Abstract
Cyber Threat Intelligence (CTI) sharing is critical for collaborative defense, yet organizations struggle to assess the reliability and quality of shared information in standardized formats like STIX 2.1. This trust deficit stems from difficulties with traceability, data integrity verification, and distinguishing high-fidelity threats from low-quality alerts, undermining the effectiveness of collective security efforts. Prior work introduced BlockCTI, an architectural solution that combines a permissioned blockchain with a Proof of Quality (PoQ) consensus mechanism grounded in NATO Admiralty Scale criteria to address these challenges. While theoretically sound, the practical viability of this design remained unvalidated. This paper presents the implementation and empirical validation of BlockCTI, demonstrating that the proposed model translates effectively into a working system. We developed a functional prototype integrating blockchain-based incident logging with automated quality assessment and TAXII/MISP compatibility. Comprehensive experimental evaluation across five dimensions: scalability, validator sensitivity, resilient coordination, load variation, and quality robustness, validates the core theoretical predictions: the system exhibits predictable latency and throughput characteristics as demand increases, and the PoQ mechanism successfully differentiates among high, medium, and low-reliability incidents. These findings confirm that BlockCTI’s theoretical model is practical and deployable, offering a viable solution for trustworthy, auditable CTI sharing in collaborative government environments.