Paper deep dive

MI$^2$DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks

Wei Lian, Alejandro Guerra-Manzanares

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 54

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%

Last extracted: 7/20/2026, 7:27:13 AM

Summary

The paper proposes MI2DAS, a multi-layer intrusion detection framework for Industrial IoT (IIoT) networks that integrates anomaly-based hierarchical traffic pooling, open-set recognition, and incremental learning to detect known and unknown attacks with minimal labeling. Evaluated on the Edge-IIoTset dataset, the framework uses GMM for initial normal-attack discrimination, LOF for unknown attack detection, Random Forest for fine-grained classification, and semi-supervised/active learning for adapting to novel threats.

Entities (9)

MI2DAS · framework · 98%Edge-IIoTset · dataset · 95%Industrial IoT · domain · 95%GMM · algorithm · 92%LOF · algorithm · 92%Random Forest · algorithm · 92%Incremental Learning · technique · 90%Active Learning · technique · 88%Semi-Supervised Learning · technique · 88%

Relation Signals (8)

MI2DAS → evaluatedon → Edge-IIoTset

confidence 98% · Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers.

MI2DAS → targets → Industrial IoT

confidence 95% · MI2DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks

MI2DAS → uses → Random Forest

confidence 95% · For fine-grained classification of known attacks, Random Forest achieves a macro-F1 of 0.941.

MI2DAS → uses → GMM

confidence 95% · In the first layer, GMM achieves superior normal-attack discrimination... In open-set recognition, GMM attains a recall...

MI2DAS → uses → LOF

confidence 95% · LOF achieves 0.882 recall for unknown attacks.

MI2DAS → applies → Incremental Learning

confidence 90% · ...incremental learning for adapting to novel attack types with minimal labeling.

Incremental Learning → includes → Semi-Supervised Learning

confidence 90% · we propose two incremental learning strategies... Semi-Supervised Learning (SSL) and Active Learning (AL).

Incremental Learning → includes → Active Learning

confidence 90% · we propose two incremental learning strategies... Semi-Supervised Learning (SSL) and Active Learning (AL).

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:The rapid expansion of Industrial IoT (IIoT) systems has amplified security challenges, as heterogeneous devices and dynamic traffic patterns increase exposure to sophisticated and previously unseen cyberattacks. Traditional intrusion detection systems often struggle in such environments due to their reliance on extensive labeled data and limited ability to detect new threats. To address these challenges, we propose MI$^2$DAS, a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling, open-set recognition to distinguish between known and unknown attacks and incremental learning for adapting to novel attack types with minimal labeling. Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers. In the first layer, GMM achieves superior normal-attack discrimination (accuracy = 0.953, TPR = 1.000). In open-set recognition, GMM attains a recall of 0.813 for known attacks, while LOF achieves 0.882 recall for unknown attacks. For fine-grained classification of known attacks, Random Forest achieves a macro-F1 of 0.941. Finally, the incremental learning module maintains robust performance when incorporation novel attack classes, achieving a macro-F1 of 0.8995. These results showcase MI$^2$DAS as an effective, scalable and adaptive framework for enhancing IIoT security against evolving threats.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

52,714 characters extracted from source content.

