Uncertainty-Aware AI Firewall Puts Blockchain Networks on Guard

Blockchain networks are often celebrated as tamper-proof ledgers, but the machines that keep those ledgers alive remain stubbornly vulnerable to the ordinary hazards of the internet. A new study published in Mobile Networks and Applications by Zheng Zhu and Wenjuan Li of The Education University of Hong Kong introduces BCFW, a consensus firewall designed for Proof-of-Authority blockchains that fuses a deep learning intrusion detector with an on-chain governance mechanism. The system does more than raise an alarm when malicious traffic appears: it attaches a calibrated measure of its own uncertainty to every prediction, and then routes enforcement decisions through a multisignature process that no single node can hijack.

The problem the researchers set out to solve is deceptively simple to state and notoriously hard to fix. Existing security solutions, the authors note, often suffer from poor generalization and weak actionability when deployed in a blockchain environment. Generalization refers to a model’s ability to recognize attacks it has never seen before; actionability refers to whether a detection can actually trigger a safe, accountable response in production. Many high-accuracy classifiers fail on both counts. They overfit to the quirks of a particular dataset, and even when they detect something suspicious, they output a bare label with no indication of how confident the system should be before taking a drastic action such as blocking a validator’s traffic.

BCFW addresses both weaknesses with an architecture built around an FT-Transformer, a transformer variant specifically designed for tabular data. Network traffic in intrusion detection datasets arrives as tables of flow features—packet counts, byte totals, durations, flags—rather than images or sequences of text, which is why the authors adapted the architecture that Gorishniy and colleagues showed can outperform conventional deep networks on tabular problems. Attention mechanisms let the model weigh the relationships among flow features dynamically instead of treating each column independently, capturing subtle combinations of attributes that betray an attack in progress.

The genuinely novel ingredient is the aleatoric uncertainty head bolted onto the detector. Borrowing from Bayesian deep learning practice, the model does not merely predict whether a flow is benign or malicious; it also estimates the intrinsic noise in that prediction. Aleatoric uncertainty captures ambiguity that no amount of additional training data can remove—for example, flows whose features genuinely overlap between classes. By learning to output a variance alongside each classification, BCFW gives downstream systems a principled way to distinguish confident detections from borderline cases, and to hold back automated responses when the model is effectively guessing.

The performance numbers are striking. Validated on the widely used CIC-IDS 2017 and CSE-CIC-IDS 2018 benchmark datasets, BCFW achieved 98.20 percent accuracy and a weighted F1 score of 98.24 percent, with a binary area under the ROC curve of 0.9979—very close to the theoretical maximum. In targeted comparisons against CapsNet+BiLSTM and a FlowTransformer-inspired baseline, the system delivered the strongest recall for botnet traffic at 0.6361 and the highest macro recall at 0.8251. Botnet flows are among the hardest categories to detect because they mimic normal background traffic, so gains here carry practical weight rather than merely inflating headline metrics.

Just as important as the accuracy is what the uncertainty estimates revealed. Benign flows and attack flows produced clearly separated variance distributions, with a mean variance of 0.032 for benign traffic against 0.249 for attacks—a separation of 0.217. In plain terms, the model not only knows when it is right; it knows when it is unsure, and its unsureness itself is informative. A network operator can therefore set policy thresholds: high-confidence detections trigger automated blocking, while uncertain cases are escalated for human review. This risk-aware automation is what the authors mean by making predictions actionable under operational risk.

Detection alone, however, leaves the hardest question unanswered: who is allowed to act on an alert? In a Proof-of-Authority blockchain, a small set of authorized validators maintain consensus, and a compromised or malicious validator is precisely the insider threat that conventional perimeter defenses handle poorly. BCFW’s answer is a governance layer built on DevLeChain, an open blockchain development platform, using multisignature schemes of the kind developed for Bitcoin’s Schnorr signatures. Firewall rules and response actions become on-chain transactions that require multiple validators to sign off before they take effect, so no individual node—not even a compromised one—can unilaterally silence a peer or rewrite protective policy.

This consensus-driven enforcement is why the authors describe BCFW as a firewall rather than merely an intrusion detection system. The chain provides an immutable, auditable record of every security decision, which addresses two chronic complaints about machine learning security tools: operators cannot verify what a black-box model did, and attackers who compromise one administrator cannot cover their tracks. With BCFW, the detection event, the uncertainty attached to it, and the multisignature approval of the response all live on the ledger, creating accountability by construction.

The design choices reflect a broader trend in blockchain security research. Prior work from overlapping research groups has explored blockchain-based collaborative intrusion detection in software-defined networking, blockchain trust management for the 6G era, and BlockFW, a blockchain-based rule-sharing firewall. BCFW extends this lineage by closing the loop: rather than using the chain only to share threat intelligence, it embeds the enforcement decision itself in consensus, tailored specifically to the permissioned Proof-of-Authority setting where the CAP theorem trade-offs between liveness and consistency differ sharply from public proof-of-work networks.

Limitations remain, as they always do. The evaluation relies on standard benchmark datasets rather than live blockchain traffic, and the authors state that no datasets were generated during the study, so real-world deployment will test whether the benign-attack variance separation persists under distribution shift. The botnet recall of 0.6361, while the best in the comparison, still leaves a substantial fraction of that class undetected. Nevertheless, the core contribution stands: by coupling high-fidelity tabular transformer detection with calibrated uncertainty and multisignature on-chain governance, BCFW sketches a blueprint for security infrastructure in which artificial intelligence proposes, but consensus disposes—a division of labor that permissioned blockchains, with their built-in accountability machinery, are unusually well placed to deliver.

Subject of Research: Uncertainty-aware machine learning intrusion detection with on-chain governance for Proof-of-Authority blockchain security

Article Title: BCFW: An Uncertainty-Aware Consensus Firewall for PoA Blockchains

Article References: Zhu, Z., & Li, W. (2026). BCFW: An Uncertainty-Aware Consensus Firewall for PoA Blockchains. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02507-7

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02507-7

Keywords: blockchain security, network intrusion detection, FT-Transformer, uncertainty estimation, Proof-of-Authority, on-chain governance, aleatoric uncertainty, CIC-IDS 2017, CSE-CIC-IDS 2018, multisignature governance, DevLeChain, deep learning