate the extent of the field’s fragmentation. Namely, we look
at the domains the applications were written for, the relevant venues papers
were published in, as well as the research groups and the countries the
authors came from.

#### Domains

Figure 13 depicts the number of approaches per domain per year. Note that if a
paper matched multiple domains, it was counted for each one of those domains.
The figure shows that the Internet of Things is the most popular domain, with
22 papers in total. Seventeen papers were published independently of any
particular domain. Following domains include Networks and Software-defined
Networking, with twelve and nine papers respectively.

Figure 13. Number of approaches per domain per year. A paper matching multiple
domains is counted for each one of those domains.

One can see with Figure 13 that trends seem to remain stable over this time
period. This lack of convergence as well as the high number of different
domains are more proof that this domain is still very fragmented, even today.

#### Countries

We also consider in this study the country of origin of the papers. Note that
like for the domains, we also count a paper for multiple countries if the
authors were from multiple countries. Analyzing the papers, we found that
China was most represented, with eighteen papers having at least one author
from China. China is closely followed by the United States of America, with
twelve papers having at least one author working in America. This observation
does not necessarily mean that China or the United States of America publish
more than other countries on the topic because they have a particular interest
in it. Indeed, what we measure here might just be a side effect of population
size, with China and the United States of America publishing more papers than
other countries overall anyways (Scimago, 2022). We argue that this finding is
still interesting to point out, since it indicates a global tendency on the
topic regardless of the reasons for why such a tendency would emerge in the
first place.

Figure 14. Number of papers per country of origin. A paper with authors from
multiple countries counts for each one of those countries.

Figure 14 represents the number of papers originating from a specific country.
This map can be referenced for further inspection about which countries
published on the topic. As before, this finding highlights great diversity and
fragmentation when it comes to blockchain for collaborative cybersecurity.

#### Research groups

We analyzed the research groups that authored the papers considered in the
study. Like for the domains and countries, we count a paper for multiple
research groups if its authors belong to more than one group. The research
groups that contributed the most, with five papers each, were the University
of Technology of Troyes, the University of Montréal and the University of
Zürich. Overall, there does not seem to be a prevalent research group, as
other groups are not far behind those universities in terms of number of
papers. This is yet another confirmation that research on the topic is still
very fragmented, with no group or groups contributing a significant share of
the research on the topic. Figure 16 in Appendix A shows the number of papers
per research group per year. There does not seem to be any particular trend
when it comes to the research groups, and the figure indicates a shift in
research groups over the years.

#### Relevant venues

We can reach the same conclusion as with research groups when looking at
relevant venues. The top venues to publish in are IEEE Access and the IEEE
Internet of Things Journal, with five and four papers respectively. Figure 17
in Appendix A represents the number of papers per venue per year. As with the
research groups, there is a shift in venues those works are published in over
the years. Yet another bit of evidence that the field is still new and
fragmented.

##  6\. Open Issues and Lessons Learned

###  6.1. Lessons Learned

Blockchain technology has rapidly gained traction in the cybersecurity
landscape due to its decentralized nature and robust security features. In the
following section, we detail some of the lessons learned from examining the
literature around blockchain for collaborative cybersecurity.

Explore minor applications and new use cases — As we have seen, blockchain has
been used in various cybersecurity applications. Prominent applications
include DDoS defense, intrusion detection and data sharing, while minor
cybersecurity applications include forensics, distributed honeypots and trust
management. It is crucial to explore those minor applications further to
uncover their potential benefits and discover new use cases in the
cybersecurity domain.

Choose your blockchain meticulously — The current literature on the
application of blockchain technology in cybersecurity reveals certain
shortcomings, particularly in the areas of blockchain selection and consensus
mechanisms. Many papers fail to utilize the most appropriate blockchain for
their specific use cases, and some even neglect to specify the type of
blockchain employed in their research. This lack of clarity can hinder the
effectiveness of proposed solutions and impede the overall progress of the
field. To address these issues, it is crucial for researchers to meticulously
and transparently select the nature of the blockchain they intend to use for
their applications. This process should involve a thorough analysis of the
specific requirements and constraints of the use case, as well as a
comprehensive understanding of the advantages and limitations of various
blockchains.

Similarly, the choice of consensus algorithm is equally important for the
success and effectiveness of a blockchain-based solution. Many researchers
have been found to overlook the significance of choosing an appropriate
consensus mechanism that aligns with the nature of their selected blockchain.
This oversight can result in suboptimal performance and reduced scalability.
For instance, in the case of public permissionless blockchains, researchers
should consider consensus mechanisms like Proof of Work (PoW) or Proof of
Stake (PoS), which are designed to maintain security and decentralization in
an open environment. On the other hand, for private permissioned blockchains,
algorithms like PBFT are more suitable, as they can ensure quick and secure
consensus among a predetermined set of trusted nodes.

By carefully selecting the most appropriate blockchain type and consensus
mechanism, researchers can develop more effective and efficient solutions for
their cybersecurity applications. This attention to detail will not only
enhance the robustness of the proposed solutions but also foster greater
confidence and understanding within the research community, ultimately driving
the continued evolution and maturation of the field.

Blockchain technology is still emerging — The nascent nature of blockchain
technology in the realm of cybersecurity is apparent, with the first academic
papers and discussions surfacing around 2016 and 2017. The current state of
fragmentation and the absence of a unified approach, as illustrated in Section
5.3, further confirms this observation.

Nevertheless, as the field continues to mature and evolve, we can anticipate
significant advancements and innovations in leveraging blockchain technology
to address various cybersecurity challenges. As researchers and industry
experts collaborate and share insights, we can expect the development of
standardized frameworks and methodologies for implementing blockchain-based
solutions in cybersecurity. These standardized approaches will not only
facilitate broader adoption but also provide a foundation for evaluating the
effectiveness and efficiency of blockchain applications in this context.

Moreover, as more use cases and real-world applications emerge, the field will
gain a deeper understanding of the potential limitations and drawbacks of
blockchain technology in cybersecurity. This knowledge will prove instrumental
in refining existing solutions and addressing any technological gaps or
vulnerabilities.

Lack of collaboration incentives — Incentives for collaboration remain a
critical question in the literature (Han et al., 2022). In previous works,
there has been a notable absence of incentive mechanisms within the realm of
blockchain technology for collaborative cybersecurity. This oversight is
particularly striking given that incentive mechanisms play a crucial role in
fostering active participation and collaboration between parties.

Despite the importance of incentive mechanisms, the literature has largely
glossed over this aspect, focusing instead on other technological aspects like
specific machine learning methods. This neglect has left a significant gap in
our understanding of how to design and implement effective incentive
structures within blockchain networks, which is essential for their long-term
sustainability and widespread adoption. In the context of DDoS defense for
example, an Autonomous System has incentives beyond rewards to mitigate these
attacks, as it saves them bandwidth. Researchers should explore incentives
further to understand the motivation for collaboration and their role in
addressing cybersecurity challenges.

###  6.2. Blockchain Design Choices

The current literature highlights certain shortcomings in the design choices
made when applying blockchain technology to cybersecurity. These shortcomings
primarily pertain to the selection of the appropriate blockchain type and
consensus mechanism for specific use cases. Insufficient attention is given to
these crucial decisions, leading to less effective and optimized solutions. To
address these issues, researchers and practitioners must meticulously evaluate
and select the most suitable blockchain for their applications.

Greenspan (Greenspan, 2015) has proposed eight requirements to ensure
justified use of blockchain technology. These requirements include the need
for a shared ledger, involvement of multiple writers, absence of trust between
writers, avoidance of centralized third parties, transaction interaction,
transaction verifiability, existence of validators, and the storage of value.

Additionally, Wüst and Gervais (Wüst and Gervais, 2018) have devised a process
for determining the suitable type of blockchain, or whether a blockchain
should be used at all. This process is depicted in Figure 15.

Figure 15. Process to determine if blockchain is an appropriate solution
(Following Wüst and Gervais (Wüst and Gervais, 2018)).

