Decentralised Trustworthy Collaborative Intrusion Detection System for IoT

TL;DR

This paper presents a decentralised blockchain-based collaborative intrusion detection system for IoT that emphasizes trust evaluation between nodes, ensuring scalable and trustworthy sharing of detection rules.

Contribution

It introduces a trust-aware, decentralised CIDS architecture that offloads trust computation to blockchain and uses decentralised storage for scalable intrusion detection.

Findings

Feasible implementation on a lab-scale testbed.

Performance within Ethereum platform benchmarks.

Enhanced trust management in collaborative intrusion detection.

Abstract

Intrusion Detection Systems (IDS) have been the industry standard for securing IoT networks against known attacks. To increase the capability of an IDS, researchers proposed the concept of blockchain-based Collaborative-IDS (CIDS), wherein blockchain acts as a decentralised platform allowing collaboration between CIDS nodes to share intrusion related information, such as intrusion alarms and detection rules. However, proposals in blockchain-based CIDS overlook the importance of continuous evaluation of the trustworthiness of each node and generally work based on the assumption that the nodes are always honest. In this paper, we propose a decentralised CIDS that emphasises the importance of building trust between CIDS nodes. In our proposed solution, each CIDS node exchanges detection rules to help other nodes detect new types of intrusion. Our architecture offloads the trust computation to the blockchain and utilises a decentralised storage to host the shared trustworthy detection rules, ensuring scalability. Our implementation in a lab-scale testbed shows that the our solution is feasible and performs within the expected benchmarks of the Ethereum platform.