{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T18:09:55Z","timestamp":1789150195906,"version":"build-2803163510"},"reference-count":40,"publisher":"Public Library of Science (PLoS)","issue":"9","license":[{"start":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T00:00:00Z","timestamp":1789084800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Deputyship for Research & Innovation, Ministry of Education in Saudi Arabia","award":["IFP-2022-2026-350"],"award-info":[{"award-number":["IFP-2022-2026-350"]}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>The rapid expansion of digital systems has intensified the complexity of cyber threats, rendering traditional intrusion detection systems (IDS) inadequate against evolving attacks. This study proposes a hybrid IDS (H-IDS) that integrates supervised (SVM, Random Forest, CatBoost, DNN) and unsupervised (Isolation Forest, One-Class SVM, Autoencoder) models within an ensemble framework. Preprocessing employs PCA for dimensionality reduction and SMOTE for class balancing, while weighted voting based on cross-validation F1-scores optimizes ensemble decisions. A lightweight blockchain-inspired hash-chained audit log provides tamper-evident logging of detection events in a single-node deployment without decentralized consensus. Evaluated on NSL-KDD and CIC-IDS2017 datasets, H-IDS achieves 98.85% accuracy (pre-blockchain) and 98.15% (post-blockchain). The ledger operates in a private, single-node setting and introduces minimal local logging overhead and observed reductions in false positives (paired t-test, n\u2009=\u20093, p\u2009&lt;\u20090.05). This work advances trustworthy, auditable, and high-performance intrusion detection for modern network environments.<\/jats:p>","DOI":"10.1371\/journal.pone.0356878","type":"journal-article","created":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T17:37:13Z","timestamp":1789148233000},"page":"e0356878","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing"],"prefix":"10.1371","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0227-7148","authenticated-orcid":true,"given":"Shailendra","family":"Mishra","sequence":"first","affiliation":[{"name":"College of Computer and Information Sciences, Majmaah University","place":["Al Majmaah, Saudi Arabia"],"department":["Department of Computer Engineering"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8749-2583","authenticated-orcid":true,"given":"Reem","family":"Alshenaifi","sequence":"additional","affiliation":[{"name":"College of Computer and Information Sciences, Majmaah University","place":["Al Majmaah, Saudi Arabia"],"department":["Department of Information Technology"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruba Ahmed","family":"Alfahidah","sequence":"additional","affiliation":[{"name":"College of Computer and Information Sciences, Majmaah University","place":["Al Majmaah, Saudi Arabia"],"department":["Department of Information Technology"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,9,11]]},"reference":[{"key":"pone.0356878.ref001","doi-asserted-by":"crossref","first-page":"12229","DOI":"10.1109\/ACCESS.2024.3355547","article-title":"A Comprehensive Survey: Evaluating the Efficiency of Artificial Intelligence and Machine Learning Techniques on Cyber Security Solutions","volume":"12","author":"M Ozkan-Okay","year":"2024","journal-title":"IEEE Access"},{"key":"pone.0356878.ref002","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1016\/j.procs.2022.03.029","article-title":"Intrusion Detection Systems using Supervised Machine Learning Techniques: A survey","volume":"201","author":"EE Abdallah","year":"2022","journal-title":"Procedia Comput Sci"},{"issue":"12","key":"pone.0356878.ref003","doi-asserted-by":"crossref","first-page":"9395","DOI":"10.1016\/j.aej.2022.02.063","article-title":"A machine learning-based intrusion detection for detecting internet of things network attacks","volume":"61","author":"Y Kayode