Users tend not to change the default settings, including the authentication credentials, and not to update the firmware of the device as this usually is a complex procedure for any novice user. There are many problems regarding the security of IoT devices [3; 4; 5; 6]. Some of those are:  
* The installed firmware is usually out of date. Manufacturers do not provide the required support for their devices. Even if they do so, users do not systematically update the firmware of already deployed devices. * Sophisticated security mechanisms are typically not embedded into devices. The cost of IoT devices is low and it is impossible for a manufacturer to produce secure IoT devices that will be competitive in the end-user market. * Users usually do not interact with devices. They do not configure the device's settings and they never change the default authentication credentials. This renders IoT devices vulnerable to malicious users that want to take control of them. * Devices are not built from scratch, even by large manufacturers. Reuse of parts produced by unknown vendors, which do not take into account basic security requirements, is a common approach between manufacturers. The growth of the use of IoT devices, along with the aforementioned issues, have formed an ideal environment for malicious users to commit various cyber-attacks. These attacks may violate users' privacy, aim for economical profit, or just aim to disrupt the normal operation of underlying systems and services. Some of the most significant IoT related cyber-attacks, observed recently, were distributed denial of service (DDoS) attacks [7]. The rise of IoT computing has practically provided the means to enlarge existing DDoS attacks, which were previously committed through the use of normal desktop computers or servers. During September of 2016, a DDoS attack was launched against [PERSON] website [8], the magnitude of which was larger than that of any other previous similar attempt. The attack was conducted by a botnet, composed of approximately one million devices, most of which were Internet protocol (IP) cameras. In a later stage, the source code of Mirai [9; 10], the botnet that was employed during the attack against the [PERSON] website, was released and the simple principle upon which Mirai is based was revealed. It scans the internet for accessible devices protected by factory-default usernames and passwords and it takes control of these devices, in order to form the botnet network. The Mirai attack has brought into daylight the important security implications of IoT computing and the fact that insecure devices, with default credentials, are exposed to the internet in masses [11; 12]. In this paper, an agent based approach to detect DDoS attacks that are executed through the use of multiple infected IoT devices is presented. In such attacks, infected devices form a botnet that sends a high load of traffic to a victim host, in order to set the latter unable to respond to normal requests. The contribution of the paper is a protocol that enables multiple agents that are installed on gateways of different sites of IoT installations, to collaborate on detecting DDoS attacks. These agents collaborate through exchanging traffic information, while at the same time they utilize a blockchain infrastructure, in order to securely reach a consensus about the information metrics that are locally calculated at the gateways of the system. The present paper is an extended version of the paper entitled \"Collaborative Agent-based Detection of DDoS IoT Botnets\" by [PERSON] et al. [13]. The main contribution of the extended version is a blockchain based consensus mechanism, in order for agents to be able to collaboratively detect DDoS attacks. Specifically, Section 5 and Sections 2.2, 6.2 are completely new in the extended version of the paper. Section 2.2 presents state of the art with respect to the use of blockchain technology regarding detection and mitigation of DDoS attacks.