01867nas a2200205   4500000000100000000000100001008004100002260002800043100001900071700002100090700001900111700002000130700002700150700001800177700002900195700001800224700002100242245008900263520130900352       2022                            d  c08/2022bUSENIXaBoston1 aXander Bouwman1 aVictor Le Pochat1 aPawel Foremski1 aTom Van Goethem1 aCarlos Hernandez-Ganan1 aGiovane Moura1 aSamaneh Tajalizadehkhoob1 aWouter Joosen1 aMichel van Eeten00aHelping hands: Measuring the impact of a large threat intelligence sharing community3 aWe tracked the largest volunteer security information sharing community known to date: the COVID-19 Cyber Threat Coalition, with over 4,000 members. This enabled us to address long-standing questions on threat information sharing. First, does collaboration at scale lead to better coverage? And second, does making threat data freely available improve the ability of defenders to act? We found that the CTC mostly aggregated existing industry sources of threat information. User-submitted domains often did not make it to the CTC’s blocklist as a result of the high threshold posed by its automated quality assurance using VirusTotal. Although this ensured a low false positive rate, it also caused the focus of the blocklist to drift away from domains related to COVID-19 (1.4%-3.6%) to more generic abuse, such as phishing, for which established mitigation mechanisms already exist. However, in the slice of data that was related to COVID-19, we found promising evidence of the added value of a community like the CTC: just 25.1% of these domains were known to existing abuse detection infrastructures at time of listing, as compared to 58.4% of domains on the overall blocklist. From the unique experiment that the CTC represented, we draw three lessons for future threat data sharing initiatives.