Intrusion alerts stop trusting one model: notary agents and on-chain votes certify a 99.65%-accurate subset

The intrusion verdict now sits on a path that several parties must sign before any action, rather than being issued by one model and logged afterwards. Earlier blockchain intrusion detection systems used the ledger mainly to share detection data or model updates, while the detector itself stayed a single unhardened model and the decision was recorded after the fact. On the 156,089-flow CICIDS2017 test partition the calibrated ensemble reaches 96.60% accuracy over all decisions, while the certified subset after the rejection gate reaches 99.65% accuracy and a 0.04% false-positive rate at 87.3% coverage.

Cost is layered: every flow passes a millisecond-scale reflex path, and only the small fraction judged as attacks pays for language-model deliberation and on-chain consensus. Putting a language model or a blockchain on the per-flow path would destroy real-time detection, so the expensive stages run at alert rate rather than flow rate. On a CPU-only workstation the complete reflex pipeline, covering three detector inferences, temperature scaling, weighted fusion and the reject decision, sustains 37,524 flows per second in batched operation.

Fusion weights follow each detector's recent calibrated precision, so a corrupted member is down-weighted automatically without a separate poisoning detector. The common defence adds an explicit poisoning detector, which becomes another fragile component an adversary can attack. Under simulated output corruption the fully corrupted RNN falls to 0.6% accuracy on its own, while the adaptive ensemble retains 96.0% and that detector's weight decays from 0.332 to 0.014.

Consensus latency grows linearly with the quorum because the chaincode read-modify-writes the alert's state key and Fabric commits at most one write per key per block. Concurrent vote submission collapses wall-clock time to one block interval, but at quorums of two and three every contending vote failed with a read-write conflict and no alert reached its quorum. In a 360-alert benchmark sequential vote collection had median latencies of 2.05, 4.11 and 6.15 seconds for quorums of one to three, while the simulated ledger backend ran the same signature and anti-replay logic in about 2 milliseconds.

The demonstrated scope is two testbed corpora: CICIDS2017 under its original protocol on a class-balanced test set, and GeNIS 2025 under a clean protocol with the natural distribution after positional columns were removed. The blockchain runs as a Fabric test network on a single workstation, with one orderer and two organisations holding one peer each. It is aimed at researchers and engineers working on security-operations automation and cross-organisational audit.

Notaries re-check only the alert's internal consistency, the threshold and the arg-max of the pooled posteriors, and do not re-classify the underlying flow, so a fully compromised Sentinel can still fabricate an internally consistent alert. The weighting guarantee assumes a majority of the ensemble stays honest, and partial corruption around p of about 0.3 produces the deepest dip, to 94.7% accuracy. The 60-second GeNIS slice is dominated by volumetrically separable floods with only 7.4% benign traffic, so false-positive granularity is about one flow per 0.02%.