A blockchain-enhanced CNN architecture for robust anomaly detection in industrial and IoT cyber-physical systems

Cyber–physical and network attacks are becoming commonplace in Industrial Internet of Things (IIoT) environments, with the potential to disrupt operations, compromise safety, and potentially impact the reliability of security evidence. In this study, a modified CNN (mCNN) framework is proposed to detect anomalies with robust, auditable capabilities by incorporating blockchain technology. The detector is based on the following building blocks: dilated convolutions to capture temporal dependencies in industrial process data, multi-branch feature extraction, dataset-adaptive input structuring, and a compact classifier to model heterogeneous patterns in IoT traffic. Anomalies detected are turned into signed and hashed event records and sent to a permissioned Hyperledger Fabric workflow. They test the framework on SWaT and N-BaIoT and validate their results with three baselines: Isolation Forest, autoencoder, and LSTM, and compare them with accuracy, precision, recall, F1-score, and AUC. The proposed CNN is designed under the adopted protocol, and the F1-scores obtained on SWaT and N-BaIoT are 0.977 and 0.951, respectively. An incremental ablation study quantifies the contributions of dilation, multi-branch fusion, windowing, and structured input representation. The findings advocate for the use of customized CNN models for anomaly detection in heterogeneous IIoT applications, and blockchain stress testing, adversarial robustness, constrained-device profiling, and model-specific explainability are key aspects that need to be assessed in the future.