Securing Industrial Internet of Things (IIoT) systems presents critical challenges due to resource constraints, expanding attack surfaces, and the inadequacy of conventional security solutions against sophisticated cyber threats. While AI-driven detection and blockchain technologies offer promise, existing frameworks suffer from computational inefficiency, lack of real-time prevention, or insufficient auditability. This paper introduces a unified AI-PureChain Intrusion Prevention Framework that tightly integrates deep learning-based threat detection with an immutable PureChain ledger using Proof of Authority and Association (PoA2) consensus. The proposed architecture achieves high-fidelity intrusion detection through hybrid CNN-BiLSTM models, attaining 99.76% accuracy on IoTForge Pro, 98.33% on WUSTL-IIoT-2021, and 98.11% on X-IIoTID datasets, while maintaining low inference latency (0.0016s). The PureChain layer ensures tamper-proof audit trails with 24.56 TPS throughput and 68ms commit time, enabling verifiable prevention actions. Experimental results demonstrate complete attack mitigation (0% success rate) under high-traffic conditions while maintaining minimal resource consumption (14.49% CPU, 448 MB memory, 12.95W power). This work represents a significant advancement in IIoT security by delivering a tightly coupled framework that simultaneously addresses detection accuracy, prevention reliability, and forensic accountability, thereby bridging critical gaps in current industrial security paradigms.

The Industrial Internet of Things (IIoT) has transformed critical infrastructure but has also introduced severe security vulnerabilities, with breaches capable of causing catastrophic physical and operational damage. While blockchain technology offers a promising foundation for tamper-proof logging, existing platforms are often ill-suited for IIoT due to high latency, low throughput, and excessive energy consumption. Furthermore, most current research treats intrusion detection, secure logging, and system recovery as isolated components, lacking a unified framework for autonomous, verifiable resilience. To bridge this critical gap, this paper introduces PureChain, a holistic, secure, and resilient ecosystem. PureChain integrates a custom lightweight blockchain with a deep learning-based intrusion detection system and a novel verifiable recovery protocol, creating a closed-loop security model. The framework leverages a novel Proof of Authority and Association (PoA2) consensus mechanism, achieving high throughput (16.82 TPS), low latency (0.0594 s), and minimal energy consumption (12.43 W), demonstrating suitability for resource-constrained IIoT environments compared to general-purpose platforms like Ethereum and Hyperledger which are optimized for different use cases. Upon intrusion detection by optimized models like XGBoost (99.87% accuracy), immutable blockchain logs actively trigger and cryptographically attest to infrastructure-enforced recovery actions such as device isolation via SDN switches or state rollback through hardware management controllers. Extensive evaluation on benchmark IIoT datasets (IoT-CAD and IoTForge) demonstrates a detection-to-recovery success rate of up to 98.59% while maintaining 100% data integrity. PureChain establishes a new paradigm that unifies real-time threat intelligence, blockchain-based trust, and provable autonomous recovery for next-generation IIoT security.

The convergence of Non-Terrestrial Networks (NTNs) and Terrestrial Networks (TNs) in 6G presents a paradigm shift for the Internet of Things (IoT), enabling ubiquitous connectivity but introducing severe routing challenges across a dynamic, multi-domain topology. Traditional blockchain-based routing frameworks often fail to adapt to the mobility, heterogeneity, and energy constraints of IoT deployments. This paper proposes a Proof-of-Route (PoR) blockchain consensus protocol, augmented with PoA (Proof-of-Authority), with adaptive validator rotation for secure and scalable routing. The protocol integrates cryptographic route authentication, dynamic validator selection, and wallet-based key management. This ensures its resistance against black holes, Byzantine attacks, and Sybil attacks. Unlike prior work, our framework was evaluated under conditions that mirror real-world operational stress. Modular Docker-based containers were developed to represent devices in a 6G-IoT setting. They simulated intermittent link availability, varying latencies, node churn and handovers. Results revealed that the proposed protocol achieved up to an average latency of42.3 ms, a packet delivery ratio of98.7% with scalability verified up to over500 nodes. This paper offers a robust, scalable, and secure solution for the complex routing demands of 6G networks.

Federated learning (FL) in the Internet of Vehicles (IoV) networks is challenged by privacy vulnerabilities, model poisoning attacks, and the limitations of centralized aggregation, which threaten security and scalability. While homomorphic encryption (HE) provides an additional layer of privacy, existing schemes often suffer from cumulative noise growth, resulting in degraded model accuracy and increased inference latency, critical factors for real-time vehicular safety applications. This paper presents PureFL, a novel FL framework that combines adaptive Cheon-Kim-Kim-Song (CKKS) homomorphic encryption with a custom permissioned blockchain (PureChain), utilizing a proof of authority and association (PoA2) consensus mechanism. PureFL incorporates dynamic precision scaling to manage noise accumulation, ensuring computational efficiency without sacrificing privacy or accuracy. The framework also implements a trust-based aggregation mechanism based on cosine-similarity trust scoring, which dynamically weights client contributions according to historical reliability and anomaly detection, thereby enhancing resilience against model poisoning. Experimentation results on the CICIOV2024 and 5G-NIDD datasets demonstrate that PureFL achieves superior anomaly detection accuracy of 99.9%, reduces CKKS HE overhead via precision scaling, and that the proposed PoA2consensus outperforms other consensus mechanisms in terms of throughput and latency, making it suitable for real-time IoV operations.

Vehicular-to-Everything (V2X) communications promise unprecedented safety and efficiency gains but remain vulnerable to confidentiality breaches such as eavesdropping, traffic analysis, and man-in-the-middle attacks. We propose ConfidSPEC-V2X, a focused hybrid framework that integrates continuous-variable quantum key distribution (CV-QKD), a multi-agent deep reinforcement learning (DRL), and an Ethereum-based permissioned blockchainPureChainpublic-key infrastructure (PKI) to deliver information-theoretic secrecy, dynamic traffic obfuscation, and tamper-proof key management. In the quantum module, CV-QKD transceivers embedded in On-Board Units (OBUs) and Roadside Units (RSUs) establish symmetric keys resilient to passive interception and capable of immediate eavesdropping detection. The Artificial Intelligence (AI) module employs multi-agent DRL agents at RSUs to learn optimal dummy-traffic injection policies that obfuscate real V2X message patterns against statistical inference. The blockchain module leverages PureChain smart contracts to register, rotate, and timestamp vehicle public keys, ensuring that any man-in-the-middle attempt to forge or replay keys is invalidated. We implement and evaluate ConfidSPEC-V2X within an OMNeT++/Veins simulation under realistic urban mobility scenarios, measuring the quantum bit error rate, key generation throughput, obfuscation entropy, and key management latency. Results demonstrate that our framework achieves robust confidentiality protection with minimal performance overhead.

The rapid expansion of the Internet of Things (IoT) into edge networks, which are populated by resource-constrained devices, introduces significant security challenges. This article introduces a robust intrusion detection systems (IDS) for edge-IoT networks developed as a combination of blockchain technology and federated learning (FL) with a customized aggregation strategy, adaptive trimmed mean aggregation (ATMA). Our design leverages a permissioned blockchain to authenticate clients and immutably store the final global model, guaranteeing that only verified participants contribute to the training. ATMA strategy used in the FL departs from fixed-threshold schemes in other works by dynamically adjusting its trimming parameter according to the observed variance in client updates. This variance-aware trimming provides strong Byzantine resilience without sacrificing model accuracy, and its sorting-based implementation maintains an O(n log n) computational complexity. The proposed setup was evaluated under combined label-flipping and Gaussian-noise attacks at adversarial rates of 0%, 10%, 20%, 30%, 40%, 50%, and 60%, in both IID and non-IID data distributions. The results demonstrated that our blockchain-backed ATMA preserves high detection performance under severe attack scenarios and does so with minimal overhead, making it a scalable, secure solution for safeguarding Edge-IoT deployments.

Increased automation, connectivity, and data sharing enabled by 6G technology have heightened the vulnerability of Internet of Vehicles (IoV) networks. Addressing this challenge requires an intrusion detection system (IDS) capable of accurately identifying data falsification within IoV while adhering to real-time constraints. This paper presents a Blockchain-enhanced feature-engineered IDS to ensure precise attack detection and classification with minimal computational overhead in in-vehicle networks (IVNs). The proposed lightweight IDS utilizes a hybrid Pearson’s Correlation Coefficient (PCC) feature selection technique designed for deployment on the Telematics Control Unit (TCU). Furthermore, we propose a custom private blockchain network utilizing the proof of authority and association (PoA) consensus mechanism, deployable on the Roadside Unit (RSU), for the secure logging of vehicle Electronic Control Unit (ECU) information, detection results, and the automatic isolation of malicious ECUs via smart contracts. Experimentation analysis demonstrates that the proposed approach achieves notable performance, with a 99.9% detection accuracy and minimal computation times of 0.24s and 1.32s on the CICIoV2024 and CAN-Intrusion datasets. Furthermore, the system achieves high blockchain scalability, maintaining stable throughput of 16 tx/s and low transaction latency of 0.062s under increasing ECU density and RSU coverage.

