Poisoning-resistant signature sharing for hybrid intrusion detection using a permissioned blockchain ledger

Collaborative intrusion detection systems share attack signatures so that an attack detected at one site, such as a roadside operator in an intelligent transportation system, can be blocked at others. Blockchain has been proposed as the sharing medium, but earlier evaluations have neither separated the contribution of the ledger from that of the detector nor examined whether shared signatures can be used to attack the receivers. This paper studies and extends a hybrid blockchain-based intrusion detection system (HBIDS) that combines signature matching with a classifier ensemble and exchanges new signatures through a permissioned ledger; the architecture follows Khonde and Ulagamuthalvi. The contributions are an endorsement rule that rejects poisoned signatures and a leakage-controlled evaluation. Each validator endorses a signature only if it matches at most 0.05% of its own benign traffic, and a signature is committed only with a threshold of signed endorsements, followed by Practical Byzantine Fault Tolerance (PBFT) agreement. HBIDS was evaluated on 6 days of CSE-CIC-IDS2018 with a chronological split per class, after removing 1,847,084, exact duplicate flows (29.4% of the records). The hybrid detector reached an F1-score of 99.43% and a false-positive rate of 0.093%. With each capture day treated as a separate site, sharing signatures raised the recall on attack families unseen at a site from 27.00% to 98.55% (authenticated publish-subscribe) and 93.07% (ledger), so the gain came from sharing, not from the ledger. Under a poisoning attack, publish-subscribe accepted all 50 poisoned signatures and the mean false-positive rate of the honest sites rose to 43.647%, whereas the ledger with an n − f admission threshold committed 0 of them (false-positive rate 0.504%) and still rejected all of them with up to f colluding validators; a 2f + 1 threshold admitted all of them with one colluding validator. Ledger commit latency was 75–435 m per 50-signature block for 4 to 13 validators, against 12–36 m for publish-subscribe. The ledger does not improve detection accuracy by itself; its benefit lies in admission control, ordering and tamper evidence for shared signatures.