ChainShieldML an intelligent decentralized security framework for next generation wireless sensor networks

Abstract

Wireless sensor networks (WSNs) will be necessary for the next generation of Internet of Things (IoT) apps. They make it possible to use smart and long-lasting sensors and smart automation in healthcare, Industry 4.0, and critical infrastructure. But security is particularly hard since they have built-in flaws, not enough computer power, not enough energy, and a significant danger of insider threats. Standard encryption methods aren’t enough, and in situations where resources are restricted, heavier blockchain or machine learning solutions aren’t always possible. This study presents ChainShieldML, a lightweight hybrid security architecture that combines Blockchain (BC) and machine learning (ML) to provide decentralised, adaptive, and resource-efficient protection for wireless sensor networks (WSNs). The idea is based on a two-pronged defence strategy. The Blockchain Prevention Module’s permissionless blockchain architecture for base stations and cluster heads makes it possible to verify identities, maintain trust in a decentralised way, and keep node interactions unchangeable. Smart contracts made in solidity and connected to the Ethereum ecosystem make it possible to safely register nodes and keep an eye on what they do. The VBFT consensus algorithm makes it possible to quickly validate without using as much computing power as most proof of work methods. The machine learning detection module uses the lightweight gradient boosting method (LightGBM) to find and rank dangerous nodes in real time. LightGBM is the best machine learning classifier when looking at things like recall, F1-score, Matthews correlation coefficient, training cost, and inference latency. ChainShieldML dramatically improves the detection of insider attacks, builds trust, and protects data while using very little energy and having very little communication delay, as shown in tests. For Wireless sensor networks (WSNs) to keep working, all of these things are very important. ChainShieldML is a novel solution to keep IoT devices safe. It uses blockchain’s decentralised trust and ML’s adaptive intelligence to make a defence system for next-generation wireless sensor networks that can grow, is strong, and is ready for the future.

Introduction

The security of the Internet of Things (IoT) is a significant subject garnering much attention from scholars and industry professionals. Reference¹ The extensive deployment of IoT devices facilitates innovative smart cities, industrial automation, healthcare and transportation services. However, the swift expansion of IoT ecosystems has resulted in the introduction of novel security and privacy vulnerabilities. IoT systems rely on wireless sensor networks (WSNs) to gather and exchange data². However, WSNs are very easy to attack because they are open to everyone, have limited resources, and are used in dangerous places. Some cyber-attacks that may occur include data manipulation, node compromise, Sybil attacks and insider threats³. Therefore, detecting and preventing malicious behavior in these networks is crucial⁴. Traditional IoT security systems depend highly on centralized control or third-party trust authority, making them easy to break. When these centralised entities are hacked, the whole network is at risk of being disrupted. Also, traditional cryptographic methods and complex security frameworks do not work for sensor nodes with limited resources because they use much processing power, time, and energy⁵. These limits necessitate lightweight and decentralized systems capable of operating within the strict confines of WSNs while providing solid security.

The combination of Blockchain (BC) and machine learning (ML) has become a viable way to solve IoT security problems in recent years⁶. Blockchain is a good way to manage trust and limit access because it is unchangeable, decentralised, and resistant to tampering⁷. Malevolent parties cannot change or delete data once data is added to the blockchain ledger⁸. This plan makes sure that the data is correct and can be traced. Machine learning makes it possible to look at data streams from IoT devices in real time, which makes it easier to find problems and strange activity⁹.

Blockchain technology and machine learning synergistically enhance security due to their complementary functionalities. This method can be utilised to integrate many levels of security into wireless sensor networks (WSNs). The utilisation of BC-ML to enhance the security of the Internet of Things is still in its infancy, albeit it shows potential. Many current studies fail to include challenges unique to wireless sensor networks (WSNs), like limited energy, processing capacity and susceptibility to delays. They concentrate on broader security concerns pertaining to the Internet of Things (IoT)^10,11. Additionally, insider attacks are still poorly understood, even though they are one of the most serious risks since they use compromised nodes to carry out stealthy, destructive activities. This gap shows a need for a lightweight, hybrid security architecture that uses BC and ML in a way made explicitly for IoT sensor networks with limited resources¹². We suggest ChainShieldML to close this gap. It is a decentralised and innovative security architecture for next-generation WSNs. The framework adds a dual-line defence system that combines blockchain-based prevention with machine learning-based detection.

Module for blockchain prevention

• Lightweight smart contracts are used in this module to ensure identification and trust are maintained.

• Only authentic and validated nodes can join the network thanks to identity management. In contrast, trust management assigns each node a trust score (TS) according to its behaviour¹³.

• Base stations (BS) and Cluster heads (CHs) use permissionless blockchains to record node identity and trust.

• VBFT consensus reduces transaction costs and time compared to PoW. This makes it a better option for WSNs¹⁴.

Module for detecting machine learning

When the blockchain discovers suspicious nodes by lowering their trust score, the ML module examines traffic patterns for anomalous activities.

• The effectiveness of pre-built supervised machine learning classifiers, such as LightGBM, LR, CompNB, NC and Stacking, is examined¹⁵.

• Accuracy, precision, recall, F1-score, Matthews correlation coefficient, processing time, training length and prediction delay are compared.

• NC is faster, but LightGBM improves detection, precision, recall and F1-score. This study suggests LightGBM for detection.

• A malicious node is immediately removed from the blockchain network when the identity management contract updates its registration status¹⁶.

ChainShieldML protects WSNs from when nodes are deployed until the network is no longer in use with this two-tier defence mechanism^17,18. Blockchain creates decentralised trust and protection against tampering, while machine learning allows computers to learn and adapt to find insider risks in real time^4,19. Importantly, these modules are designed to be lightweight and resource-aware so that they will function within sensor networks’ energy and computing limits.

