With the development of the Internet, cyberattacks are becoming increasingly complex, sustained, and organized. Cyber threat intelligence sharing is one of the effective ways to alleviate the pressure on organizational or individual cyber security defense. However, the current cyber threat intelligence sharing lacks effective incentive mechanisms, resulting in mutual distrust and a lack of motivation to share among sharing members, making the security of sharing questionable. In this paper, we propose a blockchain-based cyber threat intelligence sharing mechanism (B-CTISM) to address the problems of free riding and lack of trust among sharing members faced in cyber threat intelligence sharing. We use evolutionary game theory to analyze the incentive strategy; the resulting evolutionarily stable strategy achieves the effect of promoting sharing and effectively curbing free-riding behavior. Then, the incentive strategy is deployed to smart contracts running in the trusted environment of blockchain, whose decentralization and tamper-evident properties can provide a trusted environment for participating members and establish trust without a third-party central institution to achieve secure and efficient cyber threat intelligence sharing. Finally, the effectiveness of the B-CTISM in facilitating and regulating threat intelligence sharing is verified through experimental simulation and comparative analysis.

With the rapid development of the Internet of Things (IoT), the frequency of attackers using botnets to control IoT devices in order to perform distributed denial-of-service attacks (DDoS) and other cyber attacks on the internet has significantly increased. In the actual attack process, the small percentage of attack packets in IoT leads to low accuracy of intrusion detection. Based on this problem, the paper proposes an oversampling algorithm, KG-SMOTE, based on Gaussian distribution and K-means clustering, which inserts synthetic samples through Gaussian probability distribution, extends the clustering nodes in minority class samples in the same proportion, increases the density of minority class samples, and improves the amount of minority class sample data in order to provide data support for IoT-based DDoS attack detection. Experiments show that the balanced dataset generated by this method effectively improves the intrusion detection accuracy in each category and effectively solves the data imbalance problem.

One of the five types of Internet information service recommendation technologies is the personalized recommendation algorithm, and knowledge graphs are frequently used in these algorithms. RippleNet is a personalized recommendation model based on knowledge graphs, but it is susceptible to localization issues in user portrait updating. In this study, we propose NRH (Node2vec-side and RippleNet Hybrid Model), a hybrid recommendation model based on RippleNet that uses Node2vec-side for item portrait modeling and explores potential association relationships of items; the user portrait is split into two parts, namely, a static history portrait and a dynamic preference portrait; the NRH model adopts a hybrid recommendation approach based on collaborative filtering and a knowledge graph to obtain the user’s preferences on three publicly accessible datasets; and comparison experiments with the mainstream model are lastly carried out. The AUC and ACC increased, respectively, by 0.9% to 29.5% and 1.6% to 31.4% in the MovieLens-1M dataset, by 1.5% to 17.1% and 4.4% to 18.7% in the Book-Crossing dataset, and by 0.8% to 27.9% and 2.9% to 24.1% in the Last.FM dataset. The RippleNet model was used for comparison experiments comparing suggestion diversity. According to the experimental findings, the NRH model performs better in accuracy and variety than the popular customized knowledge graph recommendation algorithms now in use.