The accelerated industrial transformation has witnessed the supervisory control and data acquisition (SCADA) transit from monolithic to the Internet of Things (IoT-SCADA). The development also transformed conventional specialized serial-based to transmission control protocol/internet protocol reliant standard communication protocols, such as IEC-60870-5-104 (IEC-104), thereby increasing vulnerability to attacks and intrusions. Maintaining the reliability and availability of IoT-SCADA demands versatile and robust monitoring of network traffic. This study proposes a monitoring technique to detect and characterize the IEC-104 IoT-SCADA network traffic. The proposed trees bootstrap aggregation monitoring technique of GridSearchCV() hyperparameter tuning of 11 n-estimator, 20 max-depth, and 5-k cross-validation achieved early detection and characterization. Experimental results demonstrate its sensitivity and precision in detecting and classifying various network traffic and application types at a minimal execution time while reducing false alarm rates, which is vital for mitigating intrusions in heterogeneous IoT-SCADA networks.

The pervasiveness in the industrial internet of things (IIoT) due to the application of supervisory control and data acquisition (SCADA) has led to the growth of heterogeneous sensor data, thereby increasing the risk of intrusions and attacks. The existence and effect of intruders and their innovative attack techniques are on the rise. Existing intrusion detection systems (IDS) tend to be computationally expensive with this form of data due to the presence of noise. In real-time domains, available methods lag, necessitating additional research into effective feature extraction schemes, which is fundamental in machine learning (ML) for time exigency. This study, in a comparative analysis of some feature selection techniques (FS), proposes a combination of an efficient ML classifier and an agnostic feature selection (FS) scheme for attack detection and classification in a real-time SCADA network. The flexibility and interoperability of the proposed approach resolve the computational complexity of vulnerability detection schemes while reducing false alarm rates (FAR) and overall model execution time. With the view of an online preprocessing, the proposed technique is phased thus: (i) data preparatory consisting of data cleansing and normalization followed by (ii) the combination of a pre-pruned decision tree (DT) algorithm and an agnostic Chi-square FS approach built to obtain an optimal subset of data features for efficient IDS. (iii) Evaluation of proposed agnostic DT-CH and other FS candidates for anomaly detection.

Software-defined networking (SDN)-based Industrial Internet of Things (IIoT) networks have a centralized controller that is a single attractive target for unauthorized users to attack. Cybersecurity in IIoT networks is becoming the most significant challenge, especially from increasingly sophisticated Distributed Denial-of-Service (DDoS) attacks. This situation necessitates efficient approaches to mitigate recent attacks following the incompetence of existing techniques that focus more on DDoS detection. Most existing DDoS detection capabilities are computationally complex and are no longer efficient enough to protect against DDoS attacks. Thus, the need for a low-cost approach for DDoS attack classification. This study presents a competent feature selection method extreme gradient boosting (XGBoost) for determining the most relevant data features with a hybrid convolutional neural network and long short-term memory (CNN-LSTM) for DDoS attack classification. The proposed model evaluated the CICDDoS2019 data set with improved accuracy and low-complexity capability for low latency IIoT requirements. Performance results show that the proposed model achieves a high accuracy of 99.50% with a time cost of 0.179 ms.

The constant development and deployment of the supervisory control and data acquisition (SCADA) in the industrial internet of things (IIoT) have enabled vast communication leading to the generation of large volumes of sensor data. This phenomenon has increased SCADA’s susceptibility to vulnerability and attacks which calls for attack detection mechanisms. Existing systems only aim at detection accuracy without considering the effect of false alarm rates in large sensor data. To resolve this issue, we propose a Rational Quadratic Gaussian Process Regression (RQGPR) for the effective reduction of false alarm rate and improved prediction precision. In this algorithm, a Gaussian process regression model is trained with recourse to kernel functions to precisely predict attacks and reduce false alarms. The RQGPR outperforms all other kernels in the reduction of false alarm rates. Through simulations, we show that the proposed model reduces the false alarm rate up to 71.73% higher than other kernels. This result was validated by evaluating the CIRA-CIC-DoHBrw-2020 datasets, which also had a reduction rate of 67.61%. In addition, it also showed superior performance when compared with other state-of-the-art models.