A new open-access study reports a blockchain-based cybersecurity framework designed to protect client–server networks from Distributed Denial of Service (DDoS) attacks, combining an Ethereum smart contract layer with machine learning detection models trained on the CIC-DDoS2019 dataset. Across eight tested models, a convolutional neural network (CNN) achieved 98.5% DDoS attack detection accuracy and 99.8% DDoS attack prevention capability, the highest prevention value among the models evaluated in the simulation.
The research, published in Discover Data on 11 May 2026 by Eshetie Teka Mitiku, Yirga Yayeh Munaye and colleagues, addresses what the authors describe as a structural weakness of conventional defenses. Traditional artificial intelligence, machine learning and deep learning approaches, they argue, are largely limited to detecting DDoS attacks rather than blocking them, and their dependence on centralized architectures creates single points of failure that make them attractive targets for attackers.
The scale of the problem motivates the work. According to a Cisco annual report cited in the study, the number of DDoS attacks rose from 7.9 million in 2018 to 15.4 million in 2023, roughly a doubling over five years. The authors also cite industry security reports ranking DDoS fourth among major cyber-attack categories in 2025, between supply chain attacks and zero-day exploits. In a client–server architecture, servers produce services that clients consume, so flooding a server with malicious traffic can disrupt operations, cause financial loss and damage reputation.
The proposed design inserts a permissionless blockchain network layer between incoming requests and the client–server layer. Every client request must first be authenticated and validated by the blockchain layer; only non-malicious requests are forwarded to the centralized server, while unverified or malicious requests are blocked by smart contracts. The two layers communicate using JSON-RPC or HTTP/HTTPS protocols in an off-chain mode, keeping network traffic details such as IP addresses and packet headers outside the blockchain itself, since on-chain tasks are slow and costly.
On the detection side, the researchers trained and tested eight models on the CIC-DDoS2019 dataset, a large public dataset from the Canadian Institute for Cybersecurity containing multiple DDoS attack types and benign traffic. The dataset was split 80–20 for training and testing using a time-aware stratified split with a fixed seed for reproducibility. Preprocessing included normalization and removal of session-specific identifiers such as IP addresses and ports to avoid overfitting, while the SMOTE oversampling technique was applied only to the training portion to correct class imbalance, leaving test and validation data unmodified to reflect real distributions.
The eight models compared were ANN, CNN, KNN, LSTM, SVM, Random Forest, a hybrid of LSTM and CNN, and a hybrid of Random Forest and XGBoost. Detection accuracy varied widely, from 78% for LSTM to 98.5% for CNN, with a mean detection accuracy of 94.60% and a standard deviation of 6.8% across the eight trials. Latency also differed sharply: the ANN model was fastest at 0.006 milliseconds per detection, while the CNN model, despite its best prevention capability of 99.8%, was slowest at 380.169 milliseconds. The average latency across all eight models was 48.4811 milliseconds.
For the CNN model, the authors report detailed validation. The architecture used two Conv1D layers with filter sizes increasing from 32 to 64 to 128, the Adam optimizer with a learning rate of 0.0001, a batch size of 32, and 150 epochs. Several classes achieved an area under the ROC curve of 1, indicating complete class separation in the multi-class evaluation, and the confusion matrix showed the largest values concentrated on the diagonal of correctly classified classes. Training and validation losses both fell to approximately zero by the end of training, a pattern the authors note is consistent with well-regularized behavior on imbalanced multi-class data, while cautioning that small gaps alone do not rule out overfitting.
The blocking mechanism was implemented as a Solidity smart contract developed in Remix IDE on the Ethereum platform and deployed through Ganache, MetaMask and the Sepolia testnet. The system uses a Proof of Stake consensus mechanism, which the authors selected because it requires less computational energy and cost than Proof of Work. During simulation, deploying the contract used approximately 65,000 gas at a cost of 0.0000065 ETH, with transaction throughput of 15 to 30 transactions per second and latency between 12 and 30 seconds. An interactive dashboard simulated normal traffic and DDoS attacks, displaying blocked IP addresses, active attacks, CPU and memory utilization, and blockchain logs, with email alerts to network administrators when attacks occurred.
Compared with previous work reviewed in the study, which reported detection accuracies such as 99.99999% for Random Forest and 99.99996% for XGBoost, the authors emphasize that most prior studies focused on detection alone and rarely measured prevention capability, latency, throughput or resource utilization. Their framework adds eight evaluation parameters, including prevention capability, throughput, ROC and AUC curves, and CPU, memory and bandwidth utilization. The authors also acknowledge limitations: the CIC-DDoS2019 dataset is imbalanced, not fully representative of real-world attacks, and carries possible labeling errors and noise, and the study addresses only DDoS among many cyber-attack types, with scalability left for future work.
The team recommends real-world implementation to validate the framework outside simulation, noting that the required hardware and software are expensive, and suggests that a lighter, more balanced version of the CIC-DDoS2019 dataset would reduce computational overhead. For now, the study presents a simulated prototype in which blockchain smart contracts, guided by a trained CNN detector, automatically blocked the overwhelming majority of attempted DDoS attacks in the test environment, offering a quantitative baseline for decentralized approaches to DDoS mitigation on client–server networks.
Subject of Research: A blockchain and machine learning framework for detecting and blocking DDoS attacks on client–server networks
Article Title: Designing of blockchain-based cyber security for the protection of Distributed Denial of Service (DDoS) attacks on client–server networks
Article References: Mitiku, E. T., Munaye, Y. Y., Selvakumar, S., Mitiku, G. A., Belete, A. A., Zeru, S. A., Alemu, M. T., & Baye, G. A. (2026). Designing of blockchain-based cyber security for the protection of Distributed Denial of Service (DDoS) attacks on client–server networks. Discover Data, 4(1), Article 8. https://doi.org/10.1007/s44248-026-00107-0
Image Credits: AI Generated
DOI: 10.1007/s44248-026-00107-0
Keywords: blockchain, DDoS, cybersecurity, smart contracts, Ethereum, machine learning, CNN, client–server networks, CIC-DDoS2019, intrusion prevention, Proof of Stake, network security
News Source: Hailey Crawford. (October 29, 2026). Blockchain Shield Uses Smart Contracts to Block DDoS Attacks on Servers. Scienmag.
