A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing

Abstract

The rapid expansion of digital systems has intensified the complexity of cyber threats, rendering traditional intrusion detection systems (IDS) inadequate against evolving attacks. This study proposes a hybrid IDS (H-IDS) that integrates supervised (SVM, Random Forest, CatBoost, DNN) and unsupervised (Isolation Forest, One-Class SVM, Autoencoder) models within an ensemble framework. Preprocessing employs PCA for dimensionality reduction and SMOTE for class balancing, while weighted voting based on cross-validation F1-scores optimizes ensemble decisions. A lightweight blockchain-inspired hash-chained audit log provides tamper-evident logging of detection events in a single-node deployment without decentralized consensus. Evaluated on NSL-KDD and CIC-IDS2017 datasets, H-IDS achieves 98.85% accuracy (pre-blockchain) and 98.15% (post-blockchain). The ledger operates in a private, single-node setting and introduces minimal local logging overhead and observed reductions in false positives (paired t-test, n = 3, p < 0.05). This work advances trustworthy, auditable, and high-performance intrusion detection for modern network environments.