Based on the insights gained from our study, we can offer guidance on the
selection of blockchain type and consensus mechanisms for different scenarios.
Considering Figure 15, in the case of private permissionless blockchains, we
recommend to follow the same decision process as for private permissioned
blockchains. The decision of making the private blockchain permissioned or
permissionless depends on whether all participants need to validate blocks, or
just a subset.

Regarding the choice of underlying technology, we advise to rely on well-
established projects such as Ethereum or Hyperledger. These platforms have a
proven track record and extensive community support, which can contribute to
the stability and reliability of the cybersecurity system.

In public blockchains where the trust assumption among participants is lower,
it becomes crucial to employ a robust consensus algorithm. Consensus
mechanisms like Proof of Work (PoW) or Proof of Stake (PoS) are designed to
ensure security and decentralization in an open environment.

On the other hand, private blockchains have more control over participant
access since access is restricted by design. This allows for a lower trust
assumption compared to public blockchains. In such cases, the consensus
protocol should primarily serve as a fault-tolerant mechanism to achieve
global consistency and maintain a tamper-proof record (Ramanan et al., 2021),
like PBFT.

By adhering to a meticulous selection process guided by the decision flowchart
provided by Wüst and Gervais as well as our added insights on technology and
consensus algorithm choice, researchers and practitioners can make informed
decisions regarding their choice of blockchain. Careful consideration will
lead to more effective solutions for cybersecurity applications, improving the
overall robustness of those systems. Ultimately, it will contribute to the
continued evolution and maturation of the field.

###  6.3. Open Issues

While significant progress has been made in the field of collaborative
cybersecurity using blockchain technology, there remain several open issues
that warrant further exploration and research. Some of the open issues have to
do with certain applications that have been less explored.

Collaborative intrusion response — As we saw in this study, a lot of papers
focus on intrusion detection, but very few focus on the response to this
intrusion. Intrusion response systems are essential to develop effective
countermeasures, minimize the damage caused by unauthorized access to computer
networks, limit the impact of any breaches that do occur, and ultimately
reduce the risk of future attacks. More attention should be given to this
area, particularly to the automation of response to cyber threats. Like with
collaborative intrusion detection systems, blockchain should be a part of
collaborative intrusion response systems.

Public collaborative cybersecurity — Collaborative cybersecurity systems using
public blockchains remain relatively scarce. For example, out of all the
intrusion detection papers, only one considered using a public permissionless
blockchain. While many organizations prefer to keep their blockchain networks
private and permissioned for security reasons, a functioning public system
could potentially provide more data to train intrusion detection systems
better, leading to improved cybersecurity measures.

Self-Sovereign Identities — The concept of self-sovereign identities is an
area that requires more investigation. Identity is the foundation of security.
Self-Sovereign Identities (SSIs) are an innovative approach to digital
identity management that empowers users with increased control over their
personal information, leading to enhanced privacy and security. In time, those
SSIs could constitute the basis for many collaborative cybersecurity
applications, as they facilitate the process of trust establishment in those
systems.

Several open issues have more to do with intrisic properties of the blockchain
itself.

Scalability — Scalability remains an important challenge for blockchain
technology. Distributed ledgers have scalability limitations when it comes to
handling large amounts of data. This can create a bottleneck when trying to
share and collaborate on cybersecurity data in real-time. Developing efficient
compression schemes and sharding techniques will be necessary to ensure that
the blockchain can handle increasing transaction volumes and data storage
demands, especially in the case of public blockchains and certain environments
like the Internet of Things.

Interoperability — Interoperability is another crucial aspect that needs to be
addressed. Different blockchain platforms may not be able to communicate with
each other, creating silos of data and limiting collaboration.
Interoperability standards need to be established to allow different
blockchain networks to interoperate seamlessly. In the case of collaborative
cybersecurity applications, such interoperability could facilitate
collaboration between various collaborative applications with different but
converging purposes. For example, one could imagine a forensics application
using blockchain collaborating with a blockchain-based CIDS by sharing its
data.

Legal and regulatory compliance — Legal and regulatory compliance is a
significant concern when implementing collaborative cybersecurity solutions
using distributed ledgers. Participants need to ensure that their activities
are compliant with relevant laws and regulations, such as data protection and
privacy laws. GDPR compliance in particular poses challenges for blockchain
implementation, especially regarding the right to erasure. The permanence of
data on the blockchain conflicts with the GDPR’s prohibition on storing
Personally Identifiable Information in Europe. As such, there is a need for
blockchain-based collaborative cybersecurity systems that can handle this
right to erasure. Researchers and practitioners should carefully consider
these compliance issues when designing and implementing blockchain-based
cybersecurity solutions.

##  7\. Conclusion

This paper presented a comprehensive literature review on the use of
blockchain technology in collaborative cybersecurity systems. After giving an
overview on the domain, we identified key applications and trends in
blockchain usage in these systems. We also established open research issues
and lessons learned to guide future work in the area.

In Section 1, we introduced the concept of collaborative cybersecurity and the
benefits of using decentralized approaches. Section 2 delved into related
work. We detailed our research methodology in Section 3. Section 4 gave a
detailed background on blockchain technology, covering nature, technology, and
consensus. We detailed our findings on the identified papers in Section 5. It
contains a description of the archetypes of collaborative cybersecurity
applications using blockchain. We analyzed the papers in terms of several
criteria, e.g. access control method, over time. In Section 6, we gave
guidelines on an informed choice of the right blockchain technology based on
the desired applications. We discussed open issues and lessons learned,
identifying challenges and potential areas for further research.

Regarding our research questions, the main use cases for collaborative
cybersecurity applications using blockchain currently are DDoS defense,
intrusion detection systems, and secure data sharing (RQ1). Blockchain
technology has been used in more than ten domains, as shown in Figure 13
(RQ2). The blockchains used in collaborative cybersecurity systems (RQ3) are
mostly private (Figure 11), permissioned (Figure 12), but are not
characterized by a particular technology (Figure 9) or consensus method
(Figure 10). Over time (RQ4), collaborative cybersecurity using blockchain has
attracted more and more contributions (Figure 2), with an increasing number of
contributions targeting intrusion detection systems (Figure 3). Nevertheless,
the field is still fragmented (Figure 9, Figure 10, Figure 13), with no
prevalent research group (Figure 16) or venue (Figure 17).

Overall, our work shows that blockchain technology holds great potential in
the field of collaborative cybersecurity due to its decentralized nature
(RQ5). However, blockchain selection and consensus mechanisms are often chosen
poorly or without sufficient justification, negatively impacting the
effectiveness of the proposed solutions.

After guiding the reader towards a more-informed choice of blockchain
technology, we showed in Section 6 the literature has generally overlooked the
importance of collaboration incentives, leaving a critical gap in our
understanding of how to foster active participation in blockchain networks.

Our study highlighted numerous open challenges that warrant further research.
Key concerns involve collaborative efforts in intrusion response systems, the
application of public blockchains to collaborative cybersecurity systems and
self-sovereign identities. Focusing on the blockchain aspect, open issues
include enhancing scalability, fostering interoperability, and ensuring
compliance with legal and regulatory standards for the blockchains that
underpin these cooperative cybersecurity initiatives.

As the field continues to mature, we expect significant advancements and
innovations in leveraging blockchain technology to address various
cybersecurity challenges. By addressing these open issues and learning from
the lessons identified in this review, researchers and practitioners can
develop more effective and efficient blockchain-based solutions for
collaborative cybersecurity applications, ultimately enhancing the overall
security of organizations and their ability to protect against cyber attacks.

###### Acknowledgements.

Supported by the industrial chair Cybersecurity for Critical Networked
Infrastructures (cyberCNI.fr) with support of the FEDER development fund of
the Brittany region.

