The introduction of Vehicle-to-Everything (V2X) communications is a fundamental requirement for the evolution of today’s Autonomous Driving, but it leads to a new set of vulnerabilities in network infrastructure. It is important to note that cyber-attacks, including the availability ones, such as DoS, represent a significant threat to the safety of Intelligent Transport Systems (ITS). Traditional signature-based Intrusion Detection Systems (IDS) have a disadvantage in security due to their inability to adapt and manage these new and evolving attacks: they can be blind to new or “zero-day” kinds of attacks. This project is to solve this problem by proposing and validating an unsupervised Intrusion Detection System using a Deep Autoencoder architecture. Unlike typical supervised models, where labelled attack data is needed, this system is trained on normal network traffic patterns only. It tracks anomalies by learning to compress and reconstruct legitimate traffic features, marking large reconstruction errors as malicious intrusions. The model was developed in TensorFlow and tested against the KDD Cup 99 benchmark dataset. Experimental results show the high performance of the system with a total Accuracy of 99.49% and a critical Recall of 99.86%, effectively suppressing almost all availability attacks. In addition, the model is consistent with a Matthews Correlation Coefficient (MCC) of 0.9530, confirming its robustness and reliability even for very asymmetric network traffic. This research establishes solid proof-of-concept for the concept that unsupervised deep learning can work as a powerful new mechanism of security architecture for V2X infrastructure without relying on prior knowledge about specific attack signatures.
Machine learning-based intrusion detection systems can identify malicious network activity, but their predictions and explanations are typically accepted without verifying that they were derived from the same input. This thesis develops a public-model/private-input zero-knowledge framework for certifying a prediction and its semantic explanation while keeping the processed network-flow features private. The framework is instantiated through a TON_IoT intrusion detection case study in which 104 processed features are mapped into five semantic groups. Logistic Regression is used as the proof-compatible public model, while XGBoost provides a stronger plaintext performance baseline. The main technical contribution is an implementation-backed proof relation that jointly verifies Logistic Regression inference and an ordered top-3 semantic explanation from the same private input. Under a fixed training-mean reference, semantic-group Exact SHAP for the linear score reduces to a direct group-wise weighted sum, enabling its implementation in a Circom circuit and verification using Groth16. The quantized relation achieves more than 99.99% prediction agreement with the floating-point model, while ordered top-3 explanation agreement is approximately 93.8%. Valid proofs are accepted, whereas incorrect predictions, malformed rankings, and out-of-range inputs are rejected. The results demonstrate the feasibility of cryptographically binding a prediction and a semantic explanation under private tabular inputs. The implemented relation remains limited to a public linear model, fixed semantic groups, and an approved reference vector, and does not provide arbitrary-model explanation verification, model confidentiality, or production-ready provenance.
Non-Fungible Tokens (NFTs) have completely changed digital ownership and the decentralized economy. However, their anonymity and encrypted communication, conducted over encrypted tunnels, pose a significant obstacle to regulating illegal activities. Despite advances in encrypted traffic analysis, fine-grained identification of NFT behaviors over encrypted tunnels faces two critical challenges: 1) inexact segmentation of continuous behavioral traffic, and 2) feature homogeneity due to encryption-induced pattern obfuscation. In this paper, we propose NFTracker, a novel framework to identify fine-grained NFT behavioral traffic over encrypted tunnels. We design a traffic segmentation method to isolate behavioral units by leveraging traffic bursts and distribution discrepancies. To combat feature homogeneity, we introduce a sliding-window-based spatio-temporal feature extraction mechanism that captures localized action fingerprints. Furthermore, we utilize a hybrid CNN-Transformer model to integrate spatial patterns and temporal dependencies for robust behavior identification. We evaluate NFTracker on real-world datasets covering five NFT behaviors (browsing, wallet login, purchasing, selling, and minting). Experimental results demonstrate that NFTracker achieves an average F1-score of 0.9212 on identifying NFT behavioral traffic, outperforming state-of-the-art methods in encrypted tunnel scenarios.
