Problem
Research questions and friction points this paper is trying to address.
Blockchain
Endpoint Detection and Response
Intrusion Detection
Internet of Things
Decentralized Architecture
From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures
🤖 AI Summary
This study addresses the limitations of existing surveys that overlook EDR/XDR architectural transformations and conflate the role of blockchain. To this end, it proposes a three-axis taxonomy to systematically review relevant literature from 2019 to 2026. Methodologically, the work integrates consensus mechanisms, smart contract security analysis, and adversarial evaluation techniques for large language models (LLMs) to uncover the underlying causes behind the absence of endpoint-level blockchain response closed loops. The research yields a rigorous gap analysis and outlines a new agenda for hybrid on-chain/off-chain orchestration. Ultimately, it provides clear directions for bridging the divide between decentralized trust and rapid response automation.
📝 Abstract
While the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward modern Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) architectures, and they conflate blockchain's distinct functional roles into a single monolithic category. This Systematization of Knowledge (SoK) addresses these gaps by proposing a three-axis taxonomy that classifies proposals by detection-system class (NIDS, HIDS, EDR/XDR), blockchain functional role, and response-automation maturity. Synthesizing research published in high-impact venues between 2019 and 2026, we provide a rigorous gap analysis exposing why a genuine per-endpoint blockchain-anchored response loop remains nearly nonexistent due to latency, deployment, and community mismatches. Furthermore, we evaluate structural, cross-cutting challenges persisting across the literature, including consensus latency on constrained devices, post-quantum cryptographic vulnerability, smart-contract attack surfaces, and the adversarial vulnerability of evolving LLM-based detection engines. Finally, we outline a comprehensive research agenda centered on hybrid on-chain/off-chain orchestration to bridge the gap between decentralized trust and rapid response automation.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Three-axis taxonomy
EDR/XDR architectures
Blockchain functional role
Hybrid on-chain/off-chain orchestration
Adversarial vulnerability
🔎 Similar Papers
No similar papers found.
