Main Article Content
Abstract
This paper focuses not on encryption or content access-control policies, but on forensic integrity and tamper-evident logging of sensitive documents. Ensuring confidential documents remain secure in today's digital ecosystems is both a challenge and a trilemma: how to ensure cryptographic integrity, keep the operations of the system available, and respond intelligently and contextually to threats. Current SIEM solutions have high false-positive rates, and no logging solution today provides the forensic integrity essential for automated response processes. This research paper proposes a new Autonomous AI-driven Blockchain Security Lifecycle Architecture and empirically demonstrates 97.64% classification accuracy of 97.64% in a production environment, with the ability to log any modification to sensitive configurations and create a tamper-evident record on the blockchain. Moving beyond simulation-based research, we implement and test the framework on a real-time production server with a 20-core CPU and 48 GB of RAM. The system has a core based on version 30 of Bitcoin Core as an unalterable trust anchor, the Chia Network as a resilient peer-to-peer network to support failover, and Gemma-7b-Instruct Large Language Models (LLMs) that are locally deployed through Ollama to detect contextual anomalies. Wazuh handles telemetry ingestion, while IRIS provides Security Orchestration, Automation, and Response (SOAR) and runs automated playbooks aligned with NIST SP 800-61. Empirical evaluations demonstrate a 97.64% accuracy in detecting attacks, a reduction in Mean Time to Respond (MTTR) of 642.5 s to 16.15 s, and automatic failover to prevent data loss during failure of one of the nodes. Wazuh's File Integrity Monitoring (FIM) is a framework tested for 90 days that has achieved 97.64% accuracy in identifying whether a file change is legitimate or suspicious. Additionally, using a local LLM reduces false positives by 86.5% compared to rule-based baselines, making it a promising approach for privacy-preserving self-healing cybersecurity models.
Keywords
Article Details
References
- S. Tariq, M. B. Chhetri, S. Nepal, and C. Paris, “Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities,” ACM Computing Surveys, vol. 57, no. 9, p. 3723158, 2025, doi: 10.1145/3723158.
- J. Croman, C. Decker, I. Eyal, A. E. Gencer, R. Mahjoub, P. Tseng, and A. Juels, “On Scaling Decentralized Blockchains,” in Financial Cryptography and Data Security (FC 2016), Berlin, Heidelberg: Springer, 2016, pp. 106–125, doi: 10.1007/978-3-662-53357-4_8.
- A. Ali, A. Khan, M. Ahmed, and G. Jeon, “BCALS: Blockchain-based secure log management system for cloud computing,” Transactions on Emerging Telecommunications Technologies, vol. 33, no. 4, p. e4272, 2022, doi: 10.1002/ett.4272.
- L. Shekhtman and E. Waisbard, “EngraveChain: A blockchain-based tamper-proof distributed log system,” Future Internet, vol. 13, no. 6, p. 143, 2021, doi: 10.3390/fi13060143.
- M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, and M. Guizani, “A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1646–1685, 2020, doi: 10.1109/COMST.2020.2988293.
- National Institute of Standards and Technology, “Computer Security Incident Handling Guide,” NIST Special Publication 800-61 Revision 2, Gaithersburg, MD, USA, Aug. 2012. [Online]. Available: https://csrc.nist.gov/pubs/sp/800/61/r2/final
- Center for Internet Security, “CIS Ubuntu Linux 22.04 LTS Benchmark,” CIS Benchmarks, v2.0.0, 2024. [Online]. Available: https://www.cisecurity.org/benchmark/ubuntu_linux
- N. U.S. Department of Commerce, “Federal Information Processing Standards Publication 140-3,” 2019. https://csrc.nist.gov/pubs/fips/140-3/final
- National Institute of Standards and Technology, “Security Requirements for Cryptographic Modules,” Federal Information Processing Standards Publication 140-3, Gaithersburg, MD, USA, Mar. 2019. [Online]. Available: https://csrc.nist.gov/pubs/fips/140-3/final
- National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” NIST Artificial Intelligence Risk Management Framework, Gaithersburg, MD, USA, Jan. 2023. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
- M. Ismail, T. Aljohani, and S. Alshammari, “Enhancing Security Operations Center: Wazuh Security Event Response with Retrieval-Augmented-Generation-Driven Copilot,” Sensors, vol. 25, no. 3, p. 870, 2025, doi: 10.3390/s25030870.
- X. Han, S. Yuan, and M. Trabelsi, “LogGPT: Log Anomaly Detection via GPT,” in 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy: IEEE, 2023, pp. 1117–1122, doi: 10.1109/BigData59044.2023.10386543.
- B. Gipp, N. Meuschke, and A. Gernandt, “Decentralized Trusted Timestamping using the Crypto Currency Bitcoin,” pp. 1–6, 2015, [Online]. Available: http://arxiv.org/abs/1502.04015
- J. D. Morillo Reina and T. J. Mateo Sanguino, “Decentralized and Secure Blockchain Solution for Tamper-Proof Logging Events,” Future Internet, vol. 17, no. 3, 2025, doi: 10.3390/fi17030108.
- M. S. Islam and M. S. Rahman, “LogStamping: A blockchain-based log auditing approach for large-scale systems,” arXiv:2505.17236, 2025. [Online]. Available: https://arxiv.org/abs/2505.17236
- M. Akbari Gurabi, L. Nitz, R.-M. Castravet, R. Matzutt, A. Mandal, and S. Decker, “From Legacy to Standard: LLM-Assisted Transformation of Cybersecurity Playbooks into CACAO Format,” arXiv preprint arXiv:2508.03342, 2025. [Online]. Available: https://arxiv.org/abs/2508.03342
- K. Venkatesan and S. B. Rahayu, “Blockchain security enhancement: An approach towards hybrid consensus algorithms and machine learning techniques,” Scientific Reports, vol. 14, no. 1, p. 1578, 2024, doi: 10.1038/s41598-024-51578-7.
- R. Choi, Y. Song, M. Jang, T. Kim, J. Ahn, and D. Im, “Smart Contract Vulnerability Detection Using Large Language Models and Graph Structural Analysis,” Computers, Materials & Continua, 2025, doi: 10.32604/cmc.2025.061185.
- Q. Liu, M. Wu, and J. Chen et al., “Exploring the potential of ChatGPT in detecting logical vulnerabilities in smart contracts,” Blockchain: Research and Applications, vol. 6, no. 4, p. 100294, 2025, doi: 10.1016/j.bcra.2025.100294.
- A. Gupta, V. Krishnamurthy, and B. M. Sadler, “Eclipse Attack Detection on a Blockchain Network as a Non-Parametric Change Detection Problem,” arXiv:2404.00538, 2024. [Online]. Available: http://arxiv.org/abs/2404.00538
- G. Xu, B. Guo, C. Su, X. Zheng, K. Liang, D. S. Wong, and H. Wang, “Am I eclipsed? A smart detector of eclipse attacks for Ethereum,” Computers & Security, vol. 88, 2020, doi: 10.1016/j.cose.2019.101604.
- Bitcoin Core Developers, “Bitcoin Core v30.0-rc3 Release Candidate,” GitHub, Oct. 2025. [Online]. Available: https://github.com/bitcoin/bitcoin/releases/tag/v30.0rc3
- Chia Network Inc., “Chia Technical Whitepaper: Proof of Space and Time,” 2023. [Online]. Available: https://www.chia.net/whitepaper/
- Wazuh Inc., “Wazuh Documentation v4.14.1,” 2024. [Online]. Available: https://documentation.wazuh.com/current/
- Google DeepMind, “Gemma: Open Models Based on Gemini Technology and Research,” 2024. [Online]. Available: https://ai.google.dev/gemma/docs/model_card
- Ollama Team, “Ollama Documentation v0.3.14,” 2024. [Online]. Available: https://ollama.com/docs
- “IRIS Community, ‘IRIS: Incident Response & Investigation System,’ GitHub Repository, 2024.” [Online]. Available: https://github.com/dfir-iris/iris-web
- N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” 2015 Military Communications and Information Systems Conference, MilCIS 2015 - Proceedings, 2015, doi: 10.1109/MilCIS.2015.7348942.
- J. F. Ferreira, P. Cruz, T. Durieux, and R. Abreu, “SmartBugs: A framework to analyze solidity smart contracts,” in 2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), Melbourne, VIC, Australia: IEEE, 2020, pp. 1349–1352, doi: 10.1145/3324884.3415298.
References
S. Tariq, M. B. Chhetri, S. Nepal, and C. Paris, “Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities,” ACM Computing Surveys, vol. 57, no. 9, p. 3723158, 2025, doi: 10.1145/3723158.
J. Croman, C. Decker, I. Eyal, A. E. Gencer, R. Mahjoub, P. Tseng, and A. Juels, “On Scaling Decentralized Blockchains,” in Financial Cryptography and Data Security (FC 2016), Berlin, Heidelberg: Springer, 2016, pp. 106–125, doi: 10.1007/978-3-662-53357-4_8.
A. Ali, A. Khan, M. Ahmed, and G. Jeon, “BCALS: Blockchain-based secure log management system for cloud computing,” Transactions on Emerging Telecommunications Technologies, vol. 33, no. 4, p. e4272, 2022, doi: 10.1002/ett.4272.
L. Shekhtman and E. Waisbard, “EngraveChain: A blockchain-based tamper-proof distributed log system,” Future Internet, vol. 13, no. 6, p. 143, 2021, doi: 10.3390/fi13060143.
M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, and M. Guizani, “A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1646–1685, 2020, doi: 10.1109/COMST.2020.2988293.
