From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures

What it is

A SoK (Systematization of Knowledge) paper proposing a concrete three-axis taxonomy for classifying blockchain-assisted detection/response systems, by Shahsavari, Rouhani, and Zhang. The specific contribution beyond the summary's description is the exact mechanics of the taxonomy and the methodology used to build it.

How it works

Axis 1 classifies by detection-system class (NIDS, HIDS, IPS, EDR, XDR). Axis 2 classifies blockchain's functional role into four categories, each mapped to a specific blockchain primitive: immutable ledgers → evidentiary/audit logging (L); consensus protocols → decentralized trust (T); token/reputation mechanisms → incentive layers (I); and blockchain-verified model updates → federated-learning integrity assurance (F). Smart contracts are treated separately as the cross-cutting mechanism that implements Axis 3 (response-automation maturity), since a single contract can operationalize any of L/T/I/F depending on what it's attached to. Axis 3 itself has four maturity levels: R0 (detection only), R1 (logged alerting), R2 (triggered mitigation), R3 (closed-loop orchestration). Plotting surveyed systems on these axes visually exposes an empty cell — EDR/XDR crossed with R2/R3 — as the paper's central gap finding.

Preconditions / Affected

Relevant to anyone evaluating or designing blockchain-integrated detection/response architectures who needs a classification scheme to compare systems that are otherwise lumped together under "blockchain-based IDS."

What to do

The paper's methodology is reproducible for literature triage: search terms combined {blockchain, distributed ledger, smart contract} with {intrusion detection, intrusion prevention, EDR, endpoint detection and response, federated learning, IDS} against high-impact venues (IEEE Trans./Journals, ACM Computing Surveys, Computers & Security, etc.) plus 2025–2026 arXiv preprints not yet journal-indexed. Inclusion required blockchain to play a structural (not merely cited) role, with primary function being detection, prevention, or EDR/XDR. A small set of non-blockchain reference systems was included only to anchor baseline comparisons for Axis 3, explicitly excluded from Axis-2 statistics.

flowchart LR
    A[Detection System Class] --> D[Three-Axis Taxonomy]
    B[Blockchain Role: L/T/I/F] --> D
    C[Response Maturity R0-R3] --> D
    D --> E{EDR/XDR x R2/R3}
    E -->|Occupied| F[Mature cell]
    E -->|Empty| G[Research gap]

Caveats

The taxonomy's Axis-2/Axis-3 mapping treats smart contracts as non-exclusive to any one role, which the authors note deliberately breaks the otherwise clean one-to-one correspondence between the four primitives and four functional roles — this is a modeling choice, not an empirical finding.