# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 5 Integration of Blockchain Systems into a Big Data Ecosystem: A Case Study  
In an effort to assist the reader to understand our proposal in greater depth, as well as to provide clarity as regards the more technological details of its implementation, this section presents a case study that implements a blockchain solution. This case study should be considered as an example to demonstrate the feasibility of our proposal. This example is applied to an experimental hydroponic crop that we have designed, implemented and automatized. This type of cultivation has become very popular in recent times, due to its reduced demand for water, the use of nutrients instead of soil to ensure its growth, and the smaller surface area needed to produce benefits. The problem that is presented, however, is that these kinds of cultivation require greater attention on the part of the producer ([[https://www.weforum.org/agenda/2019/02/hydroponics-future-of-farming/](https://www.weforum.org/agenda/2019/02/hydroponics-future-of-farming/)]([https://www.weforum.org/agenda/2019/02/hydroponics-future-of-farming/](https://www.weforum.org/agenda/2019/02/hydroponics-future-of-farming/))). To solve that problem, our research group created a prototype solution based on cyber-physical systems (CPS). This CPS system has a series of sensors and actuators that in turn are controlled by a big data ecosystem. This big data ecosystem makes the necessary decisions as to when to activate the actuators, depending on the readings of the sensors. For example, it controls the optimal temperature for plant growth or the nutrients needed at any given time. These sensors are very varied, and the analysis of the data they generate must be performed in near real time in order to trigger the actuators; it was thus decided to use big data technologies to control this. This system is not beyond the danger of cyberattacks; in fact, it is especially sensitive to them, since the modification or masking of the values or readings produced by the sensors could lead to the loss of all plants. This being the case, we decided to incorporate our blockchain solution to control the production phase of this environment. Figure 6 shows the global architecture of the implemented system, including the blockchain-based systems that store the different events and incidents that occur in the CPS system. Figure 6: General architecture of the case study. As can be seen in the figure, the hydroponic crop has a number of sensors that generate a flow of data that feeds the big data ecosystem. Depending on the data analyzed, the different actuators are activated or deactivated; they can also be activated manually by means of a control panel. In addition, any action that occurs in the big data ecosystem is stored as an event in the event blockchain. This includes all actions ranging from the actions performed by the actuators to the operations performed on the data set. Once you have a collection of events, a machine learning process is applied, consisting of the following phases: first, there is a detection of outliers using the PCA anomaly detection algorithm, then the incident response team tags the results from the previous step, indicating whether it is an incident or not. This outcome is subsequently used as a way to train a neural network, so that after a series of iterations, it is able to identify when an incident has occurred automatically and without human intervention. The choice of a neural network is because of its fault tolerance, since in this type of scenario it is common to label a security incident incorrectly; it is also chosen for its ability to work in real time, which makes it a good tool for incident detection during the operational phase. These algorithms are performed by using the TensorFlow tool. However, this case study is under development and we do not have enough data to obtain relevant results although, as stated on the related work section, there are successful proposals that apply these techniques to discover security problems.