Aditya Pathak, Alark Kansara, Irfan Al-anbagi, M. Shamim Hossain
In emergency response vehicular networks (ERVNs), where each second might dictate a life-or-death outcome, the performance of underlying communication systems is critical. Blockchain technology is a promising backbone for authenticating emergency response vehicles (ERVs) at smart traffic signal intersections. However, the decentralized nature of blockchain networks makes them vulnerable to distributed denial of service (DDoS) attacks. A DDoS attack can compromise safetycritical functions by overwhelming the network with fake authentication requests. Therefore, this article presents a comparative performance analysis of two well-known blockchain technologies, namely Ethereum (permissionless) and Hyperledger Fabric (HLF, permissioned), under DDoS-based network congestion. We clarify that this article does not propose any DDoS detection or mitigation mechanisms; rather, we evaluate the ability of the abovedescribed blockchains to maintain service for legitimate transactions under DDoS attacks. We design three DDoS attack scenarios that simulate realistic threats to ERVNs and benchmark throughput and latency using Hyperledger Caliper. Our results show that HLF, because of its architecture, achieves up to 2.7 times higher throughput and lower latency compared to Ethereum. This finding provides an important insight: A permissioned blockchain offers better performance under DDoS attacks, making it a more reliable communication system for safety-critical transportation systems.
The increasing complexity of cyber threats across IoT-cloud infrastructures necessitates the use of innovative, flexible, and confidentiality-preserving prevention techniques. The Blockchain-Assisted Hybrid Attention-Based Intrusion Detection and Access Control System (BHA-IDACS) is presented in this paper. The primary detection module employs an Adaptive Spatio-Temporal Representation Architecture-Self-Attention and Intersample Attention Transformer (Astra-SAINT) to precisely detect evolving intrusion tendencies. A heron optimization algorithm (HOA) is utilized for tuning the model thereby improving accuracy of detection and convergence. Fully Homomorphic Encryption (FHE) maintains the security of data and storage of encrypted data in unsecured cloud and blockchain circumstances. On a Consortium Blockchain, all encrypted transactions and audit trails are maintained by a Proof-of-Stake Authority (PoSA) consensus method. Additionally, based on user behavior and trust level, Smart Contract-Based Dynamic Access Control independently enforces permission and authentication regulations. The suggested model provides better precision, recall, F1-score, F2-score, specificity, and Cohen's Kappa values in addition to a mean accuracy of 99.16%. Furthermore, statistical analysis using confidence intervals and low standard deviation values demonstrates that Astra-SAINT is reliable and consistent across all validation folds. These results demonstrate the efficacy of the suggested Astra-SAINT framework as a scalable and dependable intrusion detection method for protecting IoT environments of the next decade.
This paper presents Zero-Knowledge Federated Learning Guard (ZK-FLGuard), a privacy-preserving and verifiable federated learning framework for real-time anomaly detection in Fifth-Generation Mobile Network (5G)-enabled Internet of Things (IoT) environments. Building on the integration of zero-knowledge proofs (zk-SNARK—Zero-Knowledge Succinct Non-interactive Argument of Knowledge) and blockchain-based access control, ZK-FLGuard ensures the integrity of model updates without exposing private data. Using real-world intrusion detection datasets (CICIDS2017—Canadian Institute for Cybersecurity Intrusion Detection System 2017, TON_IoT—Telecommunications Organisation of the National Security—IoT) and a synthetic adversarial dataset, our evaluation shows that ZK-FLGuard achieves up to 0.96 F1-score (harmonic mean of precision and recall), improves recall in low-frequency attack detection, and introduces less than 10% additional latency overhead compared to standard Federated Learning (FL). Compared with centralized Long Short-Term Memory (LSTM) and FL without Zero-Knowledge Proof (ZKP), ZK-FLGuard provides competitive accuracy while ensuring verifiable computation and strong privacy guarantees. We address the critical challenge of securing federated anomaly detection in 5G-enabled IoT systems against data leakage, model poisoning, and unauthorized access. While FL preserves privacy by keeping raw data local, it remains vulnerable to gradient leakage and adversarial manipulation. Our hypothesis is that combining zero-knowledge proofs and blockchain with FL can deliver a scalable, tamper-resistant, and privacy-preserving detection pipeline suitable for resource-constrained edge environments.
