💻 computer science

BAg-IDS: A Blockchain-Enabled Agentic AI Architecture for Trustworthy Intrusion Detection

BAg-IDS is a distributed, blockchain-enabled architecture that leverages autonomous agents and a calibrated ensemble to co-sign intrusion detection verdicts on a Hyperledger Fabric ledger, achieving near-perfect accuracy (99.98%) and trustworthy certification while incurring a structural consensus latency of approximately 2 seconds.

Original authors: Mohamed Ala Eddine BAHRI, Farah JEMILI, Mohamed MOSBAH

Published 2026-10-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Mohamed Ala Eddine BAHRI, Farah JEMILI, Mohamed MOSBAH

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, security teams rely on automated systems to spot intruders trying to break into computer networks. These systems, known as intrusion detectors, have become incredibly skilled at spotting trouble, often using advanced software that learns from past attacks to recognize new ones. However, a significant problem remains: when these systems spot a threat, they issue a verdict that operators must simply trust. There is no independent witness to confirm the decision, and the digital record of what happened can be altered or deleted by a clever attacker. If the software makes a mistake, or if the computer running it is compromised, the result can be a harmful action taken against a harmless user, or a real attack going unnoticed. The core challenge is building a system that is not only accurate but also trustworthy, where the decision itself is verified by multiple independent parties before any action is taken, and where the record of that decision cannot be tampered with.

A team of researchers has built a new system called BAg-IDS to solve this problem. Instead of relying on a single computer to make the final call, they created a network of autonomous software agents that work together to detect, double-check, and certify every alert. Imagine a security guard who, before locking a door, must get a second opinion from two other independent guards, and then have their agreement written down in a permanent, unchangeable ledger that no one can erase. This is the essence of the new architecture. The system uses a special type of digital ledger, similar to a blockchain, to record every step of the decision-making process. This ensures that if a decision is made to block an attacker, it has been verified by a group of independent agents, and the proof of that agreement is stored in a way that makes it impossible to fake or change later.

The system is designed with a clever division of labor to keep it fast. Most of the time, it runs on a "reflex" path, where it scans network traffic in milliseconds using a team of three different detection models. These models work together to make a single, more reliable decision than any one of them could make alone. If the system is unsure about a piece of traffic, it pauses and asks for a second opinion, rather than guessing. Only when the system is confident that an attack is happening does it move to a slower, more careful stage. In this stage, the alert is sent to a group of independent "notary" agents. Each notary checks the alert on its own and casts a digital vote. The alert is only approved if a majority of the notaries agree. This entire voting process is recorded on the blockchain, creating a permanent, tamper-proof history of who agreed and when.

The researchers tested this system on real-world data sets containing millions of network flows. They found that the system was highly accurate. On one standard test set, the system correctly identified attacks 96.6% of the time across all decisions. More importantly, for the specific alerts that were certified by the group of notaries, the accuracy rose to 99.7%, with a false alarm rate of only 0.04%. This means that when the system says "block this," it is almost certainly right. The system also proved to be resilient against attacks designed to fool it. When the researchers simulated a scenario where one of the detection models was corrupted and started making mistakes, the system automatically reduced the influence of that faulty model. The overall accuracy dropped by only a tiny fraction, showing that the team-based approach protects the system even when one member is compromised.

Another key finding was how the system handles the time it takes to reach a decision. Because the blockchain voting process takes a few seconds, the researchers made sure this step only happens for the alerts that truly matter. The initial scanning happens instantly, but the final, certified decision takes about two seconds per vote. This delay is a structural part of the design, required to ensure that the agreement is genuine and cannot be rushed by a single bad actor. The system handles this by only applying this careful, slow process to the small fraction of traffic that triggers an alarm, while the rest of the traffic flows through at full speed. This balance allows the system to be both fast enough for real-time use and secure enough to be trusted.