## References

  * (1)
  * Abdel-Basset et al. (2022) Mohamed Abdel-Basset, Nour Moustafa, and Hossam Hawash. 2022\.  Privacy-Preserved Cyberattack Detection in Industrial Edge of Things (IEoT): A Blockchain-Orchestrated Federated Learning Approach.  _IEEE Transactions on Industrial Informatics_ 18, 11 (2022), 7920–7934.
  * Abdulkader et al. (2019) Omar Abdulkader, Alwi M Bamhdi, Vijey Thayananthan, Fathy Elbouraey, and Bandar Al-Ghamdi. 2019\.  A lightweight blockchain based cybersecurity for IoT environments. In _2019 6th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2019 5th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom)_. IEEE, 139–144.
  * Abou El Houda et al. (2019a) Zakaria Abou El Houda, Abdelhakim Hafid, and Lyes Khoukhi. 2019a.  Co-IoT: A collaborative DDoS mitigation scheme in IoT environment based on blockchain using SDN. In _2019 IEEE Global Communications Conference (GLOBECOM)_. IEEE, 1–6.
  * Abou El Houda et al. (2020a) Zakaria Abou El Houda, Abdelhakim Hafid, and Lyes Khoukhi. 2020a.  Brainchain-a machine learning approach for protecting blockchain applications using sdn. In _ICC 2020-2020 IEEE International Conference on Communications (ICC)_. IEEE, 1–6.
  * Abou El Houda et al. (2019b) Zakaria Abou El Houda, Abdelhakim Senhaji Hafid, and Lyes Khoukhi. 2019b.  Cochain-SC: An intra-and inter-domain DDoS mitigation scheme based on blockchain using SDN and smart contract.  _IEEE Access_ 7 (2019), 98893–98907.
  * Abou El Houda et al. (2018) Zakaria Abou El Houda, Lyes Khoukhi, and Abdelhakim Hafid. 2018\.  Chainsecure-a scalable and proactive solution for protecting blockchain applications using sdn. In _2018 IEEE global communications conference (GLOBECOM)_. IEEE, 1–6.
  * Abou El Houda et al. (2020b) Zakaria Abou El Houda, Lyes Khoukhi, and Abdelhakim Senhaji Hafid. 2020b.  Bringing intelligence to software defined networks: Mitigating DDoS attacks.  _IEEE Transactions on Network and Service Management_ 17, 4 (2020), 2523–2535.
  * Adhikari and Davis (2020) Sam Adhikari and Chris Davis. 2020.  Application of blockchain within aviation cybersecurity framework. In _Aiaa Aviation 2020 Forum_. 2931.
  * Akarca et al. (2019) D Akarca, PY Xiu, D Ebbitt, B Mustafa, H Al-Ramadhani, and A Albeyatti. 2019\.  Blockchain secured electronic health records: patient rights, privacy and cybersecurity. In _2019 10th International Conference on Dependable Systems, Services and Technologies (DESSERT)_. IEEE, 108–111.
  * Alevizos et al. (2022) Lampis Alevizos, Max Hashem Eiza, Vinh Thong Ta, Qi Shi, and Janet Read. 2022\.  Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture.  _IEEE Access_ 10 (2022), 89270–89288.
  * Alexopoulos et al. (2018) Nikolaos Alexopoulos, Emmanouil Vasilomanolakis, Natália Réka Ivánkó, and Max Mühlhäuser. 2018.  Towards blockchain-based collaborative intrusion detection systems. In _Critical Information Infrastructures Security: 12th International Conference, CRITIS 2017, Lucca, Italy, October 8-13, 2017, Revised Selected Papers 12_. Springer, 107–118.
  * Alexopoulos et al. (2019) Nikolaos Alexopoulos, Emmanouil Vasilomanolakis, Stephane Le Roux, Steven Rowe, and Max Mühlhäuser. 2019.  TRIDEnT: building decentralized incentives for collaborative security.  _arXiv preprint arXiv:1905.03571_ (2019).
  * Alexopoulos et al. (2020) Nikolaos Alexopoulos, Emmanouil Vasilomanolakis, Stephane Le Roux, Steven Rowe, and Max Mühlhäuser. 2020.  TRIDEnT: towards a decentralized threat indicator marketplace. In _Proceedings of the 35th Annual ACM Symposium on Applied Computing_. 332–341.
  * Aljuhani (2022) Ahamed Aljuhani. 2022\.  IDS-Chain: A Collaborative Intrusion Detection Framework Empowered Blockchain for Internet of Medical Things. In _2022 IEEE Cloud Summit_. IEEE, 57–62.
  * Alkadi et al. (2020) Osama Alkadi, Nour Moustafa, Benjamin Turnbull, and Kim-Kwang Raymond Choo. 2020.  A deep blockchain framework-enabled collaborative intrusion detection for protecting IoT and cloud networks.  _IEEE Internet of Things Journal_ 8, 12 (2020), 9463–9472.
  * Ashraf et al. (2022) Eman Ashraf, Nihal FF Areed, Hanaa Salem, Ehab H Abdelhay, and Ahmed Farouk. 2022.  Fidchain: Federated intrusion detection system for blockchain-enabled iot healthcare applications. In _Healthcare_ , Vol. 10. MDPI, 1110\.
  * Azaria et al. (2016) Asaph Azaria, Ariel Ekblaw, Thiago Vieira, and Andrew Lippman. 2016.  Medrec: Using blockchain for medical data access and permission management. In _2016 2nd international conference on open and big data (OBD)_. IEEE, 25–30.
  * Baiod et al. (2021) Wajde Baiod, Janet Light, and Aniket Mahanti. 2021.  Blockchain technology and its applications across multiple domains: a survey.  _Journal of International Technology and Information Management_ 29, 4 (2021), 78–119.
  * Belchior et al. (2022) Rafael Belchior, Sérgio Guerreiro, André Vasconcelos, and Miguel Correia. 2022\.  A survey on business process view integration: past, present and future applications to blockchain.  _Business Process Management Journal_ (2022).
  * Briner and Denyer (2012) Rob B Briner and David Denyer. 2012.  Systematic review and evidence synthesis as a practice and scholarship tool.  _Oxford Handbook of Evidence-Based Management_ (2012).
  * Brotsis et al. (2019) Sotirios Brotsis, Nicholas Kolokotronis, Konstantinos Limniotis, Stavros Shiaeles, Dimitris Kavallieros, Emanuele Bellini, and Clément Pavué. 2019.  Blockchain solutions for forensic evidence preservation in IoT environments. In _2019 IEEE Conference on Network Softwarization (NetSoft)_. IEEE, 110–114.
  * Buterin et al. (2014) Vitalik Buterin et al. 2014\.  A next-generation smart contract and decentralized application platform.  _white paper_ 3, 37 (2014), 2–1.
  * Cali et al. (2021) Umit Cali, Murat Kuzlu, Manisa Pipattanasomporn, Onur Elma, and Ramesh Reddi. 2021.  Cybersecurity of Renewable Energy Data and Applications Using Distributed Ledger Technology.  _arXiv preprint arXiv:2110.11354_ (2021).
  * Chen et al. (2017) Lin Chen, Lei Xu, Nolan Shah, Zhimin Gao, Yang Lu, and Weidong Shi. 2017\.  On security analysis of proof-of-elapsed-time (poet). In _Stabilization, Safety, and Security of Distributed Systems: 19th International Symposium, SSS 2017, Boston, MA, USA, November 5–8, 2017, Proceedings 19_. Springer, 282–297.
  * Chiu et al. (2022) Wei-Yang Chiu, Weizhi Meng, Wenjuan Li, and Liming Fang. 2022\.  FolketID: A Decentralized Blockchain-Based NemID Alternative Against DDoS Attacks. In _Provable and Practical Security: 16th International Conference, ProvSec 2022, Nanjing, China, November 11–12, 2022, Proceedings_. Springer, 210–227.
  * Christidis and Devetsikiotis (2016) Konstantinos Christidis and Michael Devetsikiotis. 2016.  Blockchains and smart contracts for the internet of things.  _Ieee Access_ 4 (2016), 2292–2303.
  * Dawit et al. (2020) Nahom Aron Dawit, Sujith Samuel Mathew, and Kadhim Hayawi. 2020.  Suitability of blockchain for collaborative intrusion detection systems. In _2020 12th Annual Undergraduate Research Conference on Applied Computing (URC)_. IEEE, 1–6.