The growing frequency of malicious attacks on Internet of Things (IoT) devices has rendered conventional approaches with static label-dependent risk assessment models obsolete, especially when coping with unknown and continuo... | Find, read and cite all the research you need on Tech Science Press
The emergence of coordinated, multi-agent offensive systems in cyberspace—variously manifesting as distributed reconnaissance campaigns, AI-assisted vulnerability discovery pipelines, adaptive lateral movement swarms, and cross-domain settlement attacks—has outpaced the formal theoretical treatment necessary for principled defence. This monograph addresses that gap with five primary contributions. First, we model swarm versus counter- swarm interaction as a two-player partially observable stochastic game (POSG) and derive equilibrium conditions under asymmetric information. A sufficient condition is established, via Fano’s inequality, under which an ambiguity-preserving offensive policy becomes dominant on the induced information set; the general exact-solution problem is shown to be intractable unless P = NEXP, because the POSG family strictly contains finite-horizon decentralised partially observable Markov decision processes as a special case. Second, we introduce a formal taxonomy of five autonomous cyber swarm attack classes—distributed reconnaissance, adaptive lateral movement, threshold-splitting exfiltration, semantic service exhaustion, and cross-domain settlement—each coupled to an exact detection decision problem with a worst- case complexity lower bound, an information-theoretic defender error floor, and a formal evasion condition. Third, we propose AEGIS-MESH (Attested Evidence-Gated Interdiction System for Multi-domain Event-Synchronized HotStuff), a new counter-swarm architecture specified as a process-algebraic state machine family, with Byzantine fault tolerance for committees of n ≥ 3f + 1 replicas and five temporal-logic safety invariants enforcing evidence gating, mandatory human approval for destructive actions, and causal auditability. Fourth, we prove that the swarm attribution problem is NP-complete by reduction from Subgraph Isomorphism and derive a closed-form sensor-density lower bound required to guarantee attribution error at most δ. Fifth, we conduct a parametric numerical analysis of the dominance condition, a systematic capability evaluation of contemporary autonomous defence systems against a proposed reproducibility and external-validity framework, and a formal treatment of three Web3 security problems—bridge validator-threshold compromise, blind signing, and TWAP oracle manipulation—before closing with treaty-grade draft governance language and an auditable definition of meaningful human control.
Open access
Infrastructure Resilience and Vulnerability Analysis
Love Allen Chijioke Ahakonye, Hamza Ibrahim, Jae-Min Lee, Dong‐Seong Kim
Smart contract environments are increasingly targeted by stealthy, adaptive attacks that evade conventional rule-based or static anomaly detection systems. Inspired by the anglerfish’s bioluminescent filament, which perceives and lures activity in dark, dynamic environments, this research introduces a Bioluminescent Filament-Inspired Artificial Intelligence Perception framework for smart contract intrusion detection. The proposed model emulates biological sensory adaptation through multi-modal attention layers that dynamically illuminate anomalous behaviors in contract execution flows. By integrating self-supervised temporal perception with context-driven feedback, the framework continuously refines its detection sensitivity while maintaining low computational overhead. We evaluate the framework using fuzz-tested smart contract vulnerability datasets that simulate diverse malicious execution behaviors observed in Ethereum environments, demonstrating over 98% detection accuracy with a 40% reduction in latency compared to traditional deep learning-based IDS models. This biologically inspired perception paradigm offers a scalable, energy-efficient solution for securing blockchain-based decentralized systems against evolving threat vectors.
This abstract presents a comprehensive concept that leverages the synergy of various cutting-edge technologies to assure confidentiality and integrity of health data. Internet of Things (IoT) sensors are utilized as the primary data source, enabling the continuous monitoring of patients vital signs and health parameters. To ensure the security of this sensitive health data, Blockchain infrastructure is employed. The Blockchain employs a specialized routing protocol called Improved Whale Optimized Routing to efficiently handle data transactions. This routing protocol minimizes latency and maximizes throughput, ensuring the seamless transfer of health data to the Blockchain. The security of the Blockchain is further fortified by Deep Convolutional Neural Network (DCNN) based intrusion detection system. This DCNN model is trained using Distributed Ledger Technology (DLT), which ensures data privacy and integrity by distributing the training process across a network of nodes. This collaborative approach enhances the CNN's ability to identify and respond to potential security breaches in real time. Once the health data is verified as intrusion-free, it is securely stored in the Blockchain using the shortest path routing algorithm. This guarantees that data is efficiently stored, and retrieval is expedited when needed for medical diagnosis or research. This integrated system represents a novel approach for collecting and securely storing health data, providing a robust foundation for the future of healthcare systems. It combines the power of IoT sensors, Blockchain, Deep CNN-based intrusion detection and Distributed Ledger Technology to ensure the highest standards of data security and accessibility in healthcare applications.
