Using BlockChains to Generate and Distribute Deny Lists

Kex-Filtering proactively detects SSH botnets by fingerprinting client configurations via KEX hashes, overcoming IP blacklist limits. Tested on Azure/AWS honeypots, it blocked 98.5% of attacks using tens of hashes (<2% false positives). Blacklists are dynamically updated via distributed C2 servers using trust, expiration, and thresholds. Multiple blockchain-based architectures are proposed to ensure secure, tamper-proof, and decentralized blacklist distribution. Analyses are conducted on the implementation feasibility of the method, and performance metrics are explored.