  * De Angelis et al. (2018) Stefano De Angelis, Leonardo Aniello, Roberto Baldoni, Federico Lombardi, Andrea Margheri, Vladimiro Sassone, et al. 2018\.  PBFT vs proof-of-authority: Applying the CAP theorem to permissioned blockchain. In _CEUR workshop proceedings_ , Vol. 2058. CEUR-WS, 1–11.
  * Demertzis (2021) Konstantinos Demertzis. 2021\.  Blockchained federated learning for threat defense.  _arXiv preprint arXiv:2102.12746_ (2021).
  * Demirkan et al. (2020) Sebahattin Demirkan, Irem Demirkan, and Andrew McKee. 2020\.  Blockchain technology in the future of business cyber security and accounting.  _Journal of Management Analytics_ 7, 2 (2020), 189–208.
  * Dibaei et al. (2021) Mahdi Dibaei, Xi Zheng, Youhua Xia, Xiwei Xu, Alireza Jolfaei, Ali Kashif Bashir, Usman Tariq, Dongjin Yu, and Athanasios V Vasilakos. 2021.  Investigating the prospect of leveraging blockchain and machine learning to secure vehicular networks: A survey.  _IEEE Transactions on Intelligent Transportation Systems_ 23, 2 (2021), 683–700.
  * Diro et al. (2021) Abebe Diro, Naveen Chilamkurti, Van-Doan Nguyen, and Will Heyne. 2021.  A comprehensive study of anomaly detection schemes in IoT networks using machine learning algorithms.  _Sensors_ 21, 24 (2021), 8320.
  * Etemadi et al. (2020) Niloofar Etemadi, YG Borbon, and F Strozzi. 2020.  Blockchain technology for cybersecurity applications in the food supply chain: A systematic literature review.  _Proceedings of the XXIV Summer School “Francesco Turco”—Industrial Systems Engineering, Bergamo, Italy_ (2020), 9–11.
  * Fan et al. (2020) Wenjun Fan, Younghee Park, Shubham Kumar, Priyatham Ganta, Xiaobo Zhou, and Sang-Yoon Chang. 2020\.  Blockchain-enabled collaborative intrusion detection in software defined networks. In _2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)_. IEEE, 967–974.
  * FISCO BCOS (2023) FISCO BCOS. 2023\.  FISCO BCOS.  http://www.fisco-bcos.org/ [Online; accessed 22-March-2023].
  * Gimenez-Aguilar et al. (2021) Mar Gimenez-Aguilar, José María De Fuentes, Lorena Gonzalez-Manzano, and David Arroyo. 2021\.  Achieving cybersecurity in blockchain-based systems: A survey.  _Future Generation Computer Systems_ 124 (2021), 91–118.
  * Golomb et al. (2018) T Golomb, Y Mirsky, and Y Elovici. 2018.  CIoTA: Collaborative Anomaly Detection via Blockchain.  _arXiv preprint arXiv:1803.03807_ (2018).
  * Greenspan (2015) Gideon Greenspan. 2015\.  Avoiding the pointless blockchain project.  https://www.multichain.com/blog/2015/11/avoiding-pointless-blockchain-project/
  * Guo et al. (2021) Wei Guo, Jin Xu, Yukui Pei, Liuguo Yin, and Chunxiao Jiang. 2021.  LDBT: a lightweight DDoS attack tracing scheme based on blockchain. In _2021 IEEE International Conference on Communications Workshops (ICC Workshops)_. IEEE, 1–6.
  * Guo et al. (2022) Wei Guo, Jin Xu, Yukui Pei, Liuguo Yin, Chunxiao Jiang, and Ning Ge. 2022\.  A distributed collaborative entrance Defense framework against DDoS attacks on satellite internet.  _IEEE Internet of Things Journal_ 9, 17 (2022), 15497–15510.
  * Gürcan et al. (2018) Önder Gürcan, Marc Agenis-Nevers, Yves-Marie Batany, Mohamed Elmtiri, François Le Fevre, and Sara Tucci-Piergiovanni. 2018.  An industrial prototype of trusted energy performance contracts using blockchain technologies. In _2018 IEEE 20th International Conference on High Performance Computing and Communications; IEEE 16th International Conference on Smart City; IEEE 4th International Conference on Data Science and Systems (HPCC/SmartCity/DSS)_. IEEE, 1336–1343.
  * Gurung et al. (2022) Gopal Gurung, Gueltoum Bendiab, Maria Shiaele, and Stavros Shiaeles. 2022.  CIDS: Collaborative Intrusion Detection System using Blockchain Technology. In _2022 IEEE International Conference on Cyber Security and Resilience (CSR)_. IEEE, 125–130.
  * Hakak et al. (2021) Saqib Hakak, Wazir Zada Khan, Gulshan Amin Gilkar, Basem Assiri, Mamoun Alazab, Sweta Bhattacharya, and G Thippa Reddy. 2021.  Recent advances in blockchain technology: A survey on applications and challenges.  _International Journal of Ad Hoc and Ubiquitous Computing_ 38, 1-3 (2021), 82–100.
  * Han et al. (2022) Rong Han, Zheng Yan, Xueqin Liang, and Laurence T Yang. 2022\.  How can incentive mechanisms and blockchain benefit with each other? a survey.  _Comput. Surveys_ 55, 7 (2022), 1–38.
  * Hasanova et al. (2019) Huru Hasanova, Ui-jun Baek, Mu-gon Shin, Kyunghee Cho, and Myung-Sup Kim. 2019.  A survey on blockchain cybersecurity vulnerabilities and possible countermeasures.  _International Journal of Network Management_ 29, 2 (2019), e2060.
  * He et al. (2022) Xiaoqiang He, Qianbin Chen, Lun Tang, Weili Wang, and Tong Liu. 2022.  CGAN-Based Collaborative Intrusion Detection for UAV Networks: A Blockchain-Empowered Distributed Federated Learning Approach.  _IEEE Internet of Things Journal_ 10, 1 (2022), 120–132.
  * Hu et al. (2020) Bin Hu, Xiaofang Zhao, Cheng Zhang, Yan Jin, and Bo Wei. 2020.  A Contract Based User-Centric Computational Trust Towards E-Governance. In _Web Services–ICWS 2020: 27th International Conference, Held as Part of the Services Conference Federation, SCF 2020, Honolulu, HI, USA, September 18–20, 2020, Proceedings 27_. Springer, 133–149.
  * Ivanov et al. (2023) Nikolay Ivanov, Chenning Li, Qiben Yan, Zhiyuan Sun, Zhichao Cao, and Xiapu Luo. 2023\.  Security Threat Mitigation For Smart Contracts: A Comprehensive Survey.  _Comput. Surveys_ (2023).
  * Keele et al. (2007) Staffs Keele et al. 2007\.  Guidelines for performing systematic literature reviews in software engineering.
  * Kolokotronis et al. (2019) Nicholas Kolokotronis, Sotirios Brotsis, Georgios Germanos, Costas Vassilakis, and Stavros Shiaeles. 2019.  On blockchain architectures for trust-based collaborative intrusion detection. In _2019 IEEE world congress on services (SERVICES)_ , Vol. 2642. IEEE, 21–28.
  * Kolokotronis et al. (2022) Nicholas Kolokotronis, Maria Dareioti, Stavros Shiaeles, and Emanuele Bellini. 2022.  An Intelligent Platform for Threat Assessment and Cyber-Attack Mitigation in IoMT Ecosystems. In _2022 IEEE Globecom Workshops (GC Wkshps)_. IEEE, 541–546.
  * Krichen et al. (2022) Moez Krichen, Meryem Ammi, Alaeddine Mihoub, and Mutiq Almutiq. 2022.  Blockchain for modern applications: A survey.  _Sensors_ 22, 14 (2022), 5274.
  * Kumar and Singh (2020) Manish Kumar and Ashish Kumar Singh. 2020.  Distributed intrusion detection system using blockchain and cloud computing infrastructure. In _2020 4th international conference on trends in electronics and informatics (ICOEI)(48184)_. IEEE, 248–252.
  * Kumar et al. (2022) Randhir Kumar, Prabhat Kumar, Rakesh Tripathi, Govind P Gupta, Sahil Garg, and Mohammad Mehedi Hassan. 2022.  A distributed intrusion detection system to detect DDoS attacks in blockchain-enabled IoT network.  _J. Parallel and Distrib. Comput._ 164 (2022), 55–68.
  * Kumar et al. (2021) Sathish Kumar, Sarveshwaran Velliangiri, Periyasami Karthikeyan, Saru Kumari, Sachin Kumar, and Muhammad Khurram Khan. 2021\.  A survey on the blockchain techniques for the Internet of Vehicles security.  _Transactions on Emerging Telecommunications Technologies_ (2021), e4317.
