Smart Contract-Based Security Alert Platform for Industrial Control Systems ^†

Abstract

As digitalization is widely used, Industrial Control Systems (ICSs) face severe cybersecurity challenges, where traditional defenses often lack real-time detection and immutable audit trails. Therefore, we propose a security alert platform that integrates blockchain, smart contracts, and homomorphic encryption. By leveraging the decentralized architecture of blockchain, the platform ensures the integrity and non-repudiation of operational logs. Concurrently, anomaly detection logic is embedded within smart contracts to enable an automated, real-time alerting mechanism. Furthermore, to preserve industrial data privacy, homomorphic encryption is employed, allowing the system to perform anomaly detection directly on encrypted data, thereby maintaining confidentiality throughout the data lifecycle. Preliminary analysis indicates that the proposed platform effectively enhances the resilience of ICS, strengthening both defense against unauthorized operations and post-incident forensic capabilities.

1. Introduction

Critical infrastructure (CI) [1] serves as the backbone of societal functionality, public safety, and economic stability, and forms the foundation upon which governments deliver essential public services. However, with the increasing degree of digitalization and network connectivity, CI has become an attractive target for cyber threats, including ransomware, phishing campaigns, and vulnerability exploitation. In particular, critical sectors such as energy, water supply, and transportation continue to rely heavily on legacy Industrial Control Systems (ICS) that lack modern cybersecurity defenses, rendering them highly vulnerable to sophisticated and persistent cyberattacks.

Recently, cyber incidents targeting critical infrastructure have occurred with increasing frequency worldwide, often resulting in severe consequences. Notable examples include the large-scale power outages in Ukraine in 2022 [2], intrusion alerts issued for the United States’ water treatment facilities in 2023 [3], and a water plant overflow incident in 2024 caused by unauthorized manipulation of control systems [4]. These events demonstrate that attacks on critical infrastructure can lead not only to service disruptions but also to cascading effects that pose serious risks to public safety and social stability.

Motivated by these observations, we explored the 2020 Wujie Dam abnormal discharge incident in Taiwan. The incident was triggered by insulation degradation in the gate control signal line, which caused an unintended gate opening during the early morning hours. Due to insufficient situational awareness, the on-duty operator failed to promptly identify the abnormal condition, manually close the gate, or issue timely warnings to downstream residents. Subsequent investigations further revealed that, despite regulatory requirements mandating accurate logging of operation time, gate opening level, water level, and flow rate after each operation, false records were deliberately entered into the dam operation log, severely undermining accountability and post-incident analysis.

The incident exposes two fundamental security weaknesses in existing ICS deployments for critical infrastructure. First, the lack of effective anomaly detection [5] and real-time alerting mechanisms prevents timely identification and response to abnormal operational conditions. Second, the absence of trustworthy audit logs allows operational records to be altered after incidents, significantly complicating responsibility attribution and forensic investigations.

To address the challenges of insufficient data integrity and limited automated detection capabilities, this paper proposes a smart-contract-based security alert platform for industrial control systems. By integrating blockchain, smart contracts, and homomorphic encryption, the proposed platform ensures immutable data records and automated anomaly triggered alerts while preserving data confidentiality. As a result, the resilience of ICS against cyber threats is substantially enhanced.

In this study, blockchain is employed to provide immutable and non-repudiable records of ICS operational and sensor data. Smart contracts are employed to execute anomaly detection logic and trigger real-time security alerts upon detecting abnormal conditions. All ICS data and detection models are homomorphically encrypted before being written to the blockchain, enabling secure analysis without compromising data privacy.

2. Related Works

The developed platform is built upon three key technologies: blockchain-based immutable data logging, smart-contract-enabled automated execution, and homomorphic encryption for data confidentiality. Existing studies have explored each of these aspects to enhance the security and trustworthiness of industrial control systems. The following subsections review related work on blockchain applications in ICS, smart-contract-based anomaly detection, and homomorphic encryption for industrial data protection.

2.1. Blockchain Applications in Industrial Control Systems

Blockchain technology [6] has been increasingly adopted in ICS and CI due to its decentralized architecture and inherent immutability. Prior studies commonly leverage blockchain to store critical operational events and sensor data in a distributed ledger, ensuring data integrity and auditability through cryptographic hash chaining [7]. Any unauthorized modification of stored records can be readily detected, thereby enhancing system trustworthiness and post-incident forensics.

However, most existing approaches only store hash digests of ICS data on the blockchain to reduce storage and computational overhead. While this design provides integrity verification, it still poses potential security risks. Under certain conditions, hash values may be inferred or correlated with sensitive operational data through constrained data spaces or side-channel information. Moreover, hash-only storage does not directly support secure analytics or anomaly detection.

To address these limitations, this work adopts a more rigorous design by encrypting ICS data before blockchain storage and recording ciphertexts instead of simple hash values. By combining cryptographic encryption with blockchain immutability, the proposed platform preserves data integrity and traceability while significantly reducing the risk of sensitive information leakage.

2.2. Smart-Contract-Based Anomaly Detection

The concept of smart contracts was originally proposed by Nick Szabo, aiming to automate contract execution through programmable logic without relying on trusted intermediaries. With the advent of platforms such as Ethereum, smart contracts can be deployed in a decentralized environment and executed by a virtual machine, ensuring that contract logic remains tamper-resistant once deployed [7].