Table 1 shows how the proposed framework will help, linking each module to the methods it will use and essential notes. These new ideas work together to build a scalable, durable, and practical security solution for next-generation IoT sensor networks.

Table 1.

Innovative mapping of ChainShieldML security modules with methods and advantages.

Framework layer	Innovation introduced	Technique/method	Distinctive advantage
Blockchain prevention	Decentralized identity management	Lightweight smart contract (solidity)	Eliminates central authority; ensures tamper-proof registration and secure revocation
	Trust-aware node evaluation	Lightweight trust management smart contract	Dynamically computes a Trust Score (TS) to track credibility across the network lifetime
	Energy-efficient consensus	VBFT (compared against PoW)	Reduces latency and transaction cost; optimized for resource-constrained WSN environments
Machine learning detection	Adaptive malicious node detection	Comparative study: LightGBM, LR, CompNB, NC, Stacking	LightGBM yields optimal outcomes for accuracy, precision, recall, and F1-score, while NC offers the fastest execution time.
	Blockchain–ML co-defense integration	The interaction between the ML classifier and the BC trust function	Facilitates the continuous adaptation of network defences by promptly eliminating potentially dangerous user IDs.

Research gaps

• Low-power WSN nodes may have difficulties with blockchain and machine learning due to their energy consumption, which can impede performance.

• We have not yet tested its efficacy in extensive sensor networks comprising thousands of nodes.

• Emerging or malevolent attack patterns may exceed the capabilities of the existing machine learning model, necessitating adaptive security measures.

• VBFT is less burdensome than PoW; yet, IoT requires more robust mechanisms for achieving agreement.

• Why data privacy is inadequately addressed until trust and integrity are prioritised.

• No studies have been conducted on the application of diversity in Internet of Things (IoT) contexts outside Wireless Sensor Networks (WSNs). • Real-world validation: it has not been evaluated on actual WSN testbeds to assess its efficacy.

Novelty of the proposed approach

• Dual-layer defence: Prior systems employed blockchain for authentication and trust management to thwart assaults effectively. This method use machine learning to detect insider threats as they occur in real time.

• Lightweight design: It is suitable for resource-constrained WSNs because of VBFT consensus (low-cost, low-latency) and LightGBM (fast, accurate, minimal complexity).

• Decentralised trust: Smart contracts ensure that identity verification, trust evaluation, and accountability are all safe against tampering without relying on central authorities.

• Insider attack resilience: This is a less-studied but significant security problem focusing on finding and stopping bad nodes in the network.

• Self-adaptive integration: The findings of ML detection are written back to the blockchain, establishing a feedback loop that makes the network always safer.

Related work

Recent studies have integrated blockchain and machine learning to enhance the security of IoT and wireless sensor networks. Researchers have utilised this integration to look at safe routing, authentication, attack localisation, malicious node detection and trust management²⁰. These studies illustrate the possibility of integrating the distributed immutability of blockchain with the predictive and adaptive intelligence of machine learning; nevertheless, their applicability in lightweight, resource-constrained sensor networks is still an unresolved issue (Table 2).

Table 2.

Comparative summary of BC–ML integrated approaches for IoT-WSN security.

Study/Ref.	Security focus	BC role	ML/DL technique	Key contributions	Limitations
Yang et al.24	Secure routing	PoA-BC for recording routing info via token contracts	Reinforcement Learning (RL)	Reduced avg. packet delay by 81%; dynamic trusted route selection	Limited to routing; lacks malicious node handling
Revanesh et al.25	Trusted routing	BC-based salp swarm optimisation	DL-CNN	Optimised routing link selection; improved packet delivery	High computational complexity; energy-intensive
Wazirali et al.26	Validator selection & routing	PoA-SC with DL validator selection	CNN-based DL	Pre-selected validators reduced latency and improved throughput	Narrow focus on validator layer; limited adaptability
Quincozes14	Routing & IDS	BC-integrated GAN-IDS	FDGAN-DL	Enhanced routing security and intrusion detection	Heavy DL processing overhead
Our work	Identity & Insider threat detection	Hybrid BC for ID management	Naïve Bayes (NB)	Mitigated insider DoS attacks on CH nodes	No pre-registration/authentication; partial coverage
Nouman et al.22	Identity & Routing security	PoA for routing transactions	GA-SVM, GA-DT	99.72% packet delivery; efficient malicious node isolation	Focused only on routing; GA-DT less accurate
Arifeen et al.27	Node authentication & DoS detection	VBFT-BC + IPFS for data chunks	HGB Classifier	98% precision; reduced transaction cost vs. PoW	No record of historical node behaviours
Gebremariam et al.9	Sybil attack detection	BC-based trust reference	HMM	Computed trust values; Sybil detection in UWSN	Limited to underwater WSN scenarios
Goyal et al.13	Attack Localisation & Trust	BC + Hybrid FL + Cascade Encryption	Hybrid FL	Large-scale WSN security; localisation + trust management	DL/FL demand heavy computation & large datasets

BlockchainML integration for secure routing in IoTWSNs

One of the most significant problems with IoT-enabled WSNs is routing, which is both safe and effective. Malicious actors can use selective forwarding, sinkhole, and blackhole attacks to stop connectivity. To tackle this issue, researchers have increasingly adopted hybrid blockchain (BC) and machine learning (ML) methodologies that guarantee reliability and adaptability in routing decisions. The token-based smart contracts and registration system²¹ securely record routing information via a Proof-of-Authority (PoA) blockchain. Reinforcement learning (RL) was used to dynamically identify trustworthy routes based on queue length, reducing average packet delay by 81% compared to conventional routing protocols. In addition, Salp swarm optimisation (SSO) with DL-CNN²² optimised routing link selection, strengthening blockchain-based routing reliability. A PoA-DL hybrid consensus protocol²³ reduced latency and improved throughput by selecting validators via deep CNN models. A new protocol called GBCRP¹⁴ combined federated deep generative adversarial networks (FDGANs), intrusion detection systems (IDS), and blockchain to make routing safer. The GAN component detected anomalous routing patterns, IDS ensured packet integrity, and BC secured logs against tampering. Together, these works show that blockchain makes routing information more reliable, while machine learning adapts to new threats.

