Paper Title: Security of sensitive documents through a hybrid Bitcoin-Chia architecture using AI: a real-time secure framework
Authors: Hiyam Hashim Saeed, Ziyad Tariq Mustafa Al-Ta’i
Corresponding Author: Hiyam Hashim Saeed(scicomphd232403@uodiyala.edu.iq)/Iraq
Abstract
This paper focuses not on encryption or content access-control policies, but on forensic integrity and tamper-evident logging of sensitive documents. Ensuring confidential documents remain secure in today’s digital ecosystems is both a challenge and a trilemma: how to ensure cryptographic integrity, keep the operations of the system available, and respond intelligently and contextually to threats. Current SIEM solutions have high false-positive rates, and no logging solution today provides the forensic integrity essential for automated response processes. This research paper proposes a new Autonomous AI-driven Blockchain Security Lifecycle Architecture and empirically demonstrates 97.64% classification accuracy of 97.64% in a production environment, with the ability to log any modification to sensitive configurations and create a tamper-evident record on the blockchain. Moving beyond simulation-based research, we implement and test the framework on a real-time production server with a 20-core CPU and 48 GB of RAM. The system has a core based on version 30 of Bitcoin Core as an unalterable trust anchor, the Chia Network as a resilient peer-to-peer network to support failover, and Gemma-7b-Instruct Large Language Models (LLMs) that are locally deployed through Ollama to detect contextual anomalies. Wazuh handles telemetry ingestion, while IRIS provides Security Orchestration, Automation, and Response (SOAR) and runs automated playbooks aligned with NIST SP 800-61. Empirical evaluations demonstrate a 97.64% accuracy in detecting attacks, a reduction in Mean Time to Respond (MTTR) of 642.5 s to 16.15 s, and automatic failover to prevent data loss during failure of one of the nodes. Wazuh’s File Integrity Monitoring (FIM) is a framework tested for 90 days that has achieved 97.64% accuracy in identifying whether a file change is legitimate or suspicious. Additionally, using a local LLM reduces false positives by 86.5% compared to rule-based baselines, making it a promising approach for privacy-preserving self-healing cybersecurity models.