  * Kumari and McPherson (2009) W. Kumari and D. McPherson. 2009.  _Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF)_.  RFC 5635. RFC Editor.
  * Lavaur et al. (2022) Léo Lavaur, Marc-Oliver Pahl, Yann Busnel, and Fabien Autrel. 2022.  The Evolution of Federated Learning-based Intrusion Detection and Mitigation: a Survey.  _IEEE Transactions on Network and Service Management_ (2022).
  * Lee and Kwon (2021) JongHyup Lee and Taekyoung Kwon. 2021.  Distributed watchdogs based on blockchain for securing industrial internet of things.  _Sensors_ 21, 13 (2021), 4393.
  * Leng et al. (2020) Jiewu Leng, Shide Ye, Man Zhou, J Leon Zhao, Qiang Liu, Wei Guo, Wei Cao, and Leijie Fu. 2020.  Blockchain-secured smart manufacturing in industry 4.0: A survey.  _IEEE Transactions on Systems, Man, and Cybernetics: Systems_ 51, 1 (2020), 237–252.
  * Li et al. (2020a) Wenyu Li, Chenglin Feng, Lei Zhang, Hao Xu, Bin Cao, and Muhammad Ali Imran. 2020a.  A scalable multi-layer PBFT consensus for blockchain.  _IEEE Transactions on Parallel and Distributed Systems_ 32, 5 (2020), 1146–1160.
  * Li et al. (2020b) Wenjuan Li, Jiao Tan, and Yu Wang. 2020b.  A framework of blockchain-based collaborative intrusion detection in software defined networking. In _Network and System Security: 14th International Conference, NSS 2020, Melbourne, VIC, Australia, November 25–27, 2020, Proceedings 14_. Springer, 261–276.
  * Li et al. (2019a) Wenjuan Li, Steven Tug, Weizhi Meng, and Yu Wang. 2019a.  Designing collaborative blockchained signature-based intrusion detection in IoT environments.  _Future Generation Computer Systems_ 96 (2019), 481–489.
  * Li et al. (2019b) Wenjuan Li, Yu Wang, Jin Li, and Man Ho Au. 2019b.  Towards blockchained challenge-based collaborative intrusion detection. In _Applied Cryptography and Network Security Workshops: ACNS 2019 Satellite Workshops, SiMLA, Cloud S &P, AIBlock, and AIoTS, Bogota, Colombia, June 5–7, 2019, Proceedings 17_. Springer, 122–139.
  * Li et al. (2021) Wenjuan Li, Yu Wang, Jin Li, and Man Ho Au. 2021\.  Toward a blockchain-based framework for challenge-based collaborative intrusion detection.  _International Journal of Information Security_ 20 (2021), 127–139.
  * Li et al. (2022) Wenjuan Li, Yu Wang, Weizhi Meng, Jin Li, and Chunhua Su. 2022.  BlockCSDN: towards blockchain-based collaborative intrusion detection in software defined networking.  _IEICE TRANSACTIONS on Information and Systems_ 105, 2 (2022), 272–279.
  * Lin and Liao (2017) Iuon-Chang Lin and Tzu-Chun Liao. 2017.  A survey of blockchain security issues and challenges.  _Int. J. Netw. Secur._ 19, 5 (2017), 653–659.
  * Liu et al. (2021a) Gao Liu, Zheng Yan, Wei Feng, Xuyang Jing, Yaxing Chen, and Mohammed Atiquzzaman. 2021a.  SeDID: An SGX-enabled decentralized intrusion detection framework for network trust evaluation.  _Information Fusion_ 70 (2021), 100–114.
  * Liu et al. (2021b) Hong Liu, Shuaipeng Zhang, Pengfei Zhang, Xinqiang Zhou, Xuebin Shao, Geguang Pu, and Yan Zhang. 2021b.  Blockchain and federated learning for collaborative intrusion detection in vehicular edge computing.  _IEEE Transactions on Vehicular Technology_ 70, 6 (2021), 6073–6084.
  * Liu et al. (2020) Yang Liu, Debiao He, Mohammad S Obaidat, Neeraj Kumar, Muhammad Khurram Khan, and Kim-Kwang Raymond Choo. 2020.  Blockchain-based identity management systems: A review.  _Journal of network and computer applications_ 166 (2020), 102731\.
  * Mathew et al. (2022) Sujith Samuel Mathew, Kadhim Hayawi, Nahom Aron Dawit, Ikbal Taleb, and Zouheir Trabelsi. 2022\.  Integration of blockchain and collaborative intrusion detection for secure data transactions in industrial IoT: a survey.  _Cluster Computing_ (2022), 1–21.
  * Meng et al. (2020) Weizhi Meng, Wenjuan Li, Laurence T Yang, and Peng Li. 2020\.  Enhancing challenge-based collaborative intrusion detection networks against insider attacks using blockchain.  _International Journal of Information Security_ 19 (2020), 279–290.
  * Meng et al. (2018) Weizhi Meng, Elmar Wolfgang Tischhauser, Qingju Wang, Yu Wang, and Jinguang Han. 2018\.  When intrusion detection meets blockchain technology: a review.  _Ieee Access_ 6 (2018), 10179–10188.
  * Miller and Pelsser (2019) Loïc Miller and Cristel Pelsser. 2019.  A taxonomy of attacks using bgp blackholing. In _Computer Security–ESORICS 2019: 24th European Symposium on Research in Computer Security, Luxembourg, September 23–27, 2019, Proceedings, Part I 24_. Springer, 107–127.
  * Mylrea and Gourisetti (2018) Michael Mylrea and Sri Nikhil Gupta Gourisetti. 2018.  Blockchain for supply chain cybersecurity, optimization and compliance. In _2018 resilience week (RWS)_. IEEE, 70–76.
  * Nakamoto (2008) Satoshi Nakamoto. 2008\.  Bitcoin: A peer-to-peer electronic cash system.  _Decentralized Business Review_ (2008), 21260.
  * Neureither et al. (2020) Jens Neureither, Alexandra Dmitrienko, David Koisser, Ferdinand Brasser, and Ahmad-Reza Sadeghi. 2020\.  LegIoT: Ledgered trust management platform for IoT. In _Computer Security–ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18, 2020, Proceedings, Part I 25_. Springer, 377–396.
  * Ossamah (2020) Almotery Ossamah. 2020\.  Blockchain as a solution to Drone Cybersecurity. In _2020 IEEE 6th World Forum on Internet of Things (WF-IoT)_. IEEE, 1–9.
  * Pahlevan et al. (2021) Maryam Pahlevan, Artemis Voulkidis, and Terpsichori-Helen Velivassaki. 2021\.  Secure exchange of cyber threat intelligence using TAXII and distributed ledger technologies-application for electrical power and energy system. In _Proceedings of the 16th International Conference on Availability, Reliability and Security_. 1–8.
  * Peng et al. (2007) Tao Peng, Christopher Leckie, and Kotagiri Ramamohanarao. 2007\.  Survey of network-based defense mechanisms countering the DoS and DDoS problems.  _ACM Computing Surveys (CSUR)_ 39, 1 (2007), 3–es.
  * Preuveneers et al. (2018) Davy Preuveneers, Vera Rimmer, Ilias Tsingenopoulos, Jan Spooren, Wouter Joosen, and Elisabeth Ilie-Zudor. 2018.  Chained anomaly detection models for federated learning: An intrusion detection case study.  _Applied Sciences_ 8, 12 (2018), 2663.
  * Ramanan et al. (2021) Paritosh Ramanan, Dan Li, and Nagi Gebraeel. 2021.  Blockchain-based decentralized replay attack detection for large-scale power systems.  _IEEE Transactions on Systems, Man, and Cybernetics: Systems_ 52, 8 (2021), 4727–4739.
  * Rathore et al. (2019) Shailendra Rathore, Byung Wook Kwon, and Jong Hyuk Park. 2019\.  BlockSecIoTNet: Blockchain-based decentralized security architecture for IoT network.  _Journal of Network and Computer Applications_ 143 (2019), 167–177.
  * Rodrigues et al. (2017b) Bruno Rodrigues, Thomas Bocek, Andri Lareida, David Hausheer, Sina Rafati, and Burkhard Stiller. 2017b.  A blockchain-based architecture for collaborative DDoS mitigation with smart contracts. In _Security of Networks and Services in an All-Connected World: 11th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2017, Zurich, Switzerland, July 10-13, 2017, Proceedings 11_. Springer International Publishing, 16–29.