Detection of malicious nodes using blockchain and machine learning methods

Another important area of research is finding faulty nodes that mess up how WSN works. We previously examined a hybrid blockchain approach for identity management, using a Naïve Bayes (NB) detection module to mitigate insider DoS attacks on cluster chiefs²⁸. It worked well, however it didn’t have a good way to register nodes. The isolated forest (iForest) method was used to construct an anomaly detection model for high-dimensional IoT data¹⁰. Blockchain technology keeps detection models safe by keeping them as trees that can’t be changed.Still, it makes behavioural monitoring more difficult because it doesn’t keep track of detection outcomes. A study²⁹ put forward a solution for identity management and secure routing through the use of GA. After the cancellation of blockchain registration, GA-SVM showed better performance in finding rogue nodes and had a packet delivery rate of 99.72%. In the same way²⁵, used the VBFT blockchain to verify and register nodes and histogram-based gradient boosting (HGB) to find denial-of-service attacks. IPFS kept node data hashed into blockchain records with more than 98% accuracy, however it didn’t keep track of past behavior³⁰. The text is blue. These experiments show that machine learning can help classify bad behaviour in a way that changes over time, and blockchain can help keep identities safe.

Blockchain and ML for managing trust

Trust management is essential in decentralised WSNs, as insider threats often arise from compromised nodes^4,31. A blockchain-based trust model³² combined Hidden Markov models (HMMs) with blockchain to detect Sybil attacks in underwater WSNs. Trust scores were stored immutably on-chain, restricting network access to genuine nodes. ^19,33 extended this with a hybrid BC-ML framework using federated learning (FL) and cascade encryption for large-scale deployments. Trust scores were decentralised and validated via blockchain, making the system resilient. However, FL’s communication overhead challenges resource-constrained IoT deployments. These results show BC-ML trust management monitors behaviour to flag compromised insiders early.

Using blockchain ML to find attack source

BC-ML integration has also been used for attack localisation³⁴ built a blockchain-hybrid FL system that combined cascade encryption with ML-based traffic analysis. Blockchain logged localisation results immutably, enabling culprits to be traced and punished³⁵. This reduced collateral damage and improved resilience by segregating compromised nodes³⁶. While promising, deep learning components in FL increased computational costs, making deployment difficult in constrained WSNs. Research on BC-ML attack localisation is still in its infancy, particularly in critical domains such as smart cities and defence networks²⁴.

Ideas for lightweight BC ML security in IoT WSNs

Secure routing, detection of malicious nodes, management of trust, and localisation of attacks are some of the areas where the aforementioned research demonstrates the potential of BC-ML integration in IoT-WSN security^17,37. On the other hand, significant blockchain communication overhead and high computation from deep learning remain two obstacles. While methods like as PoA consensus, VBFT, and IPFS do help to lower overhead, the majority of frameworks still face challenges when trying to strike a compromise between efficiency and security^18,38. Instead of using resource-intensive DL models, our solution, ChainShieldML, uses lightweight ML classifiers like LightGBM, Naïve Bayes, and Logistic Regression to expand upon these discoveries. Training and inference costs are reduced as a result. To reduce the amount of gas used for authentication and trust evaluation, we suggest using lightweight smart contracts. ChainShieldML creates a balance between security and efficiency by combining the unchanging nature of blockchain with the power of machine learning to adapt to new situations.

Dual-layer defense framework: blockchain–ML integration

The proposed dual-layer defensive system, which employs LightGBM for anomaly detection in the Internet of Things and VBFT consensus for trust management in blockchain, represents a tiny but significant advancement. It improves system security and efficiency while lowering processing costs. This is beneficial in resource-constrained IoT and WSN applications. The essential premise of dual-layer defence is shown in Fig. 1. It shows how the blockchain-based trust and machine learning-based detection modules work together. This graphic shows how ChainShieldML’s two levels work together. We will demonstrate LightGBM anomaly detection and VBFT trust management. The proposed framework for improving IoT security is shown to be effective, useful, and strong by this visual and the organised input. Centralised IoT.

Fig. 1.

Schematic overview of thdefencelayer defense in ChainShieldML.

Proposed ChainShieldML framework

ChainShieldML secures hierarchical cluster wireless sensor networks (WSNs) in the Internet of Things in an innovative and dependable manner. This technique employs blockchain and machine learning. ChainShieldML operates on an autonomous, decentralised blockchain. This spreads confidence, permanence, and resilience. This approach is more reliable than flaw-prone centralised systems. A simple machine learning detection module eliminates rogue nodes for blockchain security. This technique is useful for Internet of Things applications that have limited resources. Security, efficiency, and scalability are achieved without overloading processing or transmission resources. The Blockchain Prevention Module maintains consensus, identification and trust. The machine learning detection module identifies hostile insider nodes based on their activity patterns to provide reactive security. Figure 2 depicts the ChainShieldML framework. Permissionless blockchains enable communication among base stations, cluster nodes, monitors and attacker nodes. The ML detection module preprocesses WSN data, selects features, trains a classifier and detects anomalies. On the left, the blockchain governs trust and legitimacy. Smart contracts manage identity and trust, offer immutable data, eliminate hostile nodes, authenticate VBFT consensus interactions, and minimise hazards via the Blockchain Prevention Module. This decentralised, flexible, and resource-efficient dual-layer method combats internal threats. Blockchain-based prevention and machine learning-based detection help to secure networks.