The system also includes a human element. A security operator can be brought in to review the most serious alerts before they are acted upon. Crucially, even the human's actions are recorded on the blockchain. If an operator decides to approve a block or change a setting, that decision is signed and stored permanently. This creates a complete audit trail that shows not just what the computer decided, but also what the human decided, making the entire process transparent and accountable. The researchers demonstrated that this full stack of technology—from the fast initial detection to the slow, verified consensus and the human oversight—can run on standard computer hardware, proving that such a secure system is practical for real-world use.

In their tests, the system was also evaluated on a newer, independently generated data set from 2025, which had different characteristics than the older data it was originally trained on. The system adapted well, maintaining an accuracy of 99.98% on the certified alerts. This suggests that the approach is robust and can work with different types of network traffic without needing to be completely rebuilt. The researchers concluded that by combining machine learning with a decentralized voting system and human oversight, it is possible to create an intrusion detection system that is accurate, resistant to corruption, and fully auditable. This work moves beyond simply making detectors smarter; it builds a framework where the trustworthiness of the decision is as important as the decision itself.

Technical Summary: BAg-IDS

Problem Statement

Modern Intrusion Detection Systems (IDS) relying on deep learning face three compounding weaknesses:

Single Point of Trust: Decisions are made by a single model on a single host. If the model is poisoned, incorrect, or the host is compromised, there is no mechanism to prevent harmful automated actions (e.g., blocking legitimate traffic).
Mutable Records: Conventional logs are mutable. After an incident, there is no tamper-evident account of who agreed to a decision or what was detected, creating liability issues in automated response and regulatory contexts.
Fragility to Adversaries: Learned detectors are vulnerable to poisoning attacks that degrade performance silently. Existing defenses often add explicit poisoning detectors, which merely shift the fragility to a new component.

Current research addresses these issues in isolation: blockchain-based IDS provide tamper-evident logs but leave the detection decision to a single unhardened model; agentic AI systems provide reasoning but lack decentralized trust guarantees beneath the reasoning layer. There is a lack of an architecture that unifies detection, trust, and human oversight into a single, measured system.

Methodology

The paper presents BAg-IDS, a Blockchain-Enabled Agentic AI architecture designed to place certification on the decision path rather than in an after-the-fact log. The system is organized into four cooperating layers with a deliberate cost asymmetry:

1. Reflex Detection Layer (Millisecond Scale)

Architecture: A calibrated ensemble of three heterogeneous neural detectors (RNN, CNN, DNN) with distinct inductive biases.
Mechanism:
- Calibration: Temperature scaling is applied to each detector to ensure confidence scores are comparable.
- Conscious Weighted Consensus (CWC): A reliability-weighted fusion strategy where weights are proportional to each detector's recent validation precision. This allows the ensemble to automatically suppress a corrupted detector without explicit attack detection.
- Rejection Gate: A confidence-gated decision rule (threshold $\tau$ ) that outputs one of three verdicts: Benign, Attack, or Rejected. Low-confidence decisions are withheld from automation and routed to drift monitoring.

2. Deliberative Layer (Event-Triggered)

Trigger: Invoked only on salient events (candidate attacks or bursts of rejections).
Mechanism:
- Sentinel (Single-shot): An LLM analyzes the event summary to determine severity and recommend actions (block, rate-limit, etc.).
- Investigator (Agentic): An autonomous agent loop (perceive $\to$ reason $\to$ act $\to$ reflect) that queries the ledger for related incidents to detect coordinated campaigns. Its reasoning trace is anchored on-chain.
- Fallback: Deterministic rule-based logic ensures the system remains autonomous and reproducible if the LLM is unavailable.

3. Consensus Layer (Blockchain)

Platform: Hyperledger Fabric (permissioned blockchain).
Mechanism:
- Notary Agents: Independent agents re-validate the alert's internal consistency (threshold and arg-max) and cast cryptographically signed votes.
- Quorum: A smart contract (validateVote) enforces invariants: authorized signers, valid signatures, no replay (one vote per notary), and a quorum (e.g., 2 of 3).
- Certification: Only upon reaching a quorum is an ALERT_CERTIFIED record sealed on the ledger, authorizing remediation. This ensures no single agent can unilaterally trigger an action.

