# From Network Intrusion Detection to Blockchain-Backed Endpoint Detection and Response: Mapping the Landscape of Decentralized Detection-and-Response Architectures

arXiv: https://arxiv.org/abs/2610.01872 · HTML: https://mlsanity.com/paper/2610.01872/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 17 of its 67 references that are in the map.
- First posted on arXiv 1 Oct 2026.

## Builds on (most cited first, 17 of 17)

- [Federated Learning Meets Blockchain in Edge Computing: Opportunities and Challenges](https://mlsanity.com/paper/2104.01776/) (2021)
- [Blockchain Assisted Decentralized Federated Learning (BLADE-FL): Performance Analysis and Resource Allocation](https://mlsanity.com/paper/2101.06905/) (2021)
- [Blockchain for Large Language Model Security and Safety: A Holistic Survey](https://mlsanity.com/paper/2407.20181/) (2024)
- [BC4LLM: Trusted Artificial Intelligence When Blockchain Meets Large Language Models](https://mlsanity.com/paper/2310.06278/) (2023)
- [On Blockchain Architectures for Trust-Based Collaborative Intrusion Detection](https://mlsanity.com/paper/2109.03635/) (2021)
- [Blockchain-based Monitoring for Poison Attack Detection in Decentralized Federated Learning](https://mlsanity.com/paper/2210.02873/) (2022)
- [Federated Learning-Enhanced Blockchain Framework for Privacy-Preserving Intrusion Detection in Industrial IoT](https://mlsanity.com/paper/2505.15376/) (2025)
- [DoS Attacks and Defense Technologies in Blockchain Systems: A Hierarchical Analysis](https://mlsanity.com/paper/2507.22611/) (2025)
- [Collaborative Cybersecurity Using Blockchain: A Survey](https://mlsanity.com/paper/2403.04410/) (2024)
- [A Survey and Comparison of Post-quantum and Quantum Blockchains](https://mlsanity.com/paper/2409.01358/) (2024)
- [Automated Cybersecurity Compliance and Threat Response Using AI, Blockchain & Smart Contracts](https://mlsanity.com/paper/2409.08390/) (2024)
- [CyberNFTs: Conceptualizing a decentralized and reward-driven intrusion detection system with ML](https://mlsanity.com/paper/2409.11409/) (2024)
- [Blockchain Security Risk Assessment in Quantum Era, Migration Strategies and Proactive Defense](https://mlsanity.com/paper/2501.11798/) (2025)
- [Zer0n: An AI-Assisted Vulnerability Discovery and Blockchain-Backed Integrity Framework](https://mlsanity.com/paper/2601.07019/) (2026)
- [Tri-LLM Cooperative Federated Zero-Shot Intrusion Detection with Semantic Disagreement and Trust-Aware Aggregation](https://mlsanity.com/paper/2602.00219/) (2026)
- [Empowering IoT Security: On-Device Intrusion Detection in Resource Constrained Devices](https://mlsanity.com/paper/2605.13159/) (2026)
- [SoK: Federated Learning for Intrusion Detection in Vehicular Networks](https://mlsanity.com/paper/2607.10914/) (2026)

## Abstract (arXiv)

While the literature on blockchain-assisted intrusion detection and prevention systems (IDS/IPS) for Internet of Things (IoT) and Industrial Internet of Things (IIoT) networks is mature, existing systematic reviews suffer from two critical limitations: they overlook the structural shift toward modern Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) architectures, and they conflate blockchain's distinct functional roles into a single monolithic category. This Systematization of Knowledge (SoK) addresses these gaps by proposing a three-axis taxonomy that classifies proposals by detection-system class (NIDS, HIDS, EDR/XDR), blockchain functional role, and response-automation maturity. Synthesizing research published in high-impact venues between 2019 and 2026, we provide a rigorous gap analysis exposing why a genuine per-endpoint blockchain-anchored response loop remains nearly nonexistent due to latency, deployment, and community mismatches. Furthermore, we evaluate structural, cross-cutting challenges persisting across the literature, including consensus latency on constrained devices, post-quantum cryptographic vulnerability, smart-contract attack surfaces, and the adversarial vulnerability of evolving LLM-based detection engines. Finally, we outline a comprehensive research agenda centered on hybrid on-chain/off-chain orchestration to bridge the gap between decentralized trust and rapid response automation.