Fig. 2.

Overview of the ChainShieldML security architecture for WSNs.

Blockchain technology’s prevention module

The blockchain technology prevention module is the system’s major defence. It emphasises prevention. Node registration, authentication, trust evaluation, and transaction validation are all secure. Verifiable byzantine fault tolerance (VBFT) consensus authenticates all transactions before they are included in the distributed ledger. This reduces the likelihood of excessive electrical accumulation in a single spot while increasing people’s perception of safety.

Identity management

Identity management makes sure that only allowed nodes can join to the network. A smart contract (SC) is in charge of registering and validating sensor nodes (SN). The SC gives each registered node a unique name that is only for that node as soon as it is registered:

• Sensor node ID (SN_id), password (SN_password),

• Cluster head ID (CH_id),

• Base station ID (BS_id),

• Timestamp (SN_time).

And the SC has significant jobs:

1. RegisterNode() adds a network node.

2. AuthNode() verifies a node’s identity during a transaction or communication.

3. RevokeNode() removes dangerous or untrustworthy nodes.

4. InfoNode() provides node metadata.

5. TotalNode() counts registered and working nodes.

This distributed authentication approach eliminates a single point of failure, making impersonation and unauthorized access more difficult.

Managing trust

Ensuring the safety of nodes and users are the respective responsibilities of identity management and trust management. Every node will be given a trust score (TS) via a trust management smart contract according to these standards:

• Transmission success score (TSS): This score evaluates the degree to which data is successfully delivered on a consistent basis.

• Packet sending rate (PSR): Identifies the frequency and consistency with which data is sent.

• Packet forwarding rate (PFR): Provides information regarding the dependability of intermediary nodes in multi-hop communication chains.

• Forwarding delay (FD): Measures the amount of time it takes to send packets forward.

• Energy consumption awareness (ECA): Evaluates the effectiveness with which a node makes use of the energy that it has stored.

Each node has a TrustCard that displays its trust score, energy metrics, and overall status. Lower trust scores alert the Machine Learning Detection Module to malicious nodes. The node cannot join the blockchain network if malicious behaviour is proven.

VBFT consensus

To secure WSNs built on the blockchain, consensus validation is essential. The following parts are integrated into the VBFT mechanism:

• Verifiable random function (VRF): Ensures that the selection of nodes for consensus is fair and random,

• Byzantine fault tolerance (BFT): Makes it possible for the system to keep running even if a third of the nodes act maliciously,

• Proof of stake (PoS): Takes less power and is more scalable than old Proof of Work (PoW) systems.

This combined method guarantees energy-efficient operation in resource-constrained IoT networks, expedites block confirmation and strengthens resilience against collusion assaults.

The machine learning module

There are a lot of documented machine learning (ML) methods. For our detection module, we evaluate a number of ML algorithms that are currently on the market. Methods like LightGBM, LR, CompNB, NC and Stacking are employed to evaluate performance.

Light gradient boosting machine (LightGBM)

LightGBM enhances GBDT³⁸. It offers precise results with minimal memory and training. In LightGBM, trees are grown leaf-wise, selecting the leaf with the greatest loss²⁶. Using GOSS and EFB, it excels at handling imbalanced datasets³⁹.

The goal function of gradient boosting is

1

is a convex loss function, and represents the predicted output. Definition of the regularisation phrase:

2

The complexity penalty is determined by , the number of leaves in the tree is , and the leaf weights are .

By adding together all of the trees, the predicted result for sample is determined

3

With M as the total number of trees and as the m-th weak learner in the hypothesis space .

Logistic regression (LR)

LR, a supervised learning method, is mostly employed to predict categorical outcomes⁴⁰. The probability of class membership is expressed as

4

The variables , , and e represent the intercept, regression coefficient, and natural logarithm base. The log-odds transformation leads to the following linear form:

5

Equation (5) shows that the relationship between X and is linear.

Complement Naïve Bayes (CompNB)

CompNB is a variant of Naïve Bayes that is particularly effective for imbalanced datasets⁴¹. It selects classes based on the maximum posterior probability. The classification rule is given by

6

where is the frequency of feature j in document d, is the word count for all classes except c, is the total word count, is the prior probability of class c, is the smoothing factor for feature j, and .

Nearest centroid (NC)

The nearest centroid (NC) classifier ranks observations by class centroid proximity⁴². The Euclidean distance between sample and class k centroid is

7

where is the centroid vector of class k. The predicted class label is then obtained by

8

indicating that the observation is assigned to the class with the minimum distance.

Stacking

Multiple classifiers are stacked to improve prediction accuracy⁴³. For the jth base classifier, the class distribution vector is defined as

9

where C is the number of classes and n is the number of classifiers. Each vector satisfies the constraint:

10

The final class distribution vector is obtained by weighted aggregation:

11

where is the classifier weight vector satisfying

12

and is the matrix of class distribution vectors. Equation (11) shows how the ensemble decision is derived as a weighted combination of base classifiers.

Dataset and preprocessing

The WSN-DS dataset, which includes insider attacks like Blackhole, Grayhole, Flooding and TDMA DoS, is utilised by the ML module. A balanced dataset of 1.7 million records across all classes is achieved by applying RandomOverSampler to alleviate class imbalance. Here are the operations that are part of the preprocessing phase:

• Cleaning up errors and removing background noise,

• Assuring a consistent scale by normalising data values,

• Controlling data that is either absent or incomplete,

• Transforming numerical representations of categorical features,

• Increasing computing efficiency through the use of dimensionality reduction methods.

The dataset is split into 70% training and 30% testing in order to facilitate the model’s adaptability in real-time.

Evaluated ML algorithms

The proposed framework assesses several lightweight machine learning classifiers, aiming to achieve an optimal trade-off between predictive accuracy and computational efficiency:

• LightGBM - a gradient boosting method based on histograms that works well with big, uneven datasets,

• Logistic Regression (LR) - a straightforward yet efficient probabilistic model for binary classification problems,

• Complement Naïve Bayes (CompNB) - an enhanced version of Naïve Bayes created to work better with data that isn’t balanced,

• Nearest Centroid (NC) - allocates class labels depending on how close they are to class centroids, which doesn’t use much processing power,

• Stacking Ensemble - uses more than one base learner to make predictions that are more accurate and reliable.

Detection process

After marking a node, the trust management smart contract (SC) tests it using machine learning.

1. A pre-trained ML classifier examines the node’s behaviour for undesirable behaviour.

2. The blockchain forever records malicious activity for accountability.

3. The Identity Management SC invalidates the node’s credentials, preventing network access.

This multi-layered method protects networks by disconnecting and deleting compromised nodes before they can reconnect.

Framework workflow summary

The ChainShieldML architecture works like this:

1. The identity management SC checks the identity of nodes.

2. VBFT checks and records transactions on the blockchain.

3. The trust management SC gives out Trust Scores.

4. ML finds nodes that act strangely when it comes to trust.

5. ML classifiers show that bad things are happening.

6. Node identities that are malicious are taken away and blacklisted for good.

ChainShieldML combines the unchangeability of blockchain with the adaptability of ML to create a strong, lightweight, and scalable defence for IoT-WSNs.

Comparative evaluation of VBFT with other IoT consensus mechanisms

To assess the efficacy of the implemented VBFT consensus mechanism in comparison to other prevalent IoT consensus protocols, specifically Proof of Authority (PoA), Proof of Stake (PoS) variations, and Raft. The comparison was made based on several important aspects, such as computational overhead, energy efficiency, latency, and scalability. These are all important when deciding if a consensus protocol is right for IoT and WSN installations with limited resources. Table 3 shows that PoA and Raft have minimal latency, but they generally give up Byzantine fault tolerance and scalability in diverse IoT contexts. On the other hand, PoS-based solutions are good for decentralisation, but they tend to use more computing power and energy because of the staking and validation mechanisms. The suggested use of VBFT strikes a good mix between performance and security, allowing for high throughput and reliable consensus with only moderate processing needs.

Table 3.

A comparison of VBFT with different consensus algorithms for the Internet of Things.

Consensus mechanism	Computation overhead	Energy efficiency	Latency	Scalability
PoA	Low	High	Very Low	Moderate
PoS Variants	Moderate	Moderate	Moderate	High
Raft	Low	High	Very Low	Limited
VBFT	Moderate	High	Low	High

The comparison results reveal that VBFT balances security, energy efficiency, and scalability. This makes it ideal for decentralised IoT and WSN systems. This evaluation supports utilising VBFT as the consensus mechanism in ChainShieldML, ensuring dependability and operational efficiency in distributed IoT security administration.

Comparative energy usage and trade-offs in consensus

We compared the energy utilisation of the blockchain consensus and ML detection modules and VBFT with other lightweight consensus strategies to evaluate how well ChainShieldML works when lightweight. Table 4 provides a brief overview of energy and resource trade-offs. VBFT consensuses faster and consumes less energy than PoW. However, LightGBM detection requires little computation and memory, making it suitable for IoT and WSN installations. VBFT avoids stake centralisation and difficult node coordination while using resources efficiently, making it better than PoS and DAG-based systems.

Table 4.

Blockchain consensus and machine learning detection energy utilisation and trade-offs.

Module / Consensus	Energy	Throughput	Complexity	Notes
PoW	High	Medium	High	Costly; inappropriate for IoT
PoS	Low	Medium	Medium	Potential centralisation of stakes
DAG-based	Low	High	High	Intricate node coordination
VBFT	Low	Med-High	Low	Rapid finality; minimalistic
LightGBM	Moderate	High	Medium	Precise; little memory/CPU usage

This study shows that VBFT and LightGBM work well together to provide a solid and lightweight security architecture for IoT and WSN environments with constrained resources.

Results and discussion of the experiment

This section elucidates the functionality of the proposed modules for blockchain prevention and machine learning detection. The BC module is a permissionless blockchain built on Ethereum, distributed between base station (BS) and cluster head (CH) nodes. Solidity powers the Ethereum Remix IDE’s identity and trust smart contracts, while MetaMask wallets are used for testing and deployment. The LightGBM technique was chosen for the ML detection module after thorough testing against Logistic Regression (LR), Complement Naïve Bayes (CompNB), Nearest Centroid (NC), and Stacking classifiers. We use Python in Google Colaboratory to test balanced and unbalanced WSN-DS datasets for a complete analysis. The following subsections detail the blockchain-based prevention module, smart contracts for identity and trust, consensus evaluation, and ML detection module.

Module for preventing blockchain

The blockchain protection module uses Ethereum, a decentralised application platform best known for Ether. Ethereum allows impenetrable smart contracts (SCs) with secure logic for automation. We use the MetaMask wallet-integrated Remix IDE to develop and deploy SCs. There are two SCs: the trust management SC, which examines nodes’ performance based on trust scores and performance data, and the identity management SC, which ensures that IoT nodes may safely register and log in. The integrity of SCs on Ethereum is assured because they cannot be altered once operational. Keccak256 is the hashing algorithm used by Ethereum. This program generates a distinct sensor node identity (SN_id) by hashing each node’s MAC or physical address. Hashing is less expensive to compute, safer, and more private than other cryptographic operations. SCs use the SN_id that results from this to control identity and trust in both modules.

The graph in Fig. 3 shows how much it costs (in gwei) to use the RegisterNode(), AuthNode(), and RevokeNode() functions with PoW and VBFT consensus procedures. VBFT always costs less than PoW because it uses a lightweight leader selection and voting-based validation system. PoW, on the other hand, costs more since it requires a lot of resources to solve puzzles. This approach shows how well VBFT works for managing identities in wireless sensor networks.

Fig. 3.

Comparison of transaction costs for PoW and VBFT in identity management smart contract.

Smart contract for identity management

The identity management smart contract is written in Solidity and is responsible for registering, authenticating, revoking and querying IoT sensor nodes. The main functions are:

• RegisterNode(),

• AuthNode(),

• RevokeNode()

• InfoNode(),

• TotalNode()

Each transaction outputs status, transaction hash, block number, input parameters, and logs. With RegisterNode(), a new sensor record is created, hashed, saved, and identified as registered. The AuthNode() function verifies credentials and indicates if the node is revoked or authenticated. A node is automatically eliminated from the network if its registration status is false. The InfoNode() function provides details of a node, including credentials, status, CH and BS association, and registration timestamp. RevokeNode() deletes a node, while TotalNode() monitors all registered nodes(see in Algorithm 1).

Algorithm 1.

Smart contract-based identity management.

This architecture secures sensor node registration, verification, and revocation in wireless sensor networks, preventing unauthorised access and ensuring decentralized authentication.

Smart contract for trust management

The Solidity trust management SC evaluates sensor node reliability using a Trust Score (TS). Its main functions are AddNodeTrust(), CalculateNodeTrust(), UpdateNodeTrust(), and QueryNodeTrust(). These functions use trust-related variables, including TSS, PSR, PFR, FD, ECA, and Energy Level (see in Algorithm 2).

Algorithm 2.

Smart contract for trust management (TMSC).

This contract dynamically updates trust scores and identifies risky nodes in LEACH-based routing. The TMSC makes sure that trust evaluation is lightweight, safe, and adaptable by looking at behaviour and resource metrics. This lowers the risk of insider threats and improves WSN performance.

Evaluation of blockchain consensus

Figure 4 compares the costs of running essential smart contract (SC) operations AddNodeTrust(), CalculateNodeTrust(), and UpdateNodeTrust() using the proof of work (PoW) and verifiable byzantine fault tolerance (VBFT) consensus mechanisms. VBFT reduces work and transactions compared to PoW. Miners tackle difficult cryptographic puzzles in PoW. Transactions take longer, use more energy, and cost more. However, VBFT uses verifiable random functions (VRFs), delegated voting, and leader selection for lightweight consensus. This validates faster and consumes less power. This design saves resources and is safe and reliable. VBFT is useful for assessing trust in low-resource sensor networks. A closer look shows that VBFT always uses less gas for trust and identity smart contracts. It’s significantly cheaper to use functions like RegisterNode(), AuthNode(), and RevokeNode(). As shown in Table 5, trust management functions including AddNodeTrust(), CalculateNodeTrust(), and UpdateNodeTrust() utilise more than 60% less gas and work up to 70% faster than PoW. Overall, VBFT strikes a good compromise between security, scalability, and computational efficiency. It offers a more sustainable way to reach agreement for blockchain-enabled IoT and wireless sensor network (WSN) settings within the ChainShieldML framework.

Fig. 4.

A comparison of the transaction costs of PoW and VBFT in a smart contract for managing trust.

Table 5.

Comparative cost and gas consumption analysis of smart contract execution under PoW and VBFT consensus mechanisms.

Smart contract function	Metric	PoW (ETH)	VBFT (ETH)	Improvement (%)
RegisterNode()	Identity management cost	0.0023	0.0009	60.8
AuthNode()	Authentication cost	0.0020	0.0008	60.0
RevokeNode()	Revocation cost	0.0018	0.0007	61.1
AddNodeTrust()	Trust update cost	0.0024	0.0009	62.5
CalculateNodeTrust()	Trust calculation cost	0.0027	0.0008	70.4
UpdateNodeTrust()	Trust maintenance cost	0.0025	0.0010	60.0

The values show how much gas was used on average in the experimental WSN blockchain testbed that used Solidity smart contracts.

Machine learning detection module

The detection module identifies IoT-based denial-of-service attacks using machine learning techniques. The WSN-DS dataset is used for both balanced and unbalanced experimental trials. Model performance is evaluated using accuracy as shown in Fig. 5, precision in Fig. 6, recall in Fig. 7, F1-score in Fig. 8, and Matthews correlation coefficient in Fig. 9. The algorithms are further assessed based on physical performance metrics, including processing time, memory consumption, training duration and prediction latency as illustrated in Fig. 10.

Fig. 5.

Classification accuracy of ML models on balanced and imbalanced WSN-DS datasets.

Fig. 6.

Precision comparison of ML models for insider threat detection in WSNs.

Fig. 7.

Recall performance of ML models for capturing malicious nodes.

Fig. 8.

F1-score analysis: balancing precision and recall in WSN security.

Fig. 9.

Matthews correlation coefficient (MCC) evaluation of ML models.

Fig. 10.

Performance overhead analysis of ML classifiers on balanced and imbalanced WSN-DS data.