The rapid evolution of cyber threats has exposed fundamental weaknesses in traditional intrusion detection systems, particularly those dependent on centralized architectures vulnerable to data tampering, single-point failures, and delayed threat response. As organizations face increasingly sophisticated attacks, a resilient and transparent framework for detecting and validating abnormal activity has become essential. This study examines the design and effectiveness of a blockchain-based intrusion detection system (BIDS) that leverages distributed consensus, immutable logging, and cooperative threat intelligence to enhance the reliability and responsiveness of security operations. By integrating blockchain technology with anomaly-based and signature-based identification methods, the proposed model establishes a secure environment where intrusion data cannot be altered, suppressed, or manipulated by internal or external adversaries. Through experimental evaluation across simulated network environments, the blockchain-enabled detection model demonstrates significant improvements in event accuracy, traceability, and coordination between participating nodes. The decentralized ledger structure ensures that alerts are validated collectively, reducing false positives and limiting the adversary’s ability to compromise the detection process. The integrity of recorded events also enhances forensic analysis, allowing security teams to reconstruct attack sequences with greater confidence. Additionally, the study reveals that the distributed nature of the system provides high fault tolerance, enabling continuous operation even under attempted denial-of-service conditions or node outages. Performance analysis indicates that blockchain integration does introduce additional computational overhead; however, the trade-off is compensated by the increased transparency, data authenticity, and resistance to insider threats that the system delivers. The research further highlights that smart contracts can automate rule enforcement and improve response mechanisms by triggering protective actions when predefined thresholds are met. This automation contributes to shortening detection-to-response timelines, a critical factor in mitigating fast-moving cyberattacks. Overall, the findings suggest that blockchain-powered intrusion detection represents a promising direction for strengthening network security in decentralized, cloud-based, and large-scale enterprise environments. By combining autonomous threat identification with tamper-proof logging and distributed validation, the proposed approach offers a comprehensive pathway for defending modern digital infrastructures against evolving cyber risks. The study concludes that integrating blockchain technology with intrusion detection principles not only reinforces system resilience but also lays the groundwork for more collaborative, transparent, and secure cybersecurity ecosystems.
The exponential growth of sophisticated cyber threats in Internet of Things (IoT) environments has exposed fundamental weaknesses in existing Cyber Threat Intelligence (CTI) platforms, including centralized architectures, trust deficits, privacy vulnerabilities, and single points of failure. To overcome these limitations, this paper proposes BlockIntelChain, a blockchain-based framework for secure, scalable, and collaborative CTI sharing across distributed IoT networks. The system integrates a hybrid consensus mechanism that combines Proof-of-Stake with reputation-based validator selection, supported by a multi-layered privacy framework employing Differential Privacy (DP), Zero-Knowledge Proofs (ZKP), Homomorphic Encryption, and Secure Multi-Party Computation. BlockIntelChain further embeds Federated Learning (FL) to enable distributed model training directly on IoT edge nodes without exposing raw threat telemetry. Comprehensive evaluations on real-world Malware Information Sharing Platform (MISP) datasets show that BlockIntelChain achieves 923 Transactions per Second at 500 nodes with 99.6% consensus success, while maintaining resilience against 51% and Byzantine attacks tolerating up to 33% malicious validators. Privacy analysis confirms an optimized utility-privacy trade-off, with DP (ε = 0.1) preserving 92% data utility and ZKP achieving 94% verification accuracy. The FL-based models outperform centralized baselines, reaching 96.4% accuracy for IoT malware classification, 94.7% for phishing detection, and 95.2% for network anomaly identification. Economic modeling validates sustainability through contributor growth (156 → 1,245 in 12 months) and improved contribution quality (0.73 → 0.92). The proposed framework directly benefits Security Operation Centers and edge-deployed IoT systems by enabling real-time threat intelligence exchange with strong security, privacy, and efficiency. Comparative benchmarking demonstrates BlockIntelChain's superiority over MISP, ThreatConnect, and IBM X-Force in decentralization, privacy, and cost efficiency, positioning it as a transformative solution for next-generation privacy-aware CTI ecosystems.
