Jun 2026· PeerJ Computer Science· 0 citations· 51 references
TL;DR
This work presents a lightweight, blockchain-secured distributed IDS for IoT networks that combines anomaly-based detection using federated learning, Snort-based signature detection, and host-based log analysis with transformer models and mitigates the impact of malicious updates.
Abstract
Threats to Internet of Things (IoT) networks are becoming increasingly complex and distributed, challenging the effectiveness of traditional Intrusion Detection Systems (IDS). IDS based on federated learning (FL) offer the ability to train machine learning models among distributed nodes without sharing data, but they are vulnerable to adversarial attacks such as model poisoning. Trust among distributed nodes is also a major challenge. To address these issues, this work presents a lightweight, blockchain-secured distributed IDS for IoT networks. The proposed system combines anomaly-based detection using federated learning, Snort-based signature detection, and host-based log analysis with transformer models. The blockchain is used for immutable logging of model updates and reputation-based trust scores. These updates are linked to unique blockchain identities, and the ledger enforces Sybil-resistant enrollment, allowing only authenticated nodes to contribute valid updates. Evaluation on the CICIDS2017 and HDFS datasets shows that the proposed approach achieves detection accuracy near 98.8% for federated network traffic analysis and an F1-score of 99.6% for host-based log anomaly detection with BERT-mini-class models. In poisoning experiments using random-weight injection, reputation scoring with L2-norm update filtering mitigates the impact of malicious updates. Experiments are conducted on a hardware testbed using Raspberry Pi and ESP32 devices. Blockchain logging achieved 21.47 TPS with 736 ms average latency on a Raspberry Pi 4. BERT-mini inference achieved ~59 ms average latency (real-time).
The rapid growth of Internet of Things (IoT) environments has brought forth a wealth of security challenges in detecting network intrusions in diverse and resource-restricted systems. Privacy, scalability, and single point of failure issues plague traditional centralized intrusion detection solutions. To address these challenges, the study proposes a secure and adaptive intrusion detection model using Federated Learning (FL) and Blockchain, augmented with autoencoder-based feature reduction. The ToN-IoT dataset is pre-processed, and then an unsupervised autoencoder is used to build informative low-dimensional feature representations. The processed data is deployed to various clients to mimic a real federated situation. Every client will train a local Long Short-Term Memory (LSTM) model on its own private data to preserve data privacy.Then a blockchain-based mechanism is utilized to enhance the security and integrity of model aggregation. SHA-256 hashed local model weights are recorded on the blockchain to avoid tampering and provide traceability. Federated averaging is then implemented to refresh the global model along with blockchain-based verification of the aggregation process. Our findings show the performance of the proposed framework, leading to an accuracy of 99.96%, precision of 99.99%, recall of 99.95%, and F1-score of 99.97%. These findings show that combining FL, blockchain, and deep feature extraction offers a viable and secure solution for intrusion detection systems in IoT.
Tahseen A. Wotaifi· Journal of Intelligent Infor...· 0 citations
The integration of Internet of Things (IoT) systems with blockchain-based security mechanisms offers improved trust, auditability, and decentralization, but introduces significant challenges related to interoperability, transaction latency, and energy consumption at the network edge. Most existing blockchain-assisted intrusion detection systems (IDS) are limited to single-ledger deployments and rely on computationally intensive machine-learning inference, which restricts their applicability in resource-constrained IoT environments. Presented in the work is a cross-chain and energy-efficient intrusion detection framework that combines lightweight machine-learning–based anomaly detection with smart-contract–driven verification and interoperable blockchain communication. Intrusion detection models are optimized using pruning and INT8 quantization to reduce inference overhead on IoT gateways, while verified intrusion alerts are securely propagated across heterogeneous blockchain platforms through cross-chain messaging protocols. Smart contracts automate alert validation and response actions, enabling coordinated defense across multiple ledgers. Experimental evaluation using CICIDS2017 and BoT-IoT datasets, physical IoT gateway hardware, and a multi-chain blockchain testbed demonstrates that the proposed framework achieves a detection accuracy of 97.4%, reduces inference energy consumption by up to 56%, and improves alert propagation latency by 42% compared to single-chain baselines. These results indicate that decentralized, interoperable, and energy-aware intrusion detection is feasible for large-scale IoT deployments.
S. Bassey, Emmanuel Udoh, B. Stephen et al.· E3S Web of Conferences· 0 citations
Cloud-integrated sensor and Internet of Things (IoT) systems enable scalable data storage, processing, and intelligent monitoring, but their distributed nature exposes network-flow and host-level data to unauthorized access, tampering, and cyberattacks. This study proposes a Weighted Symmetric Hashed Blockchain (WSHB) framework that integrates mutual-information-based feature weighting, deep-learning-based attack classification, AES-256-GCM authenticated encryption, cryptographic hashing, and permissioned-ledger logging. The framework was evaluated independently using HIKARI-2021 for network-based intrusion detection and ADFA-LD for host-based intrusion detection. A transparent comparative evaluation was conducted against LSTM and CNN–RNN baselines using identical data splits, preprocessing settings, input representations, hyperparameter-search budget, and repeated initialization seeds. The proposed WSHB-DNN classifier achieved macro-F1 scores of 0.6837 on HIKARI-2021 and 0.7914 on ADFA-LD, showing the strongest overall classification performance among the evaluated models. The cryptographic and permissioned-ledger components provide confidentiality protection, record-level authentication, integrity verification, and tamper-evident logging for confirmed attack-event records. These results demonstrate the potential of WSHB as a reproducible framework for attack classification and secure event logging in cloud-integrated sensor environments.
Naveed Ahmad, Yue Cao, William Liu· Italian National Conference...· 0 citations