How We Build A Collaborative, Trustable, And Crowdsourced CTI

The talk starts by asking what makes a threat intelligence feed useful, and proposes four traits: reliable, up to date, comprehensive and automated. It then introduces an open-source agent written in Go that reads logs, detects abusive behaviour using scenario files, takes a local response such as a notification or firewall rule, and shares offending addresses with a shared network.

The shared blocklist refreshes every two hours and holds roughly 60,000 addresses, limited to sources reported by many engines across the internet to keep false positives low. Entries expire after seven days without fresh reports. A test with a deliberately weak exposed machine showed it reaching the list within a few days. Scale is presented as the answer to comprehensiveness: tens of thousands of installations, millions of daily signals, thousands of autonomous systems and many operating systems, plus a large library of scenarios.

On the analysis side, the speaker shows an enriched view of each indicator, with third-party lookups and activity timelines, and two derived scores. A background-noise score from 0 to 10 flags automated, untargeted scanning so teams can cut alert volume. A malicious-duration metric, aggregated per autonomous system, suggests that hosting providers with fast abuse remediation are less attractive to attackers. The talk closes by modelling IP data as a bipartite graph of attackers and attack types, using community detection and GraphSAGE node classification, which can score previously unseen nodes.