A vulnerability in smart contracts refers to weaknesses in the code that can be exploited by attackers, leading to security breaches and unintended behavior. With the growing use of smart contracts in decentralized blockchain systems, particularly in internet of things (IoT) environments, ensuring their security has become increasingly critical. Traditional vulnerability detection techniques, such as formal verification and symbolic execution, face significant limitations, including high rates of false positives and negatives, scalability issues, and difficulty in detecting complex vulnerabilities. To address these challenges, this paper proposes semantic contract flow analysis and deep learning ensemble (SCADE) for smart contract vulnerability detection. SCADE leverages semantic flow analysis combined with an ensemble of deep learning models, including convolutional neural networks (CNN), bidirectional sequence encoder (BSE), layered probabilistic neural network (LPNN), and adaptive context learning network (ACLN), to detect vulnerabilities effectively. The methodology breaks down the smart contract code into structured components through a contract structure mapper, followed by extracting semantic paths and converting them into sequential vector representations. These representations are then processed through a deep learning ensemble to identify potential vulnerabilities such as reentrancy, timestamp dependency, code injection, and hardcoded gas amounts.
Message spoofing and denial-of-service (DoS) attacks threaten vehicular network security by disrupting communication channels and falsifying safety-critical data. Traditional intrusion detection systems (IDS) exhibit high computational overhead and limited adaptability to evolving attack patterns. This paper presents a hybrid security framework integrating Language Agent Models (LAM) with a dual-layer blockchain architecture for real-time threat detection in Internet of Vehicles (IoV) networks. The LAM operates on edge devices to analyze heterogeneous data streams from CAN bus, V2X, and GPS sources. It identifies spoofing and DoS anomalies through transformer-based attention mechanisms with fewer than 1 billion parameters. The dual-layer blockchain combines Proof-of-Authority-and-Association (PoA2) consensus at layer 1 with zero-knowledge rollup (zk-Rollup) at layer 2. This architecture ensures tamper-proof alert logging while reducing on-chain storage overhead. The PoA2mechanism employs pre-authenticated validators to achieve microsecond-scale transaction finality. The zk-Rollup layer aggregates alert transactions into cryptographic validity proofs, minimizing blockchain storage requirements. Performance evaluation demonstrates the framework’s effectiveness across multiple metrics. Detection accuracy reaches 95.7% on the CICIoV2024 dataset and 96.9% on the Car-Hacking dataset. Precision exceeds 97% with F1-scores above 95% on both benchmarks. The system maintains false positive rates below 5.2%. End-to-end response latency remains under 5 milliseconds (ms), meeting real-time safety requirements. The blockchain layer processes over 2,187 transactions per second with 25 validator nodes. Storage optimization achieves a 92% reduction in on-chain data volume. Energy consumption decreases by 4.3 times compared to cloud-hosted language models. The proposed architecture provides deterministic threat detection with cryptographic auditability for large-scale IoV deployments.
Modern cyber threats, known for their complexity and constant change, surpass traditional intrusion detection systems (IDS). This paper explores a new security approach that combines Artificial Intelligence (AI) with decentralized architectures to develop IDS that are robust, scalable, and protect user privacy. It examines the core roles of Federated Learning (FL) and Blockchain, highlighting three main research challenges: The vulnerability of AI models to adversarial attacks, privacy and data integrity concerns in collaborative learning, and performance limitations in distributed systems. To address these issues, we suggest solutions such as adversarial training, differential privacy, and lightweight consensus mechanisms. Our analysis of case studies shows that hybrid FL-Blockchain systems outperform traditional methods in practical application environments.
With the deep integration of 6G, the Internet of Things, and artificial intelligence, this paper proposes an intrusion detection and defense framework that combines robust AI kernel reconstruction, a cross-layer collaborative perception architecture, and a dynamic defense closed-loop mechanism to address advanced persistent threats and dynamically evolving attacks targeting next-generation consumer services. First, a lightweight detection model ATF-KDBC is designed based on adversarial training and online knowledge distillation. Gradient masking and noise injection are employed to enhance robustness against adversarial samples, while a drift-aware module enables adaptive optimization under concept drift scenarios. The model achieves accuracies of 99.25% and 99.84% on the NSL-KDD and IoT-23 hybrid datasets, respectively, and compresses the model size to 1.08 MB, representing a 97.6% reduction compared with the BERT teacher model. Second, a multidimensional attack chain analysis model is developed based on a STHGN. By integrating semantic, structural, and temporal features with a multi-head self-attention mechanism, the model enables cross-layer threat tracing and millisecond-level response, achieving an F1-score exceeding 97.0% on the DARPA dataset. Furthermore, this study explores the construction of a distributed CTIS network by integrating federated learning and blockchain technology. Zero-knowledge proofs are employed to ensure privacy preservation, while a Quality of Data and Quality of Model scoring mechanism enables efficient and precise deployment of defense strategies. Experimental results demonstrate that the proposed framework significantly outperforms traditional methods in terms of robustness, environmental adaptability, and computational efficiency, thereby providing both theoretical support and a technical pathway for enhancing the resilience and security of next-generation consumer services.
