Blockchain Ledger Blocks Poisoned Attack Signatures in Collaborative Intrusion Detection

Collaborative intrusion detection systems share attack signatures so that an attack detected at one site, such as a roadside operator in an intelligent transportation system, can be blocked at others. Blockchain has been proposed as the sharing medium, but earlier evaluations have neither separated the contribution of the ledger from that of the detector nor examined whether shared signatures can be used to attack the receivers. A new study addresses both gaps by extending a hybrid blockchain-based intrusion detection system, known as HBIDS, that combines signature matching with a classifier ensemble and exchanges new signatures through a permissioned ledger, following the architecture of Khonde and Ulagamuthalvi.

The central contribution is an endorsement rule designed to reject poisoned signatures. Each validator endorses a candidate signature only if it matches at most 0.05 percent of its own benign traffic, and a signature is committed only with a threshold of signed endorsements, followed by Practical Byzantine Fault Tolerance agreement. This admission control is paired with a leakage-controlled evaluation designed to avoid optimistic bias in the reported detection scores.

The system was evaluated on six days of the CSE-CIC-IDS2018 dataset with a chronological split per class, after removing 1,847,084 exact duplicate flows, which amounted to 29.4 percent of the records. The hybrid detector reached an F1-score of 99.43 percent and a false-positive rate of 0.093 percent. With each capture day treated as a separate site, sharing signatures raised the recall on attack families unseen at a site from 27.00 percent to 98.55 percent under authenticated publish-subscribe and to 93.07 percent under the ledger, so the gain came from sharing itself, not from the ledger.

The poisoning experiments revealed the sharpest contrast between the two sharing mechanisms. Under a poisoning attack, publish-subscribe accepted all 50 poisoned signatures, and the mean false-positive rate of the honest sites rose to 43.647 percent. The ledger with an n minus f admission threshold committed none of them, keeping the false-positive rate at 0.504 percent, and it still rejected all of them with up to f colluding validators. A 2f plus 1 threshold, by contrast, admitted all of the poisoned signatures with just one colluding validator, underlining how sensitive the defense is to the choice of quorum rule.

Latency is the price of that protection. Ledger commit latency ranged from 75 to 435 milliseconds per 50-signature block for 4 to 13 validators, against 12 to 36 milliseconds for publish-subscribe. The authors conclude that the ledger does not improve detection accuracy by itself; its benefit lies in admission control, ordering and tamper evidence for shared signatures. In other words, the ledger is a governance layer for what enters the shared signature pool, not a detector in its own right.

The study’s framing matters for intelligent transportation systems, where roadside operators and other distributed nodes must coordinate defenses against attacks that may first appear at a single location. Signature sharing lets a detection made at one site protect all others, but the same channel becomes an attack surface if an adversary can inject signatures that match benign traffic at the receivers. The endorsement rule and the Byzantine agreement protocol are designed to close exactly that channel, requiring that a signature be demonstrably harmless to a quorum of independent validators before it is committed to the shared ledger.

The evaluation design also carries methodological weight. By treating each capture day as a separate site, the authors simulated a federation of independent operators with partially overlapping threat exposure, which is the realistic condition under which signature sharing is supposed to help. The chronological split per class and the removal of nearly a third of the records as exact duplicates are intended to prevent information leakage from inflating the reported scores, a common concern in machine-learning evaluations of network intrusion detection.

The distinction between the two sharing mechanisms is the study’s clearest takeaway. Authenticated publish-subscribe delivered the higher recall on unseen attack families and the lower latency, but it offered no defense against a malicious publisher. The permissioned ledger sacrificed some recall and several hundred milliseconds of latency per block, yet it preserved the integrity of the shared signature pool even when a fraction of the validators colluded. For deployments where the sharing channel itself is a plausible target, that trade-off may be decisive.

The work is presented as an original research article in Frontiers in Blockchain, in the section on Blockchain Security and Privacy, with Sharad Singh and Hanumat Sastry G of the University of Petroleum and Energy Studies, Dehradun, India, as authors. The authors state that all claims expressed in the article are solely their own and do not necessarily represent those of their affiliated organizations or of the publisher, the editors and the reviewers.

Subject of Research: Poisoning-resistant sharing of intrusion detection signatures through a permissioned blockchain ledger

Article Title: Poisoning-resistant signature sharing for hybrid intrusion detection using a permissioned blockchain ledger

Article References: Singh, S., & G, H. S. (2026). Poisoning-Resistant Signature Sharing for Hybrid Intrusion Detection Using a Permissioned Blockchain Ledger. Frontiers in Blockchain, 9, 1960105. https://doi.org/10.3389/fbloc.2026.1960105

Image Credits: AI Generated

DOI: 10.3389/fbloc.2026.1960105

Keywords: blockchain, intrusion detection, data poisoning, Byzantine fault tolerance, signature sharing, collaborative security, CSE-CIC-IDS2018, intelligent transportation systems, permissioned ledger, network security, Poisoning-resistant, signature