Privacy-Preserving Polyglot Sharing and Analysis of Confidential Cyber Threat Intelligence

Davy Preuveneers, Wouter Joosen

Abstract: Sharing cyber threat intelligence helps organizations analyze and protect against a growing number and sophistication of security threats. However, organizations are reluctant to share their locally collected cyber threat intelligence with third parties because of the the risk of incidentally disclosing sensitive business data or personally identifiable information, and the subsequent reputational harm or even financial repercussions imposed by the GDPR. To address the different confidentiality needs of threat intelligence producers and consumers, we present and evaluate a practical polyglot solution for privacy-preserving sharing and analysis of confidential or private information, and this on top of a contemporary cyber threat intelligence platform. Additionally, we investigate the security impact and computational overhead of these techniques to analyze correlations between threat events in a privacy-preserving manner and across sharing organizations.