  * Rodrigues et al. (2017a) Bruno Rodrigues, Thomas Bocek, and Burkhard Stiller. 2017a.  Enabling a cooperative, multi-domain DDoS defense by a blockchain signaling system (BloSS).  _Semantic Scholar_ (2017).
  * Rodrigues et al. (2019) Bruno Rodrigues, Lukas Eisenring, Eder Scheid, Thomas Bocek, and Burkhard Stiller. 2019.  Evaluating a blockchain-based cooperative defense. In _2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)_. IEEE, 533–538.
  * Rodrigues and Stiller (2019) Bruno Rodrigues and Burkhard Stiller. 2019.  Cooperative signaling of DDoS attacks in a blockchain-based network. In _Proceedings of the ACM SIGCOMM 2019 Conference Posters and Demos_. 39–41.
  * Rodrigues et al. (2020) Bruno Rodrigues, Spasen Trendafilov, Eder Scheid, and Burkhard Stiller. 2020.  SC-FLARE: Cooperative DDoS signaling based on smart contracts. In _2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)_. IEEE, 1–3.
  * Santin et al. (2022) Gabriele Santin, Inna Skarbovsky, Fabiana Fournier, and Bruno Lepri. 2022.  A Framework for Verifiable and Auditable Collaborative Anomaly Detection.  _IEEE Access_ 10 (2022), 82896–82909.
  * Saveetha and Maragatham (2022) D Saveetha and G Maragatham. 2022.  Design of Blockchain enabled intrusion detection model for detecting security attacks using deep learning.  _Pattern Recognition Letters_ 153 (2022), 24–28.
  * Scimago (2022) Scimago. 2022\.  Scimago Country Rank.  https://www.scimagojr.com/countryrank.php [Online; accessed 22-March-2023].
  * Shi et al. (2019) Leyi Shi, Yang Li, Tianxu Liu, Jia Liu, Baoying Shan, and Honglong Chen. 2019\.  Dynamic distributed honeypot based on blockchain.  _IEEE Access_ 7 (2019), 72234–72246.
  * Singh et al. (2023) Sushil Kumar Singh, Laurence T Yang, and Jong Hyuk Park. 2023\.  FusionFedBlock: Fusion of blockchain and federated learning to preserve privacy in industry 5.0.  _Information Fusion_ 90 (2023), 233–240.
  * Snider et al. (2018) Myles Snider, Kyle Samani, and Tushar Jain. 2018\.  Delegated proof of stake: features & tradeoffs.  _Multicoin Cap_ 19 (2018), 1–19.
  * Tang et al. (2022) Fengxiao Tang, Cong Wen, Linfeng Luo, Ming Zhao, and Nei Kato. 2022.  Blockchain-Based Trusted Traffic Offloading in Space-Air-Ground Integrated Networks (SAGIN): A Federated Reinforcement Learning Approach.  _IEEE Journal on Selected Areas in Communications_ 40, 12 (2022), 3501–3516.
  * Taylor et al. (2020) Paul J Taylor, Tooska Dargahi, Ali Dehghantanha, Reza M Parizi, and Kim-Kwang Raymond Choo. 2020\.  A systematic literature review of blockchain cyber security.  _Digital Communications and Networks_ 6, 2 (2020), 147–156.
  * Tug et al. (2018) Steven Tug, Weizhi Meng, and Yu Wang. 2018.  CBSigIDS: towards collaborative blockchained signature-based intrusion detection. In _2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)_. IEEE, 1228–1235.
  * Ujjan et al. (2019) Raja Majid Ali Ujjan, Zeeshan Pervez, and Keshav Dahal. 2019\.  Snort based collaborative intrusion detection system using blockchain in SDN. In _2019 13th International Conference on Software, Knowledge, Information Management and Applications (SKIMA)_. IEEE, 1–8.
  * Vance and Vance (2019) Taylor Rodriguez Vance and Andrew Vance. 2019.  Cybersecurity in the blockchain era: a survey on examining critical infrastructure protection with blockchain-based technology. In _2019 IEEE International Scientific-Practical Conference Problems of Infocommunications, Science and Technology (PIC S &T)_. IEEE, 107–112.
  * Vasilomanolakis et al. (2015) Emmanouil Vasilomanolakis, Shankar Karuppayah, Max Mühlhäuser, and Mathias Fischer. 2015\.  Taxonomy and survey of collaborative intrusion detection.  _ACM Computing Surveys (CSUR)_ 47, 4 (2015), 1–33.
  * Vasin (2014) Pavel Vasin. 2014\.  Blackcoin’s proof-of-stake protocol v2.  _URL: https://blackcoin. co/blackcoin-pos-protocol-v2-whitepaper. pdf_ 71 (2014).
  * Wang et al. (2023) Qin Wang, Jiangshan Yu, Shiping Chen, and Yang Xiang. 2023\.  Sok: Dag-based blockchain systems.  _Comput. Surveys_ 55, 12 (2023), 1–38.
  * Wang et al. (2020) Xifeng Wang, Changqiao Xu, Zan Zhou, Shujie Yang, and Limin Sun. 2020.  A survey of blockchain-based cybersecurity for vehicular networks.  _2020 International Wireless Communications and Mobile Computing (IWCMC)_ (2020), 740–745.
  * Wang et al. (2022) Xiaofei Wang, Yunfeng Zhao, Chao Qiu, Zhicheng Liu, Jiangtian Nie, and Victor CM Leung. 2022\.  Infedge: A blockchain-based incentive mechanism in hierarchical federated learning for end-edge-cloud communications.  _IEEE Journal on Selected Areas in Communications_ 40, 12 (2022), 3325–3342.
  * Winanto et al. (2021) Eko Arip Winanto, Mohd Yazid Idris, Deris Stiawan, and Mohammad Sulkhan Nurfatih. 2021\.  Designing consensus algorithm for collaborative signature-based intrusion detection system.  _Indones J. Electron. Eng. Comput. Sci._ 22, 1 (2021), 485–496.
  * Wüst and Gervais (2018) Karl Wüst and Arthur Gervais. 2018.  Do you need a blockchain?. In _2018 Crypto Valley Conference on Blockchain Technology (CVCBT)_. IEEE, 45–54.
  * Wylde et al. (2022) Vinden Wylde, Nisha Rawindaran, John Lawrence, Rushil Balasubramanian, Edmond Prakash, Ambikesh Jayal, Imtiaz Khan, Chaminda Hewage, and Jon Platts. 2022.  Cybersecurity, data privacy and blockchain: a review.  _SN Computer Science_ 3, 2 (2022), 1–12.
  * Xu et al. (2023) Jie Xu, Cong Wang, and Xiaohua Jia. 2023.  A survey of blockchain consensus protocols.  _Comput. Surveys_ (2023).
  * Yeh et al. (2019) Lo-Yao Yeh, Jiun-Long Huang, Ting-Yin Yen, and Jen-Wei Hu. 2019\.  A collaborative DDoS defense platform based on blockchain technology. In _2019 Twelfth International Conference on Ubi-Media Computing (Ubi-Media)_. IEEE, 1–6.
  * Yeh et al. (2020) Lo-Yao Yeh, Peggy Joy Lu, Szu-Hao Huang, and Jiun-Long Huang. 2020\.  SOChain: A privacy-preserving DDoS data exchange service over soc consortium blockchain.  _IEEE Transactions on Engineering Management_ 67, 4 (2020), 1487–1500.
  * Yenugunti and Yau (2020) Chandralekha Yenugunti and Stephen S Yau. 2020.  A blockchain approach to identifying compromised nodes in collaborative intrusion detection systems. In _2020 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)_. IEEE, 87–93.
  * Zhang et al. (2020) Weishan Zhang, Qinghua Lu, Qiuyu Yu, Zhaotong Li, Yue Liu, Sin Kit Lo, Shiping Chen, Xiwei Xu, and Liming Zhu. 2020.  Blockchain-based federated learning for device failure detection in industrial IoT.  _IEEE Internet of Things Journal_ 8, 7 (2020), 5926–5937.
  * Zheng et al. (2018) Zibin Zheng, Shaoan Xie, Hong-Ning Dai, Xiangping Chen, and Huaimin Wang. 2018.  Blockchain challenges and opportunities: A survey.  _International journal of web and grid services_ 14, 4 (2018), 352–375.
  * Zhuang et al. (2020) Peng Zhuang, Talha Zamir, and Hao Liang. 2020.  Blockchain for cybersecurity in smart grid: A comprehensive survey.  _IEEE Transactions on Industrial Informatics_ 17, 1 (2020), 3–19.