National Institute of Standards and Technology, “Computer Security Incident Handling Guide,” NIST Special Publication 800-61 Revision 2, Gaithersburg, MD, USA, Aug. 2012. [Online]. Available: https://csrc.nist.gov/pubs/sp/800/61/r2/final
Center for Internet Security, “CIS Ubuntu Linux 22.04 LTS Benchmark,” CIS Benchmarks, v2.0.0, 2024. [Online]. Available: https://www.cisecurity.org/benchmark/ubuntu_linux
N. U.S. Department of Commerce, “Federal Information Processing Standards Publication 140-3,” 2019. https://csrc.nist.gov/pubs/fips/140-3/final
National Institute of Standards and Technology, “Security Requirements for Cryptographic Modules,” Federal Information Processing Standards Publication 140-3, Gaithersburg, MD, USA, Mar. 2019. [Online]. Available: https://csrc.nist.gov/pubs/fips/140-3/final
National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” NIST Artificial Intelligence Risk Management Framework, Gaithersburg, MD, USA, Jan. 2023. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
M. Ismail, T. Aljohani, and S. Alshammari, “Enhancing Security Operations Center: Wazuh Security Event Response with Retrieval-Augmented-Generation-Driven Copilot,” Sensors, vol. 25, no. 3, p. 870, 2025, doi: 10.3390/s25030870.
X. Han, S. Yuan, and M. Trabelsi, “LogGPT: Log Anomaly Detection via GPT,” in 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy: IEEE, 2023, pp. 1117–1122, doi: 10.1109/BigData59044.2023.10386543.
B. Gipp, N. Meuschke, and A. Gernandt, “Decentralized Trusted Timestamping using the Crypto Currency Bitcoin,” pp. 1–6, 2015, [Online]. Available: http://arxiv.org/abs/1502.04015
J. D. Morillo Reina and T. J. Mateo Sanguino, “Decentralized and Secure Blockchain Solution for Tamper-Proof Logging Events,” Future Internet, vol. 17, no. 3, 2025, doi: 10.3390/fi17030108.
M. S. Islam and M. S. Rahman, “LogStamping: A blockchain-based log auditing approach for large-scale systems,” arXiv:2505.17236, 2025. [Online]. Available: https://arxiv.org/abs/2505.17236
M. Akbari Gurabi, L. Nitz, R.-M. Castravet, R. Matzutt, A. Mandal, and S. Decker, “From Legacy to Standard: LLM-Assisted Transformation of Cybersecurity Playbooks into CACAO Format,” arXiv preprint arXiv:2508.03342, 2025. [Online]. Available: https://arxiv.org/abs/2508.03342
K. Venkatesan and S. B. Rahayu, “Blockchain security enhancement: An approach towards hybrid consensus algorithms and machine learning techniques,” Scientific Reports, vol. 14, no. 1, p. 1578, 2024, doi: 10.1038/s41598-024-51578-7.
R. Choi, Y. Song, M. Jang, T. Kim, J. Ahn, and D. Im, “Smart Contract Vulnerability Detection Using Large Language Models and Graph Structural Analysis,” Computers, Materials & Continua, 2025, doi: 10.32604/cmc.2025.061185.
Q. Liu, M. Wu, and J. Chen et al., “Exploring the potential of ChatGPT in detecting logical vulnerabilities in smart contracts,” Blockchain: Research and Applications, vol. 6, no. 4, p. 100294, 2025, doi: 10.1016/j.bcra.2025.100294.
A. Gupta, V. Krishnamurthy, and B. M. Sadler, “Eclipse Attack Detection on a Blockchain Network as a Non-Parametric Change Detection Problem,” arXiv:2404.00538, 2024. [Online]. Available: http://arxiv.org/abs/2404.00538
G. Xu, B. Guo, C. Su, X. Zheng, K. Liang, D. S. Wong, and H. Wang, “Am I eclipsed? A smart detector of eclipse attacks for Ethereum,” Computers & Security, vol. 88, 2020, doi: 10.1016/j.cose.2019.101604.
Bitcoin Core Developers, “Bitcoin Core v30.0-rc3 Release Candidate,” GitHub, Oct. 2025. [Online]. Available: https://github.com/bitcoin/bitcoin/releases/tag/v30.0rc3
Chia Network Inc., “Chia Technical Whitepaper: Proof of Space and Time,” 2023. [Online]. Available: https://www.chia.net/whitepaper/
Wazuh Inc., “Wazuh Documentation v4.14.1,” 2024. [Online]. Available: https://documentation.wazuh.com/current/
Google DeepMind, “Gemma: Open Models Based on Gemini Technology and Research,” 2024. [Online]. Available: https://ai.google.dev/gemma/docs/model_card
Ollama Team, “Ollama Documentation v0.3.14,” 2024. [Online]. Available: https://ollama.com/docs
“IRIS Community, ‘IRIS: Incident Response & Investigation System,’ GitHub Repository, 2024.” [Online]. Available: https://github.com/dfir-iris/iris-web
N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” 2015 Military Communications and Information Systems Conference, MilCIS 2015 - Proceedings, 2015, doi: 10.1109/MilCIS.2015.7348942.
J. F. Ferreira, P. Cruz, T. Durieux, and R. Abreu, “SmartBugs: A framework to analyze solidity smart contracts,” in 2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), Melbourne, VIC, Australia: IEEE, 2020, pp. 1349–1352, doi: 10.1145/3324884.3415298.