Because of the rapid acceleration of cloud computing, data transfer security and intrusion detection in cloud networks have become emerging areas of concern. All traditional security mechanisms have central vulnerabilities, cannot detect real-time threats, and are ineffective against zero-day attacks. Signature-based approaches of existing intrusion detection systems (IDS) do not cover the dynamically changing nature of cyber threats. Conventional blockchain security methods suffer from poor scalability and dynamic threat analysis. Therefore, this research proposes integrating Ethereum Blockchain and Deep Learning to construct a well-founded security framework for cloud networks with data migration security and real-time intrusion detection. The architecture has five distinct methods, each of which deals with particular security issues. Blockchain-Aware Federated Learning for Secure Model Training (BAFL SMT) guarantees tamper-proof and decentralized deep learning model training, which reduces model poisoning attacks by 98.4%. Graph Neural Networks for Adaptive Intrusion Detection (GNN-AID) captures graph structures for real-time anomaly detection in networks while reducing false positives to 1.2%. Quantum-inspired Variational Autoencoders (QI VAE ZDAD) provide enhanced zero-day attack detection, with an improved detection rate of 92%. Self-Supervised Contrastive Learning for Blockchain Security Auditing (SSCL-BSA) detects smart contract vulnerabilities automatically, resulting in an 87% reduction in fraud risk. Finally, Hierarchical Transformers for Secure Data Migration (HT SDM) enhance the transfer security of large-scale cloud data, achieving an attack classification accuracy of 99.1%. Overall, this multi-layer security framework will greatly enhance cloud security by preserving data integrity, cutting down the intrusion detection time by up to 65%, and enhancing response mechanisms. By marrying the immutable transparency of blockchain with superior anomaly detection at deep learning, this research provides a scalable, real-time, and intelligent approach to strengthening security against the backed-up transfer of data within cloud networks.
Intrusion Detection Systems (IDS) play a critical role in protecting modern networks, but traditional centralized designs raise serious concerns regarding data privacy, trust, and scalability. Federated Learning (FL) reduces privacy risks through decentralized model training, and blockchain enhances trust by providing immutability and transparency. Combining these technologies creates a promising paradigm for secure and trustworthy IDS. This paper presents a comprehensive survey of blockchain-federated IDS with a particular focus on privacy and trust. The key contribution is a multi-dimensional taxonomy that integrates IDS architectures, FL strategies, blockchain types, and consensus mechanisms, providing a clear and structured view of this emerging field. We categorize threats into data, communication, and model levels, and map representative defense mechanisms to each. We also review applications in vehicular networks, industrial and medical Internet of Things (IoT), and metaverse scenarios. Finally, we highlight key challenges, including non-IID data, lightweight consensus, incentive mechanisms, and poisoning-resilient aggregation, and outline future research directions.
With the growing demand on cutting edge technologies specially in the field of internet of things (IoT) cybersecurity the intersections between blockchain and federated learning (FL) is a promising research field. Blockchain based systems, which are inherently decentralized and trustless, allow local immutable logging for transparent, tamperproof security frameworks that support automated threat response via smart contracts while really being able to understand the integrity of the data being shared across a distributed network of machines. FL represents a powerful new paradigm, allowing organizations to create an accurate intrusion detection system (IDS) without needing to centralize sensitive data, a fundamental problem to solve in healthcare, finance, or Industrial IoT. Both technologies have important synergies within hybrid architectures that offer a balanced alternative by leveraging the privacy of FL and the security and auditability of blockchain to create a viable path to robust, scalable, and reliable cyber defense. There remain numerous challenges yet to be resolved around scalability, interoperability between devices and legacy systems, real-world deployment, and energy efficiency, but the cybersecurity landscape appears to be rapidly evolving to incorporate decentralized technologies. This survey material has highlighted the areas in which progress is being made, outlined the core strengths and limitations of the technologies and approaches employed today, and suggested innovative ideas to pursue in shaping secure, and privacy-conscience, adaptive technologies in forthcoming generation of distributed and networked environments.