##  Appendix A Additional Material

###  A.1. Detailed data on the papers of this study

Tables 2 and 3 detail all the papers we treated in this survey. Table 2
contains information on the application, the domain and the number of
citations. Table 3 on the other hand contains information about the nature of
the blockchain, namely technology, consensus, access control and data
validation policy. A reader looking for an collaborative application using a
specific blockchain nature may find great use of those tables, to read the
papers using this nature in particular.

Table 2. Papers on blockchain and collaborative cybersecurity — Application,
domain and citations.

Year Name Application Domain Cited 2016 MedRec: Using Blockchain for Medical
Data Acce… (Azaria et al., 2016) Health Health 2100 2016 Blockchains and Smart
Contracts for the Intern… (Christidis and Devetsikiotis, 2016) Internet of
Things Internet of Things 4334 2017 A Blockchain-Based Architecture for
Collaborat… (Rodrigues et al., 2017b) DDoS Defense Networks 167 2017 Enabling
a Cooperative Multi-domain DDoS Defen… (Rodrigues et al., 2017a) DDoS Defense
Networks 49 2018 ChainSecure - A Scalable and Proactive Solutio… (Abou El
Houda et al., 2018) DDoS Defense Software-defined Networking 32 2018 CBSigIDS:
Towards Collaborative Blockchained S… (Tug et al., 2018) Intrusion Detection
Independent 35 2018 Chained Anomaly Detection Models for Federated…
(Preuveneers et al., 2018) Intrusion Detection Independent 173 2018 CIoTA:
Collaborative Anomaly Detection via Blo… (Golomb et al., 2018) Intrusion
Detection Internet of Things 3 2018 Blockchain for Supply Chain Cybersecurity
Opti… (Mylrea and Gourisetti, 2018) Supply Chain Internet of Things;Energy 56
2018 Towards Blockchain-Based Collaborative Intrusi… (Alexopoulos et al.,
2018) Intrusion Detection Independent 103 2019 A Collaborative DDoS Defense
Platform Based on… (Yeh et al., 2019) DDoS Defense Networks 10 2019 Blockchain
Solutions for Forensic Evidence Pre… (Brotsis et al., 2019) Forensics Internet
of Things 62 2019 On Blockchain Architectures for Trust-based Co…
(Kolokotronis et al., 2019) Intrusion Detection Independent 35 2019 Snort
Based Collaborative Intrusion Detection … (Ujjan et al., 2019) Intrusion
Detection Software-defined Networking 19 2019 Towards Blockchained Challenge-
based Collabora… (Li et al., 2019b) Intrusion Detection Independent 20 2019
Evaluating a Blockchain-based Cooperative Defense (Rodrigues et al., 2019)
DDoS Defense Networks 12 2019 Co-IoT: A Collaborative DDoS mitigation scheme…
(Abou El Houda et al., 2019a) DDoS Defense Internet of Things;Software-defined
Networking 56 2019 Cooperative Signaling of DDoS Attacks in a Blo… (Rodrigues
and Stiller, 2019) DDoS Defense Networks 12 2019 Cochain-SC: An Intra-and
Inter-Domain Ddos Mit… (Abou El Houda et al., 2019b) DDoS Defense Internet of
Things;Software-defined Networking 102 2019 TRIDEnT: Building Decentralized
Incentives for… (Alexopoulos et al., 2019) Intrusion Detection Independent 4
2019 Dynamic Distributed Honeypot Based on Blockchain (Shi et al., 2019)
Honeypot Independent 30 2019 Enhancing challenge-based collaborative intrus…
(Meng et al., 2020) Intrusion Detection Independent 36 2019 BlockSecIoTNet:
Blockchain-based decentralized… (Rathore et al., 2019) Intrusion Detection
Internet of Things 192 2019 Designing collaborative blockchained signature…
(Li et al., 2019a) Intrusion Detection Internet of Things 132 2019 An
Industrial Prototype of Trusted Energy Perf… (Gürcan et al., 2018) Energy
Energy 23 2019 Blockchain Secured Electronic Health Records: … (Akarca et al.,
2019) Health Health 14 2019 A Lightweight Blockchain Based Cybersecurity f…
(Abdulkader et al., 2019) Internet of Things Internet of Things 16 2020 SC-
FLARE: Cooperative DDoS Signaling based on … (Rodrigues et al., 2020) DDoS
Defense Networks 9 2020 BrainChain - A Machine learning Approach for p… (Abou
El Houda et al., 2020a) DDoS Defense Software-defined Networking 25 2020
Bringing Intelligence to Software Defined Netw… (Abou El Houda et al., 2020b)
DDoS Defense Software-defined Networking 36 2020 A Blockchain Approach to
Identifying Compromis… (Yenugunti and Yau, 2020) Intrusion Detection
Independent 5 2020 A Contract Based User-Centric Computational Tr… (Hu et al.,
2020) Governance Governance 1 2020 A Framework of Blockchain-Based
Collaborative … (Li et al., 2020b) Intrusion Detection Software-defined
Networking 10 2020 Blockchain-enabled Collaborative Intrusion Det… (Fan et
al., 2020) Intrusion Detection Software-defined Networking 8 2020 Distributed
Intrusion Detection System using B… (Kumar and Singh, 2020) Intrusion
Detection Independent 31 2020 LegIoT: Ledgered Trust Management Platform for…
(Neureither et al., 2020) Trust Management Internet of Things 4 2020 SOChain:
A Privacy-Preserving DDoS Data Exchan… (Yeh et al., 2020) DDoS Defense
Networks 32 2020 TRIDEnT: Towards a Decentralized Threat Indica… (Alexopoulos
et al., 2020) Intrusion Detection Independent 3 2020 Blockchain-based
Federated Learning for Device… (Zhang et al., 2020) Intrusion Detection
Internet of Things 116 2020 Application of Blockchain within Aviation Cybe…
(Adhikari and Davis, 2020) Intrusion Mitigation Vehicles;Aviation 5 2020
Blockchain as a solution to Drone Cybersecurity (Ossamah, 2020) Drones
Internet of Things;Vehicles;Drones 16 2020 Blockchain technology in the future
of busines… (Demirkan et al., 2020) Accounting Business 130 2020 Suitability
of Blockchain for Collaborative In… (Dawit et al., 2020) Intrusion Detection
Independent 12 2021 A Distributed Collaborative Entrance Defense F… (Guo et
al., 2022) DDoS Defense Networks 3 2021 A Deep Blockchain Framework-Enabled
Collaborat… (Alkadi et al., 2020) Intrusion Detection Internet of Things;Cloud
165 2021 A Comprehensive Study of Anomaly Detection Sch… (Diro et al., 2021)
Intrusion Detection Internet of Things 16 2021 Distributed Watchdogs Based on
Blockchain for … (Lee and Kwon, 2021) Supply Chain Internet of Things;Supply
Chain 6 2021 Toward a blockchain-based framework for challe… (Li et al., 2021)
Intrusion Detection Networks 41 2021 SeDID: An SGX-enabled decentralized
intrusion … (Liu et al., 2021a) Intrusion Detection Networks 16 2021 Designing
consensus algorithm for collaborativ… (Winanto et al., 2021) Intrusion
Detection Independent 4 2021 LDBT: A Lightweight DDoS Attack Tracing Scheme…
(Guo et al., 2021) DDoS Defense Networks 5 2021 Blockchain and Federated
Learning for Collabor… (Liu et al., 2021b) Intrusion Detection Vehicles 60
2021 Blockchained Federated Learning for Threat Def… (Demertzis, 2021)
Intrusion Detection Internet of Things 7 2021 Cybersecurity of Renewable
Energy Data and App… (Cali et al., 2021) Energy Energy 1 2021 Secure exchange
of cyber threat intelligence u… (Pahlevan et al., 2021) Intrusion Detection
Energy 2 2022 FolketID: A Decentralized Blockchain-Based Nem… (Chiu et al.,
2022) DDoS Defense Governance 0 2022 Blockchain-Based Decentralized Replay
Attack D… (Ramanan et al., 2021) Intrusion Detection Energy 14 2022 BlockCSDN:
Towards Blockchain-Based Collaborat… (Li et al., 2022) Intrusion Detection
Software-defined Networking 8 2022 CIDS: Collaborative Intrusion Detection
System… (Gurung et al., 2022) Intrusion Detection Independent 2 2022 IDS-
Chain: A Collaborative Intrusion Detection… (Aljuhani, 2022) Intrusion
Detection Health;Internet of Things 0 2022 Design of Blockchain enabled
intrusion detecti… (Saveetha and Maragatham, 2022) Intrusion Detection
Independent 4 2022 Blockchain-Enabled Intrusion Detection and Pre… (Alevizos
et al., 2022) Intrusion Detection;Intrusion Prevention Independent 2 2022
FIDChain: Federated Intrusion Detection System… (Ashraf et al., 2022)
Intrusion Detection Health 5 2022 Privacy-preserved Cyberattack Detection in
Ind… (Abdel-Basset et al., 2022) Intrusion Detection Internet of Things 1 2022
CGAN-Based Collaborative Intrusion Detection f… (He et al., 2022) Intrusion
Detection Internet of Things;Vehicles;Drones 0 2022 A Framework for Verifiable
and Auditable Feder… (Santin et al., 2022) Intrusion Detection Independent 0
2022 InFEDge: A Blockchain-based Incentive Mechanis… (Wang et al., 2022)
Federated Learning Cloud 3 2022 An Intelligent Platform for Threat Assessment
… (Kolokotronis et al., 2022) Intrusion Detection;Intrusion Response
Health;Internet of Things 0 2022 Blockchain-based Trusted Traffic Offloading
in… (Tang et al., 2022) Networks Networks 19 2022 A Distributed Intrusion
Detection System to De… (Kumar et al., 2022) Intrusion Detection Internet of
Things 0 2023 FusionFedBlock: Fusion of Blockchain and Feder… (Singh et al.,
2023) Federated Learning Internet of Things 2

