Decentralized networks—spanning Internet-of-Things deployments, edge computing platforms and peer-to-peer systems—offer improved scalability, resilience and the elimination of single points of failure. At the same time, their distributed structure makes continuous monitoring and timely intrusion response substantially more difficult. Traditional signature-based intrusion detection systems (IDS) are effective only against previously catalogued attacks; they cannot reliably detect zero-day or heavily obfuscated threats and typically require the centralised collection of raw traffic, thereby raising privacy, bandwidth and single-point-of-failure concerns.This paper presents a complete real-time machine-learning-based user detection and intrusion prevention system expressly designed for decentralised environments. A lightweight monitoring agent executes on every registered physical node, continuously captures live network packets, groups them into traffic flows and extracts a compact set of discriminative features: packet rate, bandwidth usage, latency, failed login attempts and connection duration. These features are classified by a Random Forest ensemble that distinguishes authorised from unauthorised activity. Concurrently, an Isolation Forest anomaly detector flags behavioural outliers that may correspond to previously unseen (zero-day) attacks. For every prediction the system computes a continuous risk score, assigns a discrete threat level (Low, Medium, High or Critical), records an immutable event log entry, displays a real-time alert together with an AI-generated explanation on the administrator dashboard, and—when prevention mode is enabled—automatically installs firewall rules that block the offending traffic. Because only summarised detection results are forwarded to the central monitoring dashboard, raw packet data never leave the local node; privacy is preserved and inter-node communication overhead is minimised. Extensive evaluation on labelled network traffic demonstrates an accuracy of 96.80%, precision of 95.40%, recall of 94.20% and F1-score of 94.80%, markedly surpassing a conventional signature-based baseline. The system maintains normal network performance under both typical and elevated traffic loads, confirming that intelligent detection need not be purchased at the expense of operational efficiency.

REFERENCES

[1]. Friha, O., Ferrag, M. A., Shu, L., Maglaras, L., & Wang, X. (2023). 2DF-IDS: Decentralized and differentially private federated learning-based intrusion detection system for industrial Internet of Things. Computers & Security, 127, 103097.

[2]. García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2019). Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers & Security, 28(1–2), 18–28.

[3]. Kairouz, P., McMahan, H. B., et al. (2021). Advances and open problems in federated learning. Foundations and Trends in Machine Learning, 14(1–2), 1–210.

[4]. Li, J., Xu, H., & Zhang, Y. (2021). Blockchain-based secure data sharing for intrusion detection in distributed networks. Information Sciences, 569, 60–75.

[5]. Lu, C., Cao, Y., & Wang, Z. (2024). Research on intrusion detection based on an enhanced random forest algorithm. Applied Sciences, 14(2), 714.

[6]. McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & y Arcas, B. A. (2019). Communication-efficient learning of deep networks from decentralized data. In Proceedings of AISTATS (pp. 1273–1282).

[7]. Pramilarani, K., Rajkumar, N., et al. (2024). Cost-based Random Forest classifier for intrusion detection system. Applied Soft Computing.

[8]. Sharma, P. K., Singh, A., & Tanwar, S. (2022). Blockchain-federated-learning-based intrusion detection for industrial IoT networks. IEEE Internet of Things Journal, 9(18), 17124–17135. [

9]. Sommer, R., & Paxson, V. (2010). Outside the closed world: On using machine learning for network intrusion detection. IEEE Symposium on Security and Privacy. [10]. Vyas, A., et al. (2024). Privacy-preserving federated learning for intrusion detection. IEEE Access.

[11]. Canadian Institute for Cybersecurity. (2017). CICIDS2017 dataset. University of New Brunswick.