Recent studies have extensively explored the integration of smart contracts for security monitoring and industrial system management, embedding sophisticated security rules and automated response logic directly into on-chain code. In contrast to traditional centralized monitoring servers, these decentralized mechanisms effectively eliminate single points of failure and significantly mitigate the risks associated with insider manipulation and data tampering [8].

On the basis of the previous research results, the developed platform in this study embeds industrial anomaly detection logic directly into smart contracts. When verified ICS data satisfies predefined anomaly conditions, the contract automatically triggers real-time alerts to relevant operators. This design enhances response timeliness while ensuring that detection logic itself remains immutable and trustworthy.

2.3. Homomorphic Encryption (HE) for Data Confidentiality in ICS

HE is a cryptographic technique that enables computations to be performed directly on ciphertexts [9]. Its fundamental property is that the result of operations executed on encrypted data, once decrypted, is identical to the result obtained by performing the same operations on the corresponding plaintexts [10]. From an algebraic perspective, given two groups $\left(G, ·\right)$ and $\left(G^{\prime }, °\right)$ and a homomorphic mapping $f : G\to G^{\prime }$, the following property holds for any x, y in G:

$$f\left(x·y\right)=f\left(x\right) ° f\left(y\right)$$

(1)

This property allows computations originally defined in the plaintext domain to be securely carried out in the encrypted domain without requiring prior decryption. In the developed platform, homomorphic encryption is employed to protect the confidentiality of industrial control system data stored on the blockchain. All ICS data are encrypted before being recorded on-chain, and anomaly detection is performed directly over the encrypted data and model inference results. This design enables secure analysis without exposing sensitive operational information, ensuring that data remains encrypted throughout the entire processing pipeline and thereby maximizing data confidentiality and privacy preservation. Figure 1 illustrates the concept of HE.

Figure 1. Concept of the homomorphic encryption.

3. Smart-Contract-Based Security Alert Platform (SCSAP)

This section presents the architecture and technical details of the SCSAP developed in this study. The platform is designed for the ICS to ensure data integrity, confidentiality, and automated anomaly detection. Figure 2 illustrates the overall platform architecture.

Figure 2. Smart-Contract-Based Security Alert Platform architecture.

3.1. Platform Architecture

ICS consists of human–machine interfaces (HMI), Supervisory Control and Data Acquisition (SCADA) systems, programmable logic controllers (PLCs), and remote terminal units [11]. In such systems, SCADA collects data from the control layer and issues commands to control devices, while HMI presents the data in a graphical format for operator monitoring. In this study, ICS is simplified to include four core nodes: database server, controller host, SCADA server, and HMI host. In the proposed platform, each node performs its traditional functions while also serving as a blockchain participant, participating in the consensus mechanism to guarantee the immutability of ICS records. This distributed architecture effectively mitigates the impact of attacks on a single node and enhances the overall security and reliability of the system.

3.2. Data Encryption and On-Chain Storage

Figure 3 illustrates the implementation of the homomorphic encryption. To ensure data integrity, immutability, and confidentiality, all ICS data and anomaly detection results are encrypted using HE. ICS data, generated by PLCs or SCADA systems, is encrypted and written to the blockchain in ciphertext, ensuring both immutability and confidentiality. Likewise, the predicted results from the anomaly detection model are encrypted and stored in smart contracts, where homomorphic computations enable secure anomaly detection on encrypted data. This approach allows the platform to maintain data privacy while still performing essential computations and decision-making operations, meeting the high standards of data security and reliability required in industrial control environments.

Figure 3. Implementation of homomorphic encryption.

3.3. Anomaly Detection and Alert Mechanism

In this study, the anomaly detection logic is embedded within smart contracts to enable automated monitoring and alerting. The detection model takes input data $X_i$ and generates the corresponding predicted value $y_i$. To quantify the deviation between predicted and actual ICS measurements, an anomaly score $e_i$ is computed for each sample as

$$e_i=\left|y_i-y_i^{\prime }\right|.$$

(2)

Here, $y_i$ represents the observed value, and $y_i^{\prime }$ denotes the predicted value. Anomalies are identified using a threshold-based approach. A pre-defined threshold λ is used to compare the anomaly score $e_i$ and determine whether a data point is abnormal. The detection function $f\left(X_i\right)$ is formally defined as follows:

$$f\left(X_i\right)=\left\{\begin{array}{cc} Normal ,& e_i< \lambda \\ Abnormal ,& e_i\ge \lambda \end{array}\right.$$

(3)

When the detection function identifies an anomaly, the smart contract automatically triggers an alert, which is sent to the SCADA and HMI servers using Hypertext Transfer Protocol Application Programming Interface or WebSocket, ultimately notifying operators for immediate response. This design not only accelerates the response to abnormal events but also ensures the reliable operation of the ICS, establishing a secure and automated monitoring framework.

4. Conclusions

We developed a smart contract-based security platform for ICS, addressing existing deficiencies in data integrity and automated detection. Through blockchain technology, the developed platform achieved immutable operational records, providing reliable digital evidence for incident investigations. The integration of smart contracts significantly reduces the latency between anomaly detection and alerting, mitigating the risks of human operational errors or delays. Finally, the application of homomorphic encryption ensures the security of sensitive operational data during sharing and analysis. The results of this study demonstrate that combining distributed ledger technology with cryptographic computation provides a robust security framework for critical infrastructure. Future work will further explore the scalability and computational performance optimization of this architecture across diverse industrial scenarios.