Performance on balanced and unbalanced datasets

LightGBM regularly beats LR, CompNB, NC, and Stacking on all assessment metrics among the tested algorithms. LightGBM has an F1 score of 98%, Precision, Recall, and Accuracy of 99.67% for the unbalanced dataset. With 100% Precision, Recall and F1-score, LightGBM gets almost ideal results on the balanced dataset. On the other hand, LR and Stacking have high accuracy but do not have excellent recall and F1 scores, especially in an imbalanced dataset. CompNB and NC don’t work well in all circumstances since they can’t handle noisy and unbalanced data. MCC numbers also show that LightGBM is better because it always gets the top scores on both datasets.

Physical performance measures

There are noticeable compromises between accuracy and speed, according on the physical performance of ML models. The most time-consuming operation, stacking, takes over 523 seconds when trained on the balanced dataset. However, NC isn’t very good at detecting and takes the least time to process. Quick and precise, LightGBM is the way to go. It takes a while to train and predict, but it has the greatest detection performance. A consistent quantity of RAM is required by each model. LightGBM’s 33-byte footprint is comparable to that of LR and NC. LightGBM’s low memory and processing power requirements make it a great fit for Internet of Things (IoT) applications that are short on resources.

Performance at different training ratios

For every given training set size, LightGBM consistently achieves the highest possible F1-score, recall, accuracy and precision. Methods such as 60:40, 70:30 and 80:20 training ratios are employed to achieve this. Training and evaluating larger training sets takes more time for all models, even though prediction times typically decrease. This method shows that LightGBM performs well with datasets of different sizes and when training parameters are changed.

Computational complexity

LightGBM’s effectiveness is validated by computational complexity research. The training and prediction processes need and time, respectively. This ensures precise outcomes with minimal computational load. In contrast, the Stacking ensemble is substantially more complex and worthless for real-time IoT applications due to its several working models.

In short, lightweight models (CompNB, NC) are better for circumstances where speed is important, whereas more expensive but technically advanced versions (LightGBM, Stacking) are better for activities that need a lot of accuracy. The testing findings show that the blockchain-based prevention module protects all three steps of registering, authenticating, and managing trust for Internet of Things nodes. I support VBFT as the best way to reach a consensus. The detection module uses LightGBM to accurately and reliably find items in both balanced and unbalanced datasets, which lowers expenses. Security architectures for the Internet of Things (IoT) that use blockchain and machine learning modules are strong, efficient, and can grow.

Comprehensive evaluation of ChainShieldML in large-scale WSNs

We made our experimental setup bigger to look like big wireless sensor networks (WSNs) so that we could fully test how well the suggested ChainShieldML framework works and how well it can grow. The new configuration had numerous network topologies with 500 to 5000 nodes. It used blockchain-enabled gateways and distributed trust evaluation methodologies. The usual specs for Internet of Things sensors say that each node can only do a little amount of processing, such as having 128 KB of RAM, 1 MB of flash memory, and 16 MHz of CPU. The blockchain layer was set up using the VBFT consensus mechanism, and the LightGBM classifier was utilised to find unusual patterns in the detection layer. We meticulously documented the energy consumption, packet delivery rate, transaction throughput, and end-to-end latency of the network. To verify that the network behaved as expected and that the performance metrics were accurate, we conducted these extensive tests in a test environment that was built around Hyperledger. The performance of the proposed architecture remains constant regardless of the size of the network, as seen in Table 6. Even after increasing the number of nodes by five, the accuracy of detection and efficiency of trust management remained over 95%, but the time it took to communicate and the cost of transactions increased just little. This proves that ChainShieldML maintains the guarantee of operational efficiency and security regardless of the size of the network.

Table 6.

WSN network size-specific ChainShieldML performance and scalability.

No. of nodes	Accuracy (%)	Latency (ms)	Throughput (Tx/s)	Energy (J)	Tx cost (ETH)
500	99.1	52.4	142	0.74	0.0008
1000	98.7	59.6	139	0.82	0.0009
2000	97.9	65.2	136	0.89	0.0010
3000	97.2	71.4	132	0.96	0.0011
5000	96.8	78.9	128	1.03	0.0012

Although the network has grown to thousands of nodes, the framework maintains accuracy and low latency, as seen in Table 6. This proves that it can handle multiple users and perform well without many IoT resources.

Adversarial robustness of the LightGBM classifier

Data poisoning and model evasion assaults were used to test the LightGBM classifier’s resilience. These attacks simulate hostile nodes manipulating training data or evading detection, ensuring IoT/WSN security. Table 7 summarises the experiments. Even in difficult conditions, LightGBM performs well on Accuracy, Precision, Recall, and F1-Score. Even when 10% of nodes are poisoned, the F1-Score remains above 98%, indicating quick object detection with minimal processing effort. The physical performance tests stated earlier demonstrated that LightGBM balanced memory usage, detection accuracy, and speed. The LightGBM detection module and blockchain-based prevention module form a powerful, scalable, and resilient WSN security architecture. Further evidence supports this. We also address adversarial training and input sanitisation to strengthen models for future deployments.

Table 7.

LightGBM’s WSN-DS performance when things go wrong.

Attack type	Accuracy (%)	Precision (%)	Recall (%)	F1-score (%)
No attack	99.67	99.67	99.67	99.67
10% of nodes are poisoned with data.	98.50	98.40	98.20	98.30
20% of nodes are poisoned with data.	97.10	97.00	96.80	96.90
Model evasion (10% of assault samples)	98.90	98.85	98.60	98.73
Model evasion (20% of assault samples)	97.50	97.40	97.10	97.25

Evaluation on multiple benchmark datasets

To test the ChainShieldML architecture’s robustness and generalisability, various benchmark datasets were used alongside WSN-DS. In specifically, the examination utilised the CIC-IDS 2017 IoT traces and UNSW-NB15 information. Because it has many network traffic patterns, attack kinds, and communication protocols, this dataset is ideal for testing a model in varied IoT scenarios. Diverse datasets help analyse the framework’s robustness, adaptability, and resilience to evolving cyberattack scenarios. The model exhibits good detection accuracy and low false positive rates in all three datasets, as demonstrated in Table 8. The detecting module using LightGBM has an average accuracy of over 98% and recall and precision values above 97%. These results suggest that the model works well in numerous network environments and may be applied in many circumstances.

