Distributed network intrusion detection model using blockchain and deep reinforcement learning

Abstract To break through the storage and computing bottlenecks of traditional centralized intrusion detection models in the context of massive network traffic and to improve the identification performance and real-time performance for complex intrusion behaviors, this study designs a distributed Network Intrusion Detection (NID) model based on blockchain and Deep Reinforcement Learning (DRL). The study first clarifies the core functions by performing requirement analysis; these functions include system user management, intrusion detection, data transmission, and display. A distributed architecture based on platforms such as Centos7 and Hadoop 2.8.0 is built by using multiple servers. Python 3.9 combined with PyTorch 2.0 is used as the core development tool; PyCharm community edition is employed to complete the system development, so as to ensure the advancement and compatibility of the development environment. The study constructs a full-process model, which consists of five modules: data collection, preprocessing, storage, intrusion detection, and execution. Flume is adopted to collect network logs and traffic data; secure storage of the full-process data is realized via Hadoop Distributed File System (HDFS). A Proximal Policy Optimization (PPO) algorithm is adopted to construct the DRL model, clearly defining state space, action space, and reward function; meanwhile, it completes intelligent identification and feedback of intrusion behavior. Finally, the KDD99 and CSE-CIC-IDS2018 datasets are simultaneously used to carry out multi-dimensional experimental tests. The results suggest that the model has a detection accuracy >90%, a False Positive Rate (FPR) < 0.5%, and a False Negative Rate (FNR) < 0.7% under data sets (ranging from 0.5 to 200,000). Relative to typical models, it performs superior and has a stable ability to adapt various protocol data, such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). This study enhances the research on the combination of blockchain and reinforcement learning in network security. Thus, it can provide an efficient, trustworthy, and adaptive intrusion detection scheme for distributed networks and effectively elevates the intelligence and reliability of network security protection.