Expand or collapse full text

MI 2 DAS: A Multi‑Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks Wei Lian and Alejandro Guerra-Manzanares a b School of Computer Science, University of Nottingham, Ningbo, China Keywords: Machine Learning, Incremental Learning, Industrial IoT, IIoT, Intrusion Detection System, Adaptive, IDS, Botnet, Attack Detection, Attack Evolution, Continual Learning, Novel Attack Detection, Threat Evolution Abstract: The rapid expansion of Industrial IoT (IIoT) systems has amplified security challenges, as het- erogeneous devices and dynamic traﬀic patterns increase exposure to sophisticated and previously unseen cyberattacks. Traditional intrusion detection systems often struggle in such environments due to their reliance on extensive labeled data and limited ability to detect new threats. To address these challenges, we propose MI 2 DAS, a multi‑layer intrusion detection framework that integrates anomaly‑based hierarchical traﬀic pooling, open‑set recognition to distinguish between known and unknown attacks and incremental learning for adapting to novel attack types with minimal label- ing. Experiments conducted on the Edge‑IIoTset dataset demonstrate strong performance across all layers. In the first layer, GMM achieves superior normal‑attack discrimination (accuracy = 0.953, TPR = 1.000). In open‑set recognition, GMM attains a recall of 0.813 for known attacks, while LOF achieves 0.882 recall for unknown attacks. For fine‑grained classification of known attacks, Random Forest achieves a macro‑F1 of 0.941. Finally, the incremental learning module maintains robust performance when incorporating novel attack classes, achieving a macro-F1 of 0.8995. These results showcase MI 2 DAS as an effective, scalable and adaptive framework for en- hancing IIoT security against evolving threats. 1 INTRODUCTION The Internet of Things (IoT) stands as a founda- tional pillar of next-generation information tech- nology, seamlessly connecting the physical and digital worlds through the integration of sen- sors, embedded systems, wireless communica- tion and cloud computing (European Commis- sion, 2025). At its core, IoT empowers previ- ously isolated devices with environmental aware- ness, intelligent connectivity and autonomous op- erational capabilities, reshaping industrial pro- cesses and daily life. For instance, smart sensors enable real-time monitoring, predictive mainte- nance and enhanced decision-making across do- mains from smart cities to healthcare and preci- sion agriculture (Rathi et al., 2025). The num- ber of IoT devices was estimated at 18.5 billion a https://orcid.org/0000-0002-3655-5804 b Correspondingauthor:alejan- dro.guerra@nottingham.edu.cn in 2024 and is projected to grow to 24 billion by 2026, reach 39 billion by 2030 and exceed 50 bil- lion by 2035 (Sinha, 2025), spanning a wide range of applications including smart cities, Industry 4.0, healthcare and agricultural monitoring (Rath et al., 2024), with widespread adoption enhancing operational eﬀiciency and resource management. As a key branch of IoT, the Industrial Internet of Things (IIoT) integrates IoT technologies into industrial environments. Unlike consumer IoT, it emphasizes reliability, real-time performance, controllability and security (Sisinni et al., 2018). By deploying large-scale sensors, actuators, in- dustrial control systems (ICS) and edge comput- ing devices, IIoT facilitates extensive industrial data collection and intelligent analysis, enabling predictive maintenance, automated scheduling and system optimization (Kapoor et al., 2025). It has seen widespread adoption across manufac- turing, energy, smart grids and healthcare, be- coming a cornerstone of Industry 4.0 and intel- arXiv:2602.23846v1 [cs.CR] 27 Feb 2026 ligent manufacturing while improving eﬀiciency, reducing maintenance costs and enhancing oper- ational flexibility (Angurala et al., 2024). How- ever, the increasing connectivity and openness of IIoT expose industrial infrastructures to growing cybersecurity threats. Unlike traditional IT net- works, IIoT devices are resource-constrained, rely on lightweight protocols such as MQTT and Mod- bus, operate in time-critical environments and have long life cycles with limited update capabil- ities (Sisinni et al., 2018). These characteristics significantly expand the attack surface and mag- nify the impact of intrusions, potentially resulting in process manipulation, production disruptions, or large-scale safety incidents, making robust In- trusion Detection Systems (IDS) essential for in- dustrial cybersecurity (Cecílio and Souto, 2024). Existing IDS approaches for IIoT face several significant challenges: (i) struggle with