Table 8.

Performance-testing ChainShieldML on several benchmark datasets.

Dataset	Accuracy (%)	Precision (%)	Recall (%)	FPR (%)
WSN-DS	99.2	99.1	99.0	0.8
CIC-IDS 2017	98.7	98.4	98.5	1.1
UNSW-NB15	98.1	97.8	97.9	1.3

Table 8 demonstrates ChainShieldML’s versatility in handling various IoT networks and threats. This exhibits framework flexibility and strength. This enhances its suitability for large-scale IoT and WSN security.

Finding and fixing problems with smart contracts

The following are examples of vulnerabilities: gas exhaustion, integer overflows and underflows, re-entrancy attacks, and inadequate access control measures. Should these risks not be managed appropriately, they may put the availability of contracts or their integrity at jeopardy. Through the utilisation of structured gas optimisation, re-entrancy safeguards, and secure code designs that adhere to Solidity best practices, we are able to triumph over these problems. Prior to deployment, automated contract auditing technologies such as Mythril, Slither, and Oyente locate and correct any network defects that may may exist. The implementation of each of these strategies makes ChainShieldML more resistant to attacks on blockchains. This makes it easier to handle both identities and trust. By conducting a comprehensive and proactive evaluation of the proposed paradigm, this patch brings the framework up to speed with the blockchain security needs and increases its reputation for dependability.

Deployment problems and ways to fix them

Real-world IoT and WSN ChainShieldML use raises numerous challenges:

• Resources: The processing power, memory, and battery life of Internet of Things devices are limited. To save money on energy and processing costs, adopt CPU-light consensus methodologies like VBFT and machine learning models like LightGBM.

• Heterogeneous devices: The existence of heterogeneous devices in networks complicates deployment. Mitigation strategies include edge/fog computing and adaptive job allocation, which distribute processing requirements equitably among nodes.

• Dynamic network topology: Node additions, failures, and mobility can all have an impact on network operations. Mitigation approaches include self-healing and flexibility, which can help you maintain your security and confidence.

• Latency and connectivity issues: There are several reports of latency or poor connectivity in wireless sensor networks. As a mitigating method, local decision-making and regular updates ensure that trust is detected and the blockchain operates properly.

• Security vulnerabilities: Internal threats, external attacks, and physical tampering all have the ability to compromise a system’s integrity. One form of mitigation is to deploy methods that protect your privacy, detect intrusions, and deliver secure updates.

In real-world Internet of Things and wireless sensor network contexts, the solutions ensure that ChainShieldML remains scalable, secure, and reliable.

Conclusion

Double-layer ChainShieldML protects IoT WSNs from insiders. Combining blockchain’s decentralised, tamper-proof characteristics with machine learning’s adaptability and prediction provides proactive and reactive security. This beats centralised systems. Identity and trust management are decentralised with the Blockchain Prevention Module, so only trusted nodes can join the network. Smart contracts constantly monitor node factors including energy utilisation, packet forwarding rate, and delay after safe registration and validation. Validation is faster, fairer, and less likely to be rigged with the VBFT consensus mechanism. It also uses less resources than Proof of Work (PoW). The Machine Learning Detection Module works with the blockchain layer to find advanced insider attacks including floods, blackholes, grayholes, and TDMA-based attacks. Supervised models trained on balanced and enriched datasets may correctly identify bad behaviour. LightGBM is the best of the algorithms that were tested. It has the best accuracy, precision, recall, F1-score, MCC, and computational efficiency, which makes it a good choice for IoT applications with limited resources. The system uses decentralised identity, trust, and registration management along with adaptive ML-based detection to find and permanently remove bad nodes. This integration makes an architecture that can fix itself and is strong enough to keep trust and reliability in real time. ChainShieldML fills in important research gaps by removing single points of failure, making sure that attack records can’t be changed, and offering scalable, low-overhead security for a wide range of IoT implementations. It also opens the door for future intelligent, decentralised security frameworks that can change as new IoT threats arise.

Future research directions

Future ChainShieldML research can improve WSN security, privacy and adaptability:

1. Privacy-preserving mechanisms: Protecting node and network data is accomplished through the use of federated learning, homomorphic encryption, and secure data aggregation.

2. Cross-layer security: The process of developing systems that can detect and defend against complex threats across multiple network levels.

3. Intelligent and self-healing mechanisms: Risk detection, recovery, and network resilience.

4. Federated learning integration: It is possible to improve intrusion detection by decentralised model training while simultaneously maintaining data privacy and location.

ChainShieldML should be scalable, safe, and privacy-aware for next-generation WSNs.

Author contributions

Dileep Kumar Murala is accountable for the conceptualisation, methodology, and draughting of the paper. Shadab Ahmad is performing experiments, analysing data, and visualising the outcomes. Veera Ankalu Vuyyuru possesses skills in software development, data curation, and technical validation. V.A. Sankar Ponnapalli conducted supplementary experiments, validated results, and revised the text. Eric Hitimana is responsible for providing supervision, conducting critical revisions, and leading the whole project.

Data availability

The research makes use of the WSN-DS dataset, which is in the public domain and contains tagged Internet of Things network traffic, including DoS attacks. When it comes to testing and training, we make use of both balanced and unbalanced versions.

Declarations

Competing interests

The authors declare no competing interests.