Blockchain uses face challenges in endpoint detection and response systems
From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures
Cryptography and SecurityArtificial IntelligenceNetworking and Internet Architecture
Summary
Detecting and responding to network threats is evolving beyond traditional tools, but combining this with blockchain technology is tricky. The authors looked at many studies and found that using blockchain directly on each device is rare and difficult due to delays and technical issues. They point out ongoing problems like slow consensus, vulnerabilities in encryption, and risks in smart contracts. They recommend new ways to combine blockchain and other systems to improve security responses.
What this means in practice
- •For security operations teams: Develop detection and response systems integrating blockchain where it helps manage trust without adding excessive delays.
- •For iot device manufacturers: Design IoT security solutions considering blockchain limitations in latency and cryptography highlighted by the survey.
A survey. It maps existing work.
Authors
Yahya Shahsavari, Sara Rouhani, Kaiwen Zhang
Abstract
While the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward modern Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) architectures, and they conflate blockchain's distinct functional roles into a single monolithic category. This Systematization of Knowledge (SoK) addresses these gaps by proposing a three-axis taxonomy that classifies proposals by detection-system class (NIDS, HIDS, EDR/XDR), blockchain functional role, and response-automation maturity. Synthesizing research published in high-impact venues between 2019 and 2026, we provide a rigorous gap analysis exposing why a genuine per-endpoint blockchain-anchored response loop remains nearly nonexistent due to latency, deployment, and community mismatches. Furthermore, we evaluate structural, cross-cutting challenges persisting across the literature, including consensus latency on constrained devices, post-quantum cryptographic vulnerability, smart-contract attack surfaces, and the adversarial vulnerability of evolving LLM-based detection engines. Finally, we outline a comprehensive research agenda centered on hybrid on-chain/off-chain orchestration to bridge the gap between decentralized trust and rapid response automation.