HoloCyberChain: A distributed entropy-fingerprint blockchain for global cyber threat intelligence

This study presents HoloCyberChain, an entropy-driven blockchain framework for decentralized cyber-threat intelligence with formal verification and privacy preservation. Each cyber event is encoded as a four-dimensional entropy fingerprint capturing structural, temporal, behavioral, and propagation uncertainty. A novel Shannon–β hybrid distance integrates residual-entropy geometry with β-divergence-based distributional separation, yielding a unified statistical–topological measure of threat dissimilarity. Residuals are transformed into calibrated novelty probabilities through a logistic uniqueness gate, while a proof-of-detection consensus protocol enables publicly verifiable and Byzantine-resilient acceptance of novel intelligence. Privacy is maintained using zero-knowledge entropy proofs, and accepted threats are organized into a spectral threat-intelligence graph that preserves family-level separability. Simulation experiments demonstrate reliable discrimination (ROC-AUC ≈0.81, PR-AUC ≈0.77) and stable calibration under noise and concept drift. Real-world validation using the CICIDS-2017 dataset (225 745 flows, 79 features; 97 718 benign and 128 027 DDoS flows) confirms that DDoS traffic exhibits higher Shannon–β entropy, with right-shifted density profiles, higher medians, and tighter interquartile ranges relative to benign traffic, indicating that the proposed entropy formulation preserves separability under realistic traffic imbalance. These empirical results align with theoretical guarantees and simulation findings, establishing HoloCyberChain as a reproducible, entropy-verified foundation for scalable and privacy-preserving cyber-threat intelligence sharing.