4. Human-in-the-Loop (HITL) Supervision

Role: Provides a governed, auditable point of control.
Mechanism:
- Governance: Administrative actions (changing thresholds, disabling oversight) are signed and anchored on-chain, making the administrator auditable.
- Approval: In supervised mode, high-severity remediations are held in an approval queue.
- Explainability: For queued flows, the system computes Shapley-value attributions (KernelSHAP) to explain the fused decision, supported by a deterministic recommendation engine and optional LLM narration.

Key Contributions

Agentic Detection Architecture: Places certification on the decision path via a Hyperledger Fabric smart contract. Autonomous agents detect, re-validate, and co-sign every remediation-triggering verdict before action, anchoring even human governance actions on-chain.
Cost-Asymmetric Layering: Enables operational viability by keeping the expensive consensus and deliberation off the per-flow path. Only the small fraction of flows yielding an attack verdict incur the cost of LLM deliberation and on-chain consensus.
Reliability-Weighted Fusion: A fusion mechanism that degrades gracefully under detector corruption. By weighting detectors based on recent calibrated reliability, the ensemble automatically suppresses a corrupted member (weight collapsing from ~0.33 to ~0.01) without explicit poisoning detection.
Complete Measured Evaluation: A full-stack evaluation on commodity hardware, including a structural bound on consensus cost, cross-corpus validation (CICIDS2017 and GeNIS 2025), and a 360-alert benchmark establishing that consensus latency is structurally bound by the ledger's block formation and key-update mechanics.

Results

The system was evaluated on the CICIDS2017 dataset (15 classes, balanced) and the independent GeNIS 2025 corpus (9 classes, natural distribution).

Accuracy:
- CICIDS2017: The calibrated ensemble achieves 96.6% accuracy over all decisions. On the certified subset (87.3% coverage), accuracy rises to 99.7% with a 0.04% false-positive rate (FPR).
- GeNIS 2025: The same stack achieves 99.98% accuracy on the certified subset (99.86% coverage) with a 0.02% FPR.
Corruption Robustness: Under simulated output corruption where the strongest detector (RNN) is fully inverted (0.6% accuracy), the adaptive ensemble retains 96.0% accuracy. The corrupted detector's weight automatically decays from 0.332 to 0.014. Static weights or median pools degrade significantly more (to ~91%).
Consensus Latency:
- The consensus layer adds a structural latency of approximately 2 seconds per vote (dominated by Fabric's block formation, not cryptography).
- Latency grows linearly with the quorum size ( $K$ votes require at least $K$ blocks) due to the "one write per key per block" constraint in optimistic concurrency.
- The reflex path remains unaffected, sustaining 37,524 flows/second on commodity hardware.
Generalization: The architecture transfers unchanged between corpora. The rejection gate adapts its cost to corpus difficulty, deferring 12.7% of flows on the harder CICIDS2017 task but only 0.14% on the easier GeNIS task.

Significance and Claims

The paper claims that BAg-IDS is the first measured system to simultaneously satisfy eight criteria for trustworthy autonomous detection: calibrated ensemble detection, selective classification, corruption robustness, decentralized cryptographic consensus, immutable decision audit, agentic LLM reasoning, governed human oversight, and line-rate viability.

The authors emphasize that the system resolves the "single point of trust" in traditional IDS and the "after-the-fact" nature of blockchain logging by integrating certification directly into the decision path. The significance lies not in a novel fusion algorithm, but in the architectural co-design and empirical validation of a system where detection, trust, and oversight are inseparable. The paper modestly notes that while the results are strong, they are bounded by the specific testbeds used (class-balanced CICIDS2017 and the volumetric bias of GeNIS) and the single-host ledger deployment, acknowledging that validation on live traffic remains the necessary next step.