Saheed","year":"2022","journal-title":"Alex Eng J"},{"issue":"1","key":"pone.0356878.ref004","doi-asserted-by":"crossref","DOI":"10.1007\/s10922-021-09615-7","article-title":"Towards Model Generalization for Intrusion Detection: Unsupervised Machine Learning Techniques","volume":"30","author":"M Verkerken","year":"2021","journal-title":"J Netw Syst Manage"},{"key":"pone.0356878.ref005","doi-asserted-by":"crossref","first-page":"104146","DOI":"10.1016\/j.cose.2024.104146","article-title":"A hybrid CNN-LSTM approach for intelligent cyber intrusion detection system","volume":"148","author":"SS Bamber","year":"2025","journal-title":"Comput Secur"},{"issue":"1","key":"pone.0356878.ref006","doi-asserted-by":"crossref","first-page":"1726","DOI":"10.1038\/s41598-025-85866-7","article-title":"Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering","volume":"15","author":"U Ahmed","year":"2025","journal-title":"Sci Rep"},{"key":"pone.0356878.ref007","doi-asserted-by":"crossref","first-page":"111517","DOI":"10.1016\/j.asoc.2024.111517","article-title":"Towards unbalanced multiclass intrusion detection with hybrid sampling methods and ensemble classification","volume":"157","author":"T-T-H Le","year":"2024","journal-title":"Appl Soft Comput J"},{"key":"pone.0356878.ref008","doi-asserted-by":"crossref","unstructured":"Yadavalli R, Polisetti R. Optimized Financial Fraud Detection using SMOTE-Enhanced Ensemble Learning with CatBoost and LightGBM. In: 2025 International Conference on Visual Analytics and Data Visualization (ICVADV). IEEE; 2025. p. 1554\u201362.","DOI":"10.1109\/ICVADV63329.2025.10961683"},{"key":"pone.0356878.ref009","doi-asserted-by":"crossref","first-page":"117995","DOI":"10.1016\/j.eswa.2022.117995","article-title":"Blockchain assisted clustering with Intrusion Detection System for Industrial Internet of Things environment","volume":"207","author":"RF Mansour","year":"2022","journal-title":"Exp Syst Appl"},{"issue":"16","key":"pone.0356878.ref010","doi-asserted-by":"crossref","first-page":"3524","DOI":"10.3390\/electronics12163524","article-title":"Blockchain and Machine Learning-Based Hybrid IDS to Protect Smart Networks and Preserve Privacy","volume":"12","author":"S Mishra","year":"2023","journal-title":"Electronics"},{"key":"pone.0356878.ref011","doi-asserted-by":"crossref","first-page":"108287","DOI":"10.1016\/j.compeleceng.2022.108287","article-title":"Blockchain-based Intrusion Detection System of IoT urban data with device authentication against DDoS attacks","volume":"103","author":"ES Babu","year":"2022","journal-title":"Comput Electr Eng"},{"key":"pone.0356878.ref012","doi-asserted-by":"crossref","first-page":"110941","DOI":"10.1016\/j.knosys.2023.110941","article-title":"A stacking ensemble of deep learning models for IoT intrusion detection","volume":"279","author":"R Lazzarini","year":"2023","journal-title":"Knowl-Based Syst"},{"issue":"12","key":"pone.0356878.ref013","doi-asserted-by":"crossref","first-page":"5568","DOI":"10.3390\/s23125568","article-title":"Ensemble-Learning Framework for Intrusion Detection to Enhance Internet of Things\u2019 Devices Security","volume":"23","author":"Y Alotaibi","year":"2023","journal-title":"Sensors"},{"key":"pone.0356878.ref014","doi-asserted-by":"crossref","first-page":"115524","DOI":"10.1016\/j.eswa.2021.115524","article-title":"A bidirectional LSTM deep learning approach for intrusion detection","volume":"185","author":"Y Imrana","year":"2021","journal-title":"Expert Syst Appl"},{"key":"pone.0356878.ref015","doi-asserted-by":"crossref","DOI":"10.7717\/peerj-cs.327","article-title":"Application of deep autoencoder as an one-class classifier for unsupervised network intrusion detection: a comparative evaluation","volume":"6","author":"T Vaiyapuri","year":"2020","journal-title":"PeerJ Comput Sci"},{"key":"pone.0356878.ref016","doi-asserted-by":"crossref","first-page":"112369","DOI":"10.1016\/j.asoc.2024.112369","article-title":"Deep anomaly