A novel intelligent cyber threat detection system with blockchain-enforced immutable forensic auditability

Traditional cybersecurity frameworks such as National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and International Organization for Standardization/International Electrotechnical Commission 27001 (ISO/IEC 27001) rely on periodic audits and static policies, rendering them unable to detect rare attack classes or flag low-confidence predictions in real time. This study introduces the Intelligent Cyber Threat Detection System (ICTDS), a fully Dockerized, end-to-end pipeline that unifies high-accuracy multi-class classification, confidence-based anomaly detection, Natural Language Processing (NLP)-enriched contextual analysis, and tamper-evident forensic logging. The system integrates Borderline-SMOTE to achieve near perfect recall on extremely rare attacks. CatBoost gradient boosting for robust handling of heterogeneous categorical features, and a spaCy transformer pipeline that extracts 3,214 threat indicators from live Suricata and Zeek logs. Predictions with confidence below 0.60 are automatically flagged as potential zero-day events, yielding 91–94% true-positive rates on unseen behaviours. Every classification decision is cryptographically hashed and immutably recorded via Solidity smart contracts, sustaining >400 records per second in local Ganache emulation and successfully verified on the Sepolia testnet. Cross-dataset evaluation on CICIDS-2017 and Czech Technical University–Internet of Things–Malware Dataset (CTU-IoT-Malware) demonstrates strong generalization with macro F1-scores of 0.983 ± 0.001 and 0.954 ± 0.006, respectively. Comprehensive ablation studies confirm component interdependence: removing Synthetic Minority Over-sampling Technique (SMOTE) collapses macro F1 by >85 percentage points, excluding the NLP module reduces weighted F1 by 5.68% and zero-day detection by >318%, and disabling blockchain (BC) logging sacrifices forensic integrity entirely. ICTDS framework seamlessly combines state-of-the-art detection, contextual intelligence, and legally admissible auditability within a single reproducible pipeline.