Blockchain-Based Security Framework for OSI Model Network Interaction in Critical Infrastructure Systems

Abstract

The article develops and experimentally evaluates a cybersecurity framework for network interaction in critical infrastructure systems by combining cross-layer OSI monitoring, permissioned blockchain, PBFT consensus, smart-contract-based detection and automated response. The relevance of the study is determined by the growing exposure of energy, water supply, transport, telecommunications and other critical infrastructure sectors to multi-stage cyberattacks that affect several layers of network communication and may include traffic manipulation, false command injection, denial-of-service actions and tampering with security logs. Conventional centralized intrusion detection architectures remain vulnerable to the compromise of event repositories and create a single point of failure, which limits the evidentiary value and operational reliability of collected security events. The aim of the article is to propose an integrated architecture in which monitoring agents collect metadata of protocol data units from OSI layers L2-L7, hashes and compressed event features are recorded in an immutable distributed ledger, and smart contracts perform cross-layer correlation and initiate response scenarios. The paper formalizes the threat model, describes the structure of the blockchain registry, introduces an adaptive trust assessment mechanism for event sources, defines an integral anomaly score and presents the operational algorithm of the framework. Experimental evaluation on an emulation testbed demonstrates that the proposed approach achieves a higher F1 score than a signature-based IDS, an RF-IDS and a centralized event-storage variant while preserving acceptable end-to-end detection latency for critical infrastructure monitoring scenarios. The results confirm the feasibility of using permissioned blockchain networks as a trusted layer for logging, verification and response coordination in distributed cyber-physical environments where the integrity and traceability of security evidence are essential.