detection: A linear one-class SVM approach for high-dimensional and large-scale data","volume":"167","author":"K Suresh","year":"2024","journal-title":"Appl Soft Comput"},{"issue":"5","key":"pone.0356878.ref017","doi-asserted-by":"crossref","first-page":"2658","DOI":"10.1007\/s42235-024-00575-7","article-title":"An Intrusion Detection System on The Internet of Things Using Deep Learning and Multi-objective Enhanced Gorilla Troops Optimizer","volume":"21","author":"H Asgharzadeh","year":"2024","journal-title":"J Bionic Eng"},{"issue":"1","key":"pone.0356878.ref018","doi-asserted-by":"crossref","first-page":"19339","DOI":"10.1038\/s41598-024-70094-2","article-title":"An improved intrusion detection method for IIoT using attention mechanisms, BiGRU, and Inception-CNN","volume":"14","author":"K Yang","year":"2024","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0356878.ref019","doi-asserted-by":"crossref","first-page":"127","DOI":"10.3390\/s24010127","article-title":"Enhancing Network Intrusion Detection Using an Ensemble Voting Classifier for Internet of Things","volume":"24","author":"AH Farooqi","year":"2023","journal-title":"Sensors (Basel)"},{"key":"pone.0356878.ref020","first-page":"316","article-title":"A stacked ensemble approach to detect cyber attacks based on feature selection techniques","volume":"5","author":"WF Urmi","year":"2024","journal-title":"Int J Cogn Comput Eng"},{"key":"pone.0356878.ref021","doi-asserted-by":"crossref","DOI":"10.7717\/peerj-cs.1778","article-title":"A comprehensive secure system enabling healthcare 5.0 using federated learning, intrusion detection and blockchain","volume":"10","author":"J Almalki","year":"2024","journal-title":"PeerJ Comput Sci"},{"key":"pone.0356878.ref022","doi-asserted-by":"crossref","unstructured":"Mohan GB, Sharon KV, Reddy PP, Hemanth Y, Akshay SS, Bhavana B. Anomaly Detection in Blockchain Transactions: A Comparative Study of Isolation Forest, K-Means Clustering, and LSTM Models. In: 2023 IEEE Technology & Engineering Management Conference-Asia Pacific (TEMSCON-ASPAC). IEEE; 2023. p. 1\u20137.","DOI":"10.1109\/TEMSCON-ASPAC59527.2023.10531556"},{"issue":"1","key":"pone.0356878.ref023","doi-asserted-by":"crossref","first-page":"11321","DOI":"10.1038\/s41598-025-95966-z","article-title":"LSTM-JSO framework for privacy preserving adaptive intrusion detection in federated IoT networks","volume":"15","author":"SE Sorour","year":"2025","journal-title":"Sci Rep"},{"key":"pone.0356878.ref024","doi-asserted-by":"crossref","unstructured":"Son DH, Manh BD, Khoa TV, Trung NL, Hoang DT, Minh HT, et al. Semi-Supervised Learning for Anomaly Detection in Blockchain-Based Supply Chains. In: 2024 23rd International Symposium on Communications and Information Technologies (ISCIT). IEEE; 2024. p. 140\u20135.","DOI":"10.1109\/ISCIT63075.2024.10793673"},{"issue":"6","key":"pone.0356878.ref025","article-title":"A hybrid intrusion detection system with K-means and CNN+LSTM","volume":"11","author":"H Lv","year":"2024","journal-title":"ICST Trans Scalable Inf Syst"},{"key":"pone.0356878.ref026","doi-asserted-by":"crossref","first-page":"796","DOI":"10.1016\/j.procs.2023.03.106","article-title":"Feature Selection Using a Combination of Ant Colony Optimization and Random Forest Algorithms Applied To Isolation Forest Based Intrusion Detection System","volume":"220","author":"O Lifandali","year":"2023","journal-title":"Procedia Comput Sci"},{"key":"pone.0356878.ref027","doi-asserted-by":"crossref","first-page":"103868","DOI":"10.1016\/j.jnca.2024.103868","article-title":"Securing SDN: Hybrid autoencoder-random forest for intrusion detection and attack mitigation","volume":"225","author":"L Mhamdi","year":"2024","journal-title":"J Netw Comput Appl"},{"issue":"1","key":"pone.0356878.ref028","first-page":"265","article-title":"Improved Supervised and Unsupervised Metaheuristic-Based Approaches to Detect Intrusion in Various Datasets","volume":"137","author":"O