A Blockchain-Secured Transfer Learning and Transformer-Based Framework for Next-Generation Intrusion Detection Systems

The rapid evolution of Internet of Things (IoT), Industrial Internet of Things (IIoT), and edge-enabled systems has substantially expanded the cyber-attack surface of modern digital infrastructures. In such settings, conventional Intrusion Detection Systems (IDS) frequently underperform because of severe class imbalance, evolving attack behavior, heterogeneous network conditions, un-secure and malicious Artificial Intelligence (AI) models, and the computational constraints of edge and industrial platforms. This thesis addresses these limitations through a unified research that combines transformer-based learning, Deep Transfer Learning (DTL), confidential model sharing and screening, and lightweight telemetry driven detection architectures. The first research stream develops transformer-enhanced intrusion detection model based on feature extraction through Bidirectional Encoder Representations from Transformers (BERT) and classification through Multi-Layer Perceptron (MLP) for unbalanced network traffic. The results demonstrate that contextual representation learning improves the detection of both frequent and rare attack classes while reducing dependence on manual feature engineering. This methodology is subsequently extended to IIoT environments, where robust and accurate attack detection is critical for operational continuity. Building on these findings, the thesis proposes DTL-based edge architectures and compact IDS designs for IoT devices, improving cross-domain generalization and deployment feasibility in resource-constrained settings. The second line of work investigates secure model exchange for collaborative learning across distributed nodes. To enable Transfer Learning (TL) without exposing Intellectual Property (IP), the thesis introduces a confidential model-sharing protocol that integrates local encryption and digital signatures with decentralized storage via InterPlanetary File System (IPFS) and blockchain-governed access control on Ethereum. An extended framework further incorporates artifact screening, requester-specific key recovery, and immutable provenance recording, enabling secure, selective, and auditable reuse of model artifacts in mutually untrusted environments. The third line of work addresses real-time Distributed Denial of Service (DDoS) detection in virtualized infrastructures through kernel-level observability. In this framework, Extended Berkeley Packet Filter (eBPF) telemetry captures fine-grained network and application events with low overhead, while Machine Learning (ML)-based analytics deployed within a Security Information and Event Management (SIEM) platform provide near real-time attack detection. The resulting architecture offers low-latency monitoring without requiring modifications to protected applications and supports modular deployment in cloud and multi-Virtual Machines (VM) environments. Comprehensive experimental evaluation on representative cybersecurity benchmark datasets, including Network Security Laboratory Knowledge Discovery and Data Mining 2009 (NSL-KDD 2009), Canadian Institute for Cybersecurity Intrusion Detection System 2017 (CIC-IDS 2017), Washington University in St. Louis Industrial Internet of Things (WUSTL-IIoT) 2018, WUSTL-IIoT 2021, and Canadian Institute for Cybersecurity Advanced Persistent Threats Dataset for Industrial Internet of Things (CIC-APT-IIoT) 2024, together with system-level validation of confidential model sharing and eBPF-driven DDoS detection, confirms that the proposed approaches provide high detection capability, strong adaptability across heterogeneous environments, secure and efficient model dissemination, and suitability for near real-time operation. Overall, this thesis delivers a scalable and practically grounded framework for next-generation cyber defense across IoT, IIoT, edge, and distributed collaborative learning ecosystems.