Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture

Lampis Alevizos, Max Hashem Eiza, VINH-THONG TA, Qi Shi, Janet Read

Research output: Contribution to journalArticle (journal)peer-review

15 Citations (Scopus)
262 Downloads (Pure)


In a world where organisations are embracing new IT working models such as Bring Your Own Device (BYOD) and remote working, the traditional mindset of defending the network perimeter is no longer sufficient. Zero Trust Architecture (ZTA) has recently emerged as a new security model in which the breach mindset dominates the threat model. By default, the ZTA considers any endpoint (i.e., device), user, or application to be untrusted until proven otherwise. Nonetheless, once proven by the endpoint, using Advanced Persistent Threats (APT), attackers can still take over an authenticated and authorised session via that endpoint. Therefore, they can perform several user/device centric malicious activities in addition to lateral movement rendering the endpoint the Achilles heel of ZTA. To effectively deter APT attack capabilities on the endpoints, this work proposes a Blockchain-enabled Intrusion Detection and Prevention System (BIDPS) that augments ZTA onto endpoints. The BIDPS aims to achieve two core outcomes: first, detect and prevent attackers’ techniques and tactics as per MITRE’s ATT&CK enterprise matrix earlier than the lateral movement stage, and secondly, strip trust out of the endpoint itself and place it on-chain, thus creating an immutable system of explicit trust. To evaluate the effectiveness of the BIDPS, a testbed was built where techniques of over ten APTs attacks were launched against the endpoint. BIDPS has a high rate of success defending against the launched attacks owing to its Blockchain’s immutability, fortifying the detection/prevention processes.
Original languageEnglish
Article number10
Pages (from-to) 89270 - 89288
Number of pages19
JournalIEEE Access
Early online date18 Aug 2022
Publication statusPublished - 29 Aug 2022


  • Advanced persistent threats
  • blockchain
  • endpoints
  • intrusion detection
  • intrusion prevention
  • security
  • zero trust

Research Centres

  • Data and Complex Systems Research Centre


Dive into the research topics of 'Blockchain-Enabled Intrusion Detection and Prevention System of APTs Within Zero Trust Architecture'. Together they form a unique fingerprint.

Cite this