Mjahed","year":"2023","journal-title":"Comput Model Eng Sci"},{"issue":"1","key":"pone.0356878.ref029","doi-asserted-by":"crossref","first-page":"20577","DOI":"10.1038\/s41598-025-06363-5","article-title":"Smart deep learning model for enhanced IoT intrusion detection","volume":"15","author":"FS Alsubaei","year":"2025","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0356878.ref030","article-title":"An Enhanced LSTM Approach for Detecting IoT-Based DDoS Attacks Using Honeypot Data","volume":"18","author":"AKB Arnob","year":"2025","journal-title":"Int J Comput Intell Syst"},{"issue":"1","key":"pone.0356878.ref031","doi-asserted-by":"crossref","first-page":"36520","DOI":"10.1038\/s41598-025-10601-1","article-title":"Privacy preserving blockchain integrated explainable artificial intelligence with two tier optimization for cyber threat detection and mitigation in the internet of things","volume":"15","author":"MA Alohali","year":"2025","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0356878.ref032","doi-asserted-by":"crossref","first-page":"38156","DOI":"10.1038\/s41598-025-22074-3","article-title":"An intrusion detection system in the Internet of Things with deep learning and an improved arithmetic optimization algorithm (AOA) and sine cosine algorithm (SCA)","volume":"15","author":"R Ghadami","year":"2025","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0356878.ref033","doi-asserted-by":"crossref","first-page":"11703","DOI":"10.1038\/s41598-024-62435-y","article-title":"Ensemble technique of intrusion detection for IoT-edge platform","volume":"14","author":"A Aldaej","year":"2024","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0356878.ref034","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1186\/s13638-022-02089-4","article-title":"Hybrid intrusion detection system using blockchain framework","volume":"2022","author":"SR Khonde","year":"2022","journal-title":"J Wireless Com Network"},{"issue":"7","key":"pone.0356878.ref035","doi-asserted-by":"crossref","DOI":"10.1007\/s10586-025-05135-0","article-title":"A hybrid Blockchain-Based framework for securing intrusion detection systems in internet of things","volume":"28","author":"H Nandanwar","year":"2025","journal-title":"Cluster Comput"},{"issue":"10","key":"pone.0356878.ref036","doi-asserted-by":"crossref","first-page":"1695","DOI":"10.3390\/sym12101695","article-title":"SAAE-DNN: Deep Learning Method on Intrusion Detection","volume":"12","author":"C Tang","year":"2020","journal-title":"Symmetry"},{"issue":"1","key":"pone.0356878.ref037","doi-asserted-by":"crossref","first-page":"1005","DOI":"10.1038\/s41598-024-79230-4","article-title":"An intelligent hybrid approach combining fuzzy C-means and the sperm whale algorithm for cyber attack detection in IoT networks","volume":"15","author":"EI Elsedimy","year":"2025","journal-title":"Sci Rep"},{"key":"pone.0356878.ref038"},{"key":"pone.0356878.ref039"},{"issue":"8","key":"pone.0356878.ref040","doi-asserted-by":"crossref","first-page":"524","DOI":"10.1007\/s10586-025-05215-1","article-title":"A blockchain framework for enhancing data security and intrusion detection in the internet of things environment using hybrid deep learning model","volume":"28","author":"S Gautam","year":"2025","journal-title":"Cluster Comput"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0356878","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T17:37:28Z","timestamp":1789148248000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0356878"}},"subtitle":[],"editor":[{"given":"Sohail","family":"Saif","sequence":"first","affiliation":[{"name":"Maulana Abul Kalam Azad University of Technology West Bengal","place":["INDIA"]}],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,9,11]]},"references-count":40,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2026,9,11]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0356878","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,11]]}}}