From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures
A systematization maps blockchain roles in detection-and-response and finds per-endpoint on-chain loops remain rare.
This systematization of knowledge reviews blockchain-assisted intrusion detection published from 2019 to 2026 and argues earlier surveys miss the move toward EDR and XDR. It proposes a three-axis taxonomy of detection-system class, blockchain functional role, and response-automation maturity. The authors conclude that a genuine per-endpoint blockchain-anchored response loop is nearly nonexistent because of latency, deployment, and community mismatches. Persistent challenges include consensus latency, post-quantum cryptography, smart-contract attacks, and adversarial weakness of LLM-based detectors.
- SoK reviews blockchain-assisted detection research published from 2019 to 2026.
- Taxonomy covers detection class, blockchain role, and response automation.
- Per-endpoint on-chain response loops remain nearly nonexistent.
- Gaps include latency, post-quantum crypto, smart contracts, and LLM detectors.
From the original article
1 min read at arxiv.orgWhile the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward modern Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) architectures, and they conflate…
By Yahya Shahsavari · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.