Blockchain and Federated Learning Join Forces to Shield Connected Cars From Cyberattacks

Connected vehicles are no longer just machines that move people from one place to another. They are rolling networks of sensors, controllers, and wireless links that constantly exchange data with other cars, roadside infrastructure, and cloud services. This connectivity is what enables modern driver assistance, real-time traffic management, and the coming wave of autonomous driving, but it also turns every vehicle into a potential entry point for cyberattacks. A new study published in Cluster Computing by K. Durga Charan and R. Vishnukumar of Madanapalle Institute of Technology and Science proposes an ambitious answer: a security framework called IoV BCFL+ that combines federated learning, blockchain governance, and spatio-temporal intelligence to detect intrusions across the Internet of Vehicles without ever moving sensitive driving data off the cars that generate it.

The core problem the researchers set out to solve is architectural. Traditional intrusion detection systems for vehicle networks tend to be centralized: raw data from thousands of vehicles is funneled to a central server, where a machine learning model scans it for signs of malicious activity. That design creates several weaknesses at once. It introduces communication bottlenecks and latency, which are dangerous when a response to an attack must happen in milliseconds. It concentrates critical vehicle data in one place, creating an attractive target for attackers and raising privacy concerns. And it produces a single point of failure: if the central detector is compromised or overwhelmed, the entire fleet loses its protective umbrella. As IoV deployments scale into the millions of vehicles, these limitations become untenable.

IoV BCFL+ inverts that architecture using federated learning, a technique in which the detection model is trained locally on each participating vehicle or edge node, and only the learned model updates, not the raw data, are shared for aggregation. This preserves privacy by keeping driving records, communication logs, and behavioral traces on the vehicles themselves. But federated learning brings its own vulnerabilities. If some participants are malicious or compromised, they can poison the shared model by submitting corrupted updates, a scenario known as a model poisoning attack. The framework addresses this with what the authors call Blockchain Anchored Trust Weighted Federated Aggregation, in which each participant’s contributions are weighted by a trust score, and the aggregation process is anchored to a blockchain so that the history of model updates cannot be silently altered.

The blockchain component is not a generic ledger bolted on for publicity. The researchers use a Proof of Authority consensus mechanism, which is far lighter than the energy-hungry Proof of Work schemes behind cryptocurrencies and therefore better suited to the tight computational and latency budgets of vehicular networks. Smart contracts encoded on the chain enforce what the authors describe as consensus-driven, self-evolving model governance: rules for how the detection model is updated, how trust scores rise and fall, and how misbehaving nodes are handled are executed automatically rather than managed by a central administrator. The governance layer is designed to evolve over time, adjusting to new attack patterns and network conditions rather than remaining a static set of policies.

Detection itself relies on a mobility-aware spatio-temporal representation module. Vehicles in traffic are inherently dynamic objects: their communication patterns change with speed, density, road topology, and time of day. A static classifier trained on fixed network snapshots will miss attacks that only reveal themselves in the temporal evolution of vehicle behavior. The framework builds representations that capture both spatial relationships among vehicles, such as which nodes are communicating with which neighbors, and temporal dynamics, such as how those relationships shift across successive time windows. This is the kind of pattern recognition where recurrent and attention-based deep learning architectures excel, and the authors situate their approach within a body of prior work using BiLSTM networks, graph transformers, and spatio-temporal attention models for network intrusion detection.

One of the more distinctive elements of the study is its treatment of forensic evidence. When an intrusion is detected, investigators need trustworthy records of what happened, but storing bulky evidence on-chain would be slow and expensive. IoV BCFL+ adopts a hybrid on-chain and off-chain structure: cryptographic fingerprints and metadata of intrusion evidence are anchored on the blockchain, while the full evidence payloads are stored off-chain on the InterPlanetary File System, a distributed storage network. This design pays off in a striking way in the reported results: forensic retrieval time was reduced by more than 40 percent compared with conventional approaches, meaning that incident response teams can reconstruct an attack timeline substantially faster. Security of the evidence pipeline is reinforced with lightweight cryptographic measures, including dynamic key management and the ASCON authenticated encryption cipher, which is designed for resource-constrained devices.

Anticipating that attackers will not stand still, the authors also built adversarial stress testing into the development cycle. Through what they call Federated Adversarial Scenario Stress Testing, the detection model is deliberately challenged with adversarial perturbations and novel attack variants during training, hardening it against the manipulation techniques that real adversaries deploy. This matters because machine learning based detectors are famously brittle: small, carefully crafted changes to input data can flip a malicious event into the benign category. By exposing the model to such manipulations before deployment, the framework aims to close that gap proactively rather than discovering it during a live incident.

The empirical results are the headline numbers. Tested on three widely used benchmark datasets, UNSW NB15, CIC IDS2018, and VeReMi, the latter being a standard reference dataset for vehicular misbehavior, the framework achieved detection accuracy above 96 percent. Against novel attack variants, it demonstrated more than 30 percent improved robustness, a measure of how well the detector holds up when confronted with threats it has not seen during training. Perhaps most important for real-world scalability, the communication overhead per federated learning round stayed below 4 megabytes, a crucial figure because bandwidth in congested vehicular networks is scarce and every megabyte exchanged between vehicles and aggregators competes with safety-critical traffic information.

The researchers have also made reproducibility a priority in a field where it is often lacking. The complete implementation and network hierarchical configuration code is publicly accessible through a Google Colab notebook, allowing other researchers and practitioners to verify the results and build on the work. The authors declare no competing interests and no external funding for the research, and the study appears in Cluster Computing, Volume 29, as article number 797, published on 27 September 2026.

The significance of this work extends beyond one detection algorithm. It sketches a template for how security in large-scale cyber-physical systems might be governed in the future: intelligence distributed to the edge, trust computed and enforced through tamper-evident ledgers, evidence preserved in a way that survives disputes, and governance rules that adapt autonomously as threats evolve. For the Internet of Vehicles specifically, where a successful attack can translate directly into physical danger on the road, the combination of privacy-preserving learning, trust-weighted aggregation, and fast forensic retrieval addresses the full lifecycle of a security incident, from detection through investigation. Challenges certainly remain, including the overhead of blockchain operations at city scale, the difficulty of bootstrapping trust among strangers on the road, and the relentless creativity of attackers. But IoV BCFL+ demonstrates that these pieces can be assembled into a coherent, tested architecture, and it offers next-generation intelligent transportation systems a credible path toward security that scales with the fleet and evolves with the threat landscape.

Subject of Research: Blockchain-enabled federated learning for intrusion detection in Internet of Vehicles networks

Article Title: Blockchain-enabled federated learning with spatio-temporal trust and self-evolving governance for IoV intrusion detection

Article References: Durga Charan, K., & Vishnukumar, R. (2026). Blockchain-enabled federated learning with spatio-temporal trust and self-evolving governance for IoV intrusion detection. Cluster Computing, 29(14), Article 797. https://doi.org/10.1007/s10586-026-06621-9

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06621-9

Keywords: Internet of Vehicles, federated learning, blockchain, intrusion detection, cybersecurity, spatio-temporal intelligence, trust management, connected vehicles, forensics, adversarial robustness, smart contracts, privacy preservation