Table 3. Papers on blockchain and collaborative cybersecurity — Technology,
consensus, access control and permission.

Year Name Technology Consensus Access control Permission 2016 MedRec: Using
Blockchain for Medical Data Acce… (Azaria et al., 2016) Ethereum Proof of Work
Private Permissioned 2016 Blockchains and Smart Contracts for the Intern…
(Christidis and Devetsikiotis, 2016) Independent Independent Independent
Independent 2017 A Blockchain-Based Architecture for Collaborat… (Rodrigues et
al., 2017b) Ethereum Proof of Ownership Private Permissioned 2017 Enabling a
Cooperative Multi-domain DDoS Defen… (Rodrigues et al., 2017a) Ethereum Not
specified Private Permissioned 2018 ChainSecure - A Scalable and Proactive
Solutio… (Abou El Houda et al., 2018) Not specified Not specified Private
Permissioned 2018 CBSigIDS: Towards Collaborative Blockchained S… (Tug et al.,
2018) Not specified Not specified Private Permissioned 2018 Chained Anomaly
Detection Models for Federated… (Preuveneers et al., 2018) Multichain Round-
robin Private Permissioned 2018 CIoTA: Collaborative Anomaly Detection via
Blo… (Golomb et al., 2018) Custom Not specified Private Permissionless 2018
Blockchain for Supply Chain Cybersecurity Opti… (Mylrea and Gourisetti, 2018)
Not specified Proof of Authority Private Permissioned 2018 Towards Blockchain-
Based Collaborative Intrusi… (Alexopoulos et al., 2018) Independent
Independent Independent Independent 2019 A Collaborative DDoS Defense Platform
Based on… (Yeh et al., 2019) Ethereum Proof of Work Private Permissioned 2019
Blockchain Solutions for Forensic Evidence Pre… (Brotsis et al., 2019)
Hyperledger Fabric Not specified Private Permissioned 2019 On Blockchain
Architectures for Trust-based Co… (Kolokotronis et al., 2019) Custom Proof of
Work;Proof of Stake Private Permissioned 2019 Snort Based Collaborative
Intrusion Detection … (Ujjan et al., 2019) Ethereum Proof of Work Private
Permissioned 2019 Towards Blockchained Challenge-based Collabora… (Li et al.,
2019b) Custom Proof of Identity Private Permissioned 2019 Evaluating a
Blockchain-based Cooperative Defense (Rodrigues et al., 2019) Ethereum Not
specified Private Permissioned 2019 Co-IoT: A Collaborative DDoS mitigation
scheme… (Abou El Houda et al., 2019a) Ethereum Not specified Private
Permissioned 2019 Cooperative Signaling of DDoS Attacks in a Blo… (Rodrigues
and Stiller, 2019) Ethereum Not specified Private Permissioned 2019 Cochain-
SC: An Intra-and Inter-Domain Ddos Mit… (Abou El Houda et al., 2019b) Ethereum
Not specified Private Permissioned 2019 TRIDEnT: Building Decentralized
Incentives for… (Alexopoulos et al., 2019) Ethereum Proof of Burn;Proof of
Work Public Permissionless 2019 Dynamic Distributed Honeypot Based on
Blockchain (Shi et al., 2019) Ethereum Proof of Work Private Permissioned 2019
Enhancing challenge-based collaborative intrus… (Meng et al., 2020) Custom Not
specified Private Permissioned 2019 BlockSecIoTNet: Blockchain-based
decentralized… (Rathore et al., 2019) Ethereum Proof of Work Private
Permissioned 2019 Designing collaborative blockchained signature… (Li et al.,
2019a) Custom Custom Private Permissionless 2019 An Industrial Prototype of
Trusted Energy Perf… (Gürcan et al., 2018) Ethereum Proof of Work Private
Permissioned 2019 Blockchain Secured Electronic Health Records: … (Akarca et
al., 2019) Not specified Not specified Private Permissioned 2019 A Lightweight
Blockchain Based Cybersecurity f… (Abdulkader et al., 2019) Custom Proof of
Authority Private Permissioned 2020 SC-FLARE: Cooperative DDoS Signaling based
on … (Rodrigues et al., 2020) Ethereum Proof of Authority Private Permissioned
2020 BrainChain - A Machine learning Approach for p… (Abou El Houda et al.,
2020a) Ethereum Not specified Private Permissioned 2020 Bringing Intelligence
to Software Defined Netw… (Abou El Houda et al., 2020b) Ethereum Not specified
Private Permissioned 2020 A Blockchain Approach to Identifying Compromis…