Blockchain is a distributed ledger technology that provides pseudo-anonymity among participants to maintain privacy. However, malicious actors utilise this property to hide their illegal rewards received through cyber attacks, dark market trades, money laundering and Ponzi schemes. The recent confiscation by the FBI of more than $4 million USD worth of bitcoin from the ‘Silk Road’ dark marketplace indicates the scale of the problem faced by financial regulators and law enforcement authorities. Analysing and identifying harmful actors is, therefore, necessary to regulate the transactions of digital assets. Machine learning models can assist in detecting patterns and correlations between the actors in blockchain networks that may not be apparent through traditional methods. In blockchain networks, the number of actors linked to illegal activities is significantly smaller than that of regular activities. Also, only very limited labelled transaction data is available about these malicious actors. These limitations make it harder to train supervised learning models to provide real-time proactive responses. This article represents a pioneering effort in thoroughly examining the different unsupervised learning methods for clustering suspicious behaviour of actors within blockchain networks. The proposed unsupervised learning-based analysis considers metadata and interconnectivity information of blockchain transactions. The metadata contains time-based and amount-based information. Interconnectivity data represents centrality measures and embedding vectors of the blockchain network. The quality of the identified clusters is validated using internal and external cluster validation measures. The validation results were used to identify influential features using the eXplainable AI technique Shapley (ShAP) values. The results reveal that the features related to the spending and receiving transactions strongly influenced cluster identification. Overall, the centroid-based and connectivity-based approaches identified well-separated clusters for metadata and centrality-based features of blockchain transactions.
Smart contract vulnerability detection has attracted increasing attention due to billions of economic losses caused by vulnerabilities. Existing smart contract vulnerability detection methods have high false negative and high false positive rates. To address these issues, we present ByteEye, a bytecode level smart contract vulnerability detection framework with Graph Neural Networks (GNNs). ByteEye first constructs an edge-enhanced Control Flow Graph (CFG) to maintain rich information from the low-level bytecode with low latency. ByteEye also designs and incorporates both general information and vulnerability-specific information into its detection method as bytecode level features. Furthermore, ByteEye flexibly supports machine/deep learning models, especially with graph neural networks, which can facilitate vulnerability detection precisely. The extensive experimental results highlight that ByteEye outperforms the state-of-the-art approaches on all three types of vulnerability detection. ByteEye can achieve an average of 35.29%, 43.95%, and 6.38% higher on F1 than the bytecode level best-performed baseline on reentrancy vulnerability, timestamp dependency vulnerability, and integer overflow/underflow vulnerability, respectively. Moreover, ByteEye can detect 361 new vulnerabilities in real-world smart contracts, which are reported for the first time. ByteEye enhances control flow information, designs general bytecode-level features with expert knowledge, and flexibly supports deep learning models, particularly GNNs, thus achieving high detection effectiveness.
A blockchain-enabled Model integrates blockchain technology with Intrusion Detection Systems to enhance the security of Internet of Things (IoT) networks. It ensures data integrity, decentralization, and tamper-proof logging of intrusion detection. The approach improves trust, transparency, and real-time threat detection in distributed IoT environments. The existing blockchain-based IDS approaches, Blockchain Enabled (BCE-IoT), uniquely integrate blockchain consensus with federated-style local training, lightweight cryptography, and Shapley Additive Explanations (SHAP)-based explainability, ensuring both security and interpretability in IoT environments. The proposed work combines Blockchain technology with explainable artificial intelligence solutions to create a new cybersecurity Model that strengthens intrusion detection within IoT networks. The proposed model enhances transparency in tracking cyberattacks by combining blockchain security storage capabilities with SHAP, an explainable AI. This research utilises machine learning and artificial intelligence to detect threats in real-time, countering Distributed Denial of Service (DDoS), Denial of Service (DoS), scanning, Cross-Site Scripting (XSS), injection, password, and backdoor attacks. BCE-IoT delivers more precise security by combining blockchain’s permanent data features and AI anomaly detectors, thereby reducing security alert mistakes. The performance effectiveness of Blockchain-Enabled IoT surpasses that of the Content Integrity Detection System. It combines Blockchain and Software-Defined Networking to enhance security in network environments, utilising blockchain-based mutual confirmation for software-defined networking to detect and block cyber threats. The evaluation establishes BCE-IoT as an effective IoT network security solution that delivers strong cybersecurity features, is adaptable to modern connected environments, and offers interpretable security solutions. The performance evaluations demonstrate that BCE-IoT provides a robust, flexible, and interpretable cybersecurity solution suitable for modern IoT environments.