Blockchain-Backed Fog Nodes Team Up to Catch IoT Intrusions

Researchers have unveiled a distributed intrusion detection system that combines machine learning, blockchain technology and fog computing to protect Internet of Things devices, reporting that collaboration among fog nodes sharply improves detection of zero-day attacks. The study, published in Cluster Computing, was conducted by Rahma Trabelsi, Ghofrane Fersi and Mohamed Jmaiel, and addresses a persistent trade-off in existing intrusion detection systems between detection accuracy and the resources they consume.

The proposed architecture places a hybrid intrusion detection system on each fog node, the intermediate computing layer that sits close to IoT devices. Every node runs a combination of signature-based, anomaly-based and reputation-based processes, using machine learning algorithms to identify abnormal patterns that may indicate malicious activity. Rather than operating in isolation, the fog nodes engage in proactive collaboration: they jointly compute reputation scores that feed into intrusion detection decisions, strengthening their shared knowledge base and improving the precision of the detection mechanisms. The blockchain serves two roles in the design. It guarantees the traceability, integrity, immutability and post-hoc auditability of the reputation scores used to grant or revoke access, and it maintains the list of trusted fog nodes permitted to participate in the reputation-score computation.

The evaluation covered deployments with different numbers of fog nodes, ranging from 1 to 10, and attack rates ranging from 30% to 90%. Across these experiments, the mean values of accuracy, precision, recall and F1-score were reported as 0.91, 0.95, 0.94 and 0.94 respectively, while the false-positive rate stayed below 0.2. These figures describe the system’s measured performance in the authors’ test configuration rather than results from a real-world deployment.

The most striking results came from the zero-day tests, which probe how the system handles previously unseen attacks. When the number of collaborating fog nodes increased from 1 to 10, the average F1-score rose from 0.563 to 0.891, recall improved from 0.557 to 0.915, and accuracy climbed from 0.574 to 0.896. The authors present these gains as evidence that the collaborative approach is effective in IoT networks: a single fog node working alone misses a substantial share of novel intrusions, while pooling reputation-based judgments across many nodes recovers much of that lost detection capability.

The design reflects the specific constraints of IoT security. IoT systems connect numerous smart devices that communicate, gather and share data, and the authors identify securing them against malicious attacks as a crucial necessity, with automated intrusion detection as the first step in prevention. By exploiting the locality of fog nodes for low-latency processing, the approach aims to keep detection close to the devices while the blockchain layer adds accountability for the scores that decide access. The reported evaluation is confined to the tested ranges of node counts and attack rates, and the published abstract does not include results from deployments on production IoT infrastructure, so the figures should be read as experimental performance in the authors’ test setting rather than guarantees for arbitrary networks.

Subject of Research: A blockchain- and fog-computing-based distributed intrusion detection system for IoT networks.

Article Title: Distributed intrusion detection system based on blockchain and fog computing for IoT networks

Article References: Trabelsi, R., Fersi, G., & Jmaiel, M. (2026). Distributed intrusion detection system based on blockchain and fog computing for IoT networks. Cluster Computing, 29(16), Article 902. https://doi.org/10.1007/s10586-026-06713-6

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06713-6

Keywords: IoT security, intrusion detection, blockchain, fog computing, machine learning, reputation scores, zero-day attacks, distributed systems, network security, Cluster Computing, Distributed, intrusion