A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing
- 1Department of Computer Engineering, College of Computer and Information Sciences, Majmaah University, Al Majmaah, Saudi Arabia
- 2Department of Information Technology, College of Computer and Information Sciences, Majmaah University, Al Majmaah, Saudi Arabia
Abstract
The rapid expansion of digital systems has intensified the complexity of cyber threats, rendering traditional intrusion detection systems (IDS) inadequate against evolving attacks. This study proposes a hybrid IDS (H-IDS) that integrates supervised (SVM, Random Forest, CatBoost, DNN) and unsupervised (Isolation Forest, One-Class SVM, Autoencoder) models within an ensemble framework. Preprocessing employs PCA for dimensionality reduction and SMOTE for class balancing, while weighted voting based on cross-validation F1-scores optimizes ensemble decisions. A lightweight blockchain-inspired hash-chained audit log provides tamper-evident logging of detection events in a single-node deployment without decentralized consensus. Evaluated on NSL-KDD and CIC-IDS2017 datasets, H-IDS achieves 98.85% accuracy (pre-blockchain) and 98.15% (post-blockchain). The ledger operates in a private, single-node setting and introduces minimal local logging overhead and observed reductions in false positives (paired t-test, n = 3, p < 0.05). This work advances trustworthy, auditable, and high-performance intrusion detection for modern network environments.
Related
- Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection
- ACO-Enhanced DCNN-BiLSTM framework for intrusion detection in smart Consumer Electronics network
- Fuzzy-clustering–based multi-scale intrusion detection for the industrial internet of things
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- X-MAG-COS: Compact Evidence Messaging for Source-Partitioned Open-Set Intrusion Detection in 5G–IoT Networks
BibTeX
@article{mishra2026lightweight,
title = {{A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing}},
author = {Shailendra Mishra and Reem Alshenaifi and Ruba Ahmed Alfahidah},
journal = {PLOS One},
year = {2026},
month = sep,
doi = {10.1371/journal.pone.0356878},
url = {https://doi.org/10.1371/journal.pone.0356878},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing
AU - Shailendra Mishra
AU - Reem Alshenaifi
AU - Ruba Ahmed Alfahidah
PY - 2026
DA - 2026/09/11
JO - PLOS One
DO - 10.1371/journal.pone.0356878
UR - https://doi.org/10.1371/journal.pone.0356878
AB - The rapid expansion of digital systems has intensified the complexity of cyber threats, rendering traditional intrusion detection systems (IDS) inadequate against evolving attacks. This study proposes a hybrid IDS (H-IDS) that integrates supervised (SVM, Random Forest, CatBoost, DNN) and unsupervised (Isolation Forest, One-Class SVM, Autoencoder) models within an ensemble framework. Preprocessing employs PCA for dimensionality reduction and SMOTE for class balancing, while weighted voting based on cross-validation F1-scores optimizes ensemble decisions. A lightweight blockchain-inspired hash-chained audit log provides tamper-evident logging of detection events in a single-node deployment without decentralized consensus. Evaluated on NSL-KDD and CIC-IDS2017 datasets, H-IDS achieves 98.85% accuracy (pre-blockchain) and 98.15% (post-blockchain). The ledger operates in a private, single-node setting and introduces minimal local logging overhead and observed reductions in false positives (paired t-test, n = 3, p < 0.05). This work advances trustworthy, auditable, and high-performance intrusion detection for modern network environments.
SN - 1932-6203
ER -