Adaptive Real-Time Threat Detection in Blockchain Networks: A Smart Contract-Based Approach

Abstract

Public blockchain networks are exposed to Distributed Denial-of-Service (DDoS), Sybil and replay attacks due to their open, permissionless architecture. Existing defenses are predominantly static: access control lists, fixed rate limiters and off-chain reputation services cannot react to emerging adversarial patterns within a single block or transaction lifecycle [3]. This paper presents ThreatDetector, an adaptive on-chain threat detection system implemented as a gas optimised Solidity smart contract on the Ethereum Sepolia testnet. The system detects three principal attack classes — DDoS (sliding window), Sybil (age– frequency) and replay (nullifier registry) — through a unified cumulative scoring model bounded by saturating addition at 100 and escalated at two configurable thresholds (ALERT ≥70, CRITICAL ≥90). An off-chain AdaptiveMonitor written in Python and Web3.py polls on-chain events at eight-second intervals. The final prototype (v3) was deployed at 1,387,453 gas, achieving a 21.9% reduction compared to v2. Across 80 controlled simulations and eight live Sepolia events the system reported 100% detection accuracy.