massive, high-dimensional, heterogeneous data streams that show strong temporal dependencies, mak- ing real-time detection diﬀicult; (i) the scarcity of labeled attack samples (especially for emerg- ing, low-frequency attacks) raises the risk of mis- classification; severe class imbalance, where nor- mal traﬀic vastly dominates, degrades the perfor- mance of supervised models; and (i) the rapid emergence of novel, zero-day attacks outpaces traditional signature-based techniques. To overcome these limitations, a dedicated IIoT intrusion detection architecture is required that enhances the separability between normal and malicious traﬀic, eﬀiciently handles high- dimensional and imbalanced data and detects novel or zero-day attacks. Achieving these ob- jectives is critical for safeguarding industrial in- frastructures, preventing economic losses and en- abling the transition towards intelligent, resilient industrial systems. Addressing these needs, our main contributions are: 1. We propose the Multi-layer IIoT Intrusion De- tection Adaptive System (MI 2 DAS) architec- ture that integrates sequential pooling and classification, enabling accurate separation of normal and attack traﬀic, effective discrimi- nation between known and unknown threats and incremental discovery and adaptation to emerging attacks. 2. We perform a comprehensive evaluation of algorithms, identifying complementary strengths and determining the optimal models for each layer within the proposed architecture 3. We develop an incremental classifier integrat- ing semi-supervised learning or active learning approaches, enabling the continual incorpora- tion of new attack types with minimal labeling effort 4. We conduct extensive experiments on the Edge-IIoTset dataset to validate the effective- ness and scalability of the proposed architec- ture. The results demonstrate that the system remains robust under varying attack distribu- tions and across incremental learning stages. The structure of this paper is as follows: Sec- tion 2 reviews related work on IIoT intrusion de- tection. Section 3 details the proposed multi- layer intrusion detection framework, MI 2 DAS. Section 4 provides the experimental results and analysis, while Section 5 states the limitations of our study. Finally, Section 6 summarizes the study and outlines future research directions. 2 RELATED WORK IDS have evolved significantly with the advance- ment of Machine Learning (ML) and Deep Learn- ing (DL) techniques, which enable eﬀicient pro- cessing of high-volume network traﬀic with com- plex spatiotemporal patterns. Meanwhile, the unique characteristics of the IIoT have driven the development of specialized intrusion detection so- lutions. This section reviews relevant research on general network intrusion detection algorithms and IIoT-specific IDS. 2.1 ML-based IDS In the context of traditional (non-IoT) networks, ML methods remain widely adopted in intrusion detection due to their eﬀiciency, interpretabil- ity and low resource requirements (Ali et al., 2025). Ahmed et al. (2022) combined SMOTE oversampling with multi-stage feature selection to optimize Ramdom Forest (RF), achieving 95.1% accuracy on UNSW-NB15, obtaining better ac- curacy than models trained on raw imbalanced data. Kasongo and Sun (2020) leveraged the gradient boosting model, XGBoost, to select 19 critical features from the 44-dimensional UNSW- NB15 dataset, improving detection accuracy and reducing computational overhead for real-time applications. Although they were only evaluated in non-IoT networks, these optimized pipelines may also benefit resource-constrained IoT sys- tems. DL methods learn hierarchical features with- out manual engineering, enabling them to capture complex decision boundaries and significantly im- prove intrusion detection (Ali et al., 2025). Con- volutional neural networks (CNN) effectively ex- tract spatial features and, when applied to the CSE-CIC-IDS2018 dataset, achieved 91.5% ac- curacy in detecting DoS attacks (Kim et al., 2020). A hybrid CNN–LSTM architecture, com- bined with data balancing techniques, achieved over 99% accuracy on the UNSW-NB15 and CIC- IDS2018 datasets (Al and Dener, 2021). Address- ing labeling challenges, Shone et al. (2018) pro- posed an autoencoder-based unsupervised feature learning framework followed by RF classification, achieving good results on NSL-KDD. 2.2 Intrusion Detection in IIoT IIoT environments, which integrate ICS, sen- sor networks and cloud/edge infrastructures, face significant challenges such as protocol hetero- geneity (e.g., Modbus, CAN, MQTT), strict la- tency demands, resource-limited edge devices and evolving attack surfaces (Sisinni et al., 2018). Optimized ML pipelines are widely adopted in IIoT environments due to their low computa- tional overhead. In this regard, Kasongo and Sun (2020) used XGBoost-based feature selec- tion and achieved real-time detection with la- tency lower than 50ms on IIoT-like traﬀic, while Talukder et al. (2024) combined random over- sampling and stacking feature embedding to im- prove performance on IIoT-related attacks, reach- ing 99.95% accuracy on CIC-IDS2017 and reduc- ing false positives by 62%. Mohy-eddine et al. (2022) proposed a lightweight hybrid model com- bining Pearson’s correlation coeﬀicient, Isolation Forest (IF) and RF, which achieved 98.3% accu- racy on BoT-IoT. Hybrid DNN/CNN–LSTM frameworks tai- lored for protocols such as Modbus/TCP can extract protocol-aware features and sequential control command patterns, achieving high DoS detection accuracy with low inference laten- cies (Halbouni et al., 2022). Similarly, protocol- specific approaches, such as Deng and Liu (2022) voltage fingerprint-based IDS for CAN bus net- works leverage physical-layer characteristics to reach 99.2% with<1ms latency. Lo et al. (2022) proposed E-GraphSAGE, the first Graph Neural Network-based IIoT IDS that integrates edge fea- tures and network topology to capture collabo- rative malicious behaviors among compromised devices, achieving F1-scores up to 1.0 on BoT- IoT. Sáez-de Cámara et al. (2023) proposed a privacy-preserving architecture to train unsuper- vised models for network intrusion detection in large, distributed IoT and IIoT deployments. Although existing methods address specific challenges within IIoT networks, our proposed approach, MI 2 DAS, tackles the core challenges in IIoT environments by employing lightweight models, eﬀiciently managing high-dimensional and imbalanced data and enabling effective de- tection of novel attack types. By incorporat- ing new attacks into the detection pipeline via semi-supervised and active learning strategies, MI 2 DAS not only maintains high performance, but also reduces the need for extensive manual labeling. 3 METHODOLOGY The proposed methodology introduces a multi- layer intrusion detection architecture tailored for IIoT environments, addressing three core security challenges: • Intrusion detection. The proposed system ef- fectively distinguishes normal traﬀic from ma- licious activity at the network edge. • Novel attack detection. The architecture en- ables the identification of previously unseen or zero-day attacks. • Adaptive continuous learning. The system maintains detection performance in the pres- ence of evolving attack types by incrementally incorporating new threats under limited label- ing resources. The proposed architecture is organized into three sequential layers, each addressing a distinct functional requirement: • Layer 1: Traﬀic Filtering and Normal Flow Processing. Performs the initial binary sep- aration of traﬀic, distinguishing benign flows from suspicious ones at the network edge. • Layer 2: Novelty Detection and Known At- tack Classification. Identifies previously un- seen attack patterns while classifying traﬀic into established attack categories at the net- work edge. • Layer 3: Incremental Learning and Adaptive Modeling. Unseen attack patterns are relayed to the central server for analysis by the edge nodes. This layer incrementally incorporates new attack types into the detection pipeline, enabling the system to maintain performance under evolving threats. Figure 1 illustrates the architectural design of the proposed system. The hierarchical struc- ture enables IIoT devices to perform lightweight, early-stage traﬀic filtering (Layer 1: normal vs. attack traﬀic separation; Layer 2: known vs. un- known attack separation and known attack clas- sification), while the server-side model performs progressively refined traﬀic analysis and dynami- cally updates the detection capabilities of the sys- tem to evolving threats. As depicted in Figure 1, the MI 2 DAS architec- ture is composed of three core modules, outlined as follows and elaborated in the subsequent sub- sections: • Data Pooling Module. This module comprises two layers, which are deployed on edge de- vices. It performs traﬀic filtering at multiple levels of granularity, organizing flows into dis- tinct data pools to enable eﬀicient subsequent analysis. The two‑level module is enclosed in a purple box in Figure 1. • Attack Classification Module. This edge- device component provides a fine-grained cat- egorization of known attack types, enabling accurate identification and differentiation of malicious traﬀic patterns (attacks). This layer 2 module is highlighted in an orange box in Figure 1. • Incremental Attack Update Module. This server-side component is designed to main- tain detection performance under evolving threats. This module incrementally incorpo- rates newly emerging attack types using semi- supervised and active learning strategies, re- ducing the need of extensive manual annota- tion. Figure 1 highlights this layer 3 module within a green box. 3.1 Data Pooling Module The Data Pooling Module (DPM), is composed of two layers deployed on edge devices. It performs a two-stage hierarchical partitioning of raw network traﬀic, classifying incoming data into different data pools. It adopts novelty detection and out- lier detection models to minimize dependency on labeled attack samples and to ensure system func- tionality under real-world class-imbalance scenar- ios. 3.1.1 First DPM Layer: Normal vs. Attack The first-level detector separates benign traﬀic from anomalous patterns using novelty detection or outlier detection techniques. Since only nor- mal traﬀic is guaranteed to be available at de- ployment time, the system leverages unsuper- vised boundary-learning models, such as (Chan- dola et al., 2009): 1. One-Class Support Vector Machines (OC- SVM): It constructs a decision boundary in a high-dimensional feature space around normal traﬀic using a maximum-margin formulation. This approach is effective for modeling com- pact normal patterns, but its performance is highly sensitive to the choice of kernel func- tion. 2. Gaussian Mixture Models (GMM): It models data as a weighted mixture of Gaussian com- ponents and performs anomaly detection by evaluating the likelihood of a sample under the estimated density. Its probabilistic and multi-modal representation provides flexibil- ity for capturing heterogeneous normal behav- iors. 3. Local Outlier Factor (LOF): It quantifies the local density deviation of each sample rela- tive to its neighbors, assigning higher anomaly scores to points that are locally sparse or iso- lated. As a non-parametric, density-based ap- proach, it is particularly effective at capturing context-dependent and irregular anomalies. Note that, depending on the characteristics of the data traﬀic, different anomaly detection models may show varying levels of effectiveness. In this regard, density-based approaches, such as LOF, are well-suited for capturing local ir- regularities, while probabilistic models like GMM are more effective at representing heterogeneous traﬀic distributions. Boundary-learning methods such as OC-SVM perform best when normal traf- fic patterns are compact and well-defined. The detection model is trained offline using only normal samples from the central server and then deployed to edge devices to execute real- time, per-sample traﬀic pooling. 3.1.2 Second DPM Layer: Open-Set Recognition for Attack Categorization As shown in Figure 1, traﬀic identified as abnor- mal in the first layer is further processed to dis- tinguish: Network traffic Central Server Normal TrafficNormal Traffic Processing Attack Traffic Known Attack Traffic Unknown Attack Pool Still Unknown Attacks New Known AttacksUpdated Attack Classification Model Normal or Attack Known or Unknown Edge Device Edge Device The updated model is distributed to edge devices Layer 1 Data Pooling Module (Layer 1) Data Pooling Module (Layer 2) Attack Classification Model Layer 2 Layer 3 Attack Classification Module Incremental learning strategy (SSL/AL) Incremental Attack Update Module Figure 1: Architecture of the Multi-Layer IIoT Intrusion Detection Adaptive System (MI 2 DAS). • Known attack categories, which are classified using supervised models trained on labeled at- tack samples. • Novel or unknown attack patterns, which are flagged through open-set recognition tech- niques and forwarded for adaptive learning. This stage again relies on novelty detection since only known attack categories are available during training. To accommodate diverse de- ployment scenarios, in our experiments, multiple attack-category partitions are considered, allow- ing edge devices to operate flexibly under hetero- geneous attack distributions. In our experiments, the models evaluated at this stage include OC- SVM, GMM, LOF and IF. As depicted in Fig- ure 1, the output of this layer is organized into a two-pool structure: a Known Attack Traﬀic pool and an Unknown Attack Pool, which sup- port downstream classification tasks (Section 3.2) and facilitate incremental model updates (Section 3.3), respectively. 3.2 Attack Classification Module The Attack Classification Module processes traf- fic assigned to the Known Attack Traﬀic pool (i.e., the output of the second DPM layer as de- scribed in Section 3.1.2), performing fine-grained traﬀic classification in established attack cat- egories. This component leverages supervised learning models specifically optimized for high- dimensional IIoT traﬀic, ensuring accurate dif- ferentiation among attack types. In our experimental setup, we evaluated two types of classification models: 1. Traditional ML Models. k-Nearest Neighbors (k-N), Support Vector Machines (SVM) and Logistic Regression (LR) were used as baseline classifiers. These models serve as benchmarks and provide interpretable decision boundaries. 2. Ensemble Models. To capture non-linear pat- terns and improve robustness, the following ensemble methods were adopted as core clas- sifiers: • RF: Bootstrap-aggregated decision trees that ensure stability and resistance to noise. • XGBoost: Gradient boosting trees with second-order optimization and built-in reg- ularization. • LightGBM: Gradient boosting trees opti- mized for eﬀiciency and scalability, incorpo- rating second-order optimization and regu- larization. Similar to the anomaly detection models de- scribed in Section 3.1.1, these classifiers are trained at the central server on structured at- tack features and subsequently deployed to edge devices to eﬀiciently classify traﬀic within the Known Attack Pool. 3.3 Incremental Attack Update Module The Incremental Attack Update Module ensures long-term adaptability by incorporating new at- tack types, using data assigned to the Unknown Attack Pool identified by the second DPM layer. as outlined in Section 3.1.2. Through contin- ual learning mechanisms, the taxonomy is incre- mentally expanded to incorporate novel attack classes, while mitigating catastrophic forgetting to preserve performance on previously learned categories. Note that since labeled data for new attack classes is often unavailable, the central server em- ploys incremental methods to further differenti- ate: • New attack types, which are incorporated into the system through incremental class expan- sion. • Still unknown attacks, which remain flagged for further analysis, labeling, or adaptive re- training in subsequent cycles. Based on the operational characteristics of IIoT environments, we propose two incremen- tal learning strategies for incremental learn- ing: Semi-Supervised Learning (SSL) and Active Learning (AL). They are briefly described as fol- lows: 1. Semi-Supervised Learning. This approach au- tomatically expands the labeled dataset by as- signing pseudo-labels to high-confidence un- known samples. Key algorithms include: self- training, label propagation and label spread- ing. This approach leverages the abundance of unlabeled data to improve model general- ization with minimal manual effort. 2. Active Learning. This strategy selects the most informative samples, using uncertainty- based or representativeness-based criteria, for manual expert annotation, minimizing the la- beling effort while maximizing the utility of newly labeled data. These strategies enables adaptive, incremental expansion of the attack taxonomy with minimal labeling efforts, avoiding full dataset retraining while preserving scalability and responsiveness in dynamic threat environments. The detailed incremental training procedure is presented in pseudocode in Algorithm 1. In our experimental setup, we evaluated three com- monly used SSL approaches: self-training, la- bel spreading and label propagation. For ac- tive learning, we used uncertainty-based sampling strategies to query the most informative instances for manual annotation. Note that, for compact- ness, we include both SSL and AL approaches within Algorithm 1, although in practice they would typically be employed independently de- pending on the availability of unlabeled data and labeling resources (i.e., human experts, often re- ferred to as oracles in the AL nomenclature). Data: Known Attack Pool KnownAttack , Unknown Attack Pool UnknownPool Result: Updated classifierCand refined UnknownPool Initialize seed setSfrom manually annotated samples; L←KnownAttack∪S; Initialize base classifierC; Initialize semi-supervised learnerSSL (i.e., self-training, label spreading or label propagation method) or active learnerAL; for each iteration do if Strategy = “SSL” then Generate pseudo-labels for subset U⊆UnknownPoolusingSSL; Select high-confidence pseudo-labeled setP; if UsePseudoLabeling = TRUE then L←L∪P; UnknownPool← UnknownPool ; else RetainPfor monitoring or validation only; end else if Strategy = “AL” then Select most informative samples Q⊆UnknownPoolusingAL(e.g., uncertainty sampling); Query ground-truth labels forQ from human oracle; L←L∪Q; UnknownPool←UnknownPool ; end Retrain classifierCon updated labeled setL; if convergence criterion satisfied then break; end end Algorithm 1: Adaptive model training via SSL and AL 3.4 Summary of Methodological Advantages This study introduces MI 2 DAS, a multi-level intrusion detection architecture specifically de- signed for IIoT environments. The proposed framework addresses key challenges inherent to IIoT environments, including limited computa- tional resources, scarcity of labeled training data, class imbalance and the continuous emergence of novel threats. The architecture is organized as a hierarchical collaboration of three core modules: • Data Pooling: Aggregates heterogeneous IIoT traﬀic into structured pools, facilitating hi- erarchical organization and enabling eﬀicient separation of normal and malicious flows at multiple levels of granularity. • Attack Classification: Employs super- vised learning models optimized for high- dimensional IIoT traﬀic to achieve fine- grained categorization of known attack types. • Incremental Attack Update: Ensures long- term adaptability through continual learning, dynamically integrating newly discovered at- tack classes while mitigating catastrophic for- getting. Integrated within a unified pipeline, as de- picted in Figure 1, the modules enable continual learning and adaptive intrusion detection, ensur- ing eﬀicient operation while preserving robustness against the dynamic threat landscape of IIoT sys- tems. 4 RESULTS & DISCUSSION This section presents a comprehensive evaluation of the proposed multi-layer intrusion detection and continual learning pipeline. To validate the effectiveness of the architecture, four experiments are conducted, each corresponding to one of the operational stages of the system. For every exper- iment, we detail the experimental design, report the results and provide in-depth discussion, with supporting tables and figures referenced where appropriate. 4.1 Dataset The experiments are based on the Edge-IIoTset dataset (Ferrag et al., 2022), a large-scale indus- trial IoT traﬀic dataset specifically designed for evaluating intrusion detection systems for IIoT networks. Specifically, it contains: • Normal Traﬀic: Generated by benign indus- trial control system operations, representing baseline IIoT behavior. • Attack Traﬀic: Fourteen distinct classes, including Distributed Denial-of-Service (DDoS) attacks (TCP/UDP/ICMP/HTTP), password-based attacks, backdoor intrusions, Man-In-The-Middle (MITM), SQL injection, fingerprinting, vulnerability scanning, cross- site scripting (XSS), malicious file uploading and other threats. • Feature Space: High-dimensional and hetero- geneous, extracted from both network flow statistics and IoT protocol-level interactions. To avoid overfitting, we excluded eight topol- ogy‑dependent features (e.g., IPs), resulting in a final set of 53 features. • Class Imbalance: The dataset has a signifi- cantly skewed data distribution, with normal traﬀic making up most of the data while some attack categories have only a small number of samples. This diversity and imbalance make Edge- IIoTset an appropriate benchmark for simulating realistic IIoT environments, where normal traf- fic constitutes the majority, novel attacks emerge continuously and labeled samples are scarce. Note that while the complete dataset comprises ≈20million IIoT traﬀic records, for reproducibil- ity, we rely on the oﬀicial dataset splits. Specif- ically, Table 1 provides the class distribution of the randomly selected subsets of data for ML al- gorithms from the Edge-IIoTset dataset accord- ing to the oﬀicial training-test partition provided by the authors (Ferrag et al., 2022). 4.2 DPM Layer 1: Normal or Attack The first DPM layer serves as the system’s initial defense layer, designed to filter malicious traﬀic from legitimate and normal activity. All exper- iments use the Edge-IIoTset dataset, which in- cludes normal traﬀic and fourteen different attack types, as described in Table 1. In this experiment, two anomaly detection paradigms are considered: Novelty detection, which trains the model exclusively on normal traf- fic under the assumption that anomalies (attacks) are absent during training, thus modeling the Table 1: Dataset class distribution (Ferrag et al., 2022) ClassTotalTrainingTest Normal24301192814820 Backdoor1019578921973 DDoS_HTTP1056183962099 DDoS_ICMP14090104772619 DDoS_TCP1024781982049 DDoS_UDP14498115982900 Fingerprinting1001682171 MITM121428672 Password998979781994 Port Scanning1007171371784 Ransomware1092577511938 SQL Injection1031182252057 Uploading1026981712043 Vulnerability Scan1007680502012 XSS attack1005276341909 challenge of zero-day attack detection; and out- lier detection, which trains the model on predom- inantly normal traﬀic with a minor proportion of attack samples (100:1 ratio), assuming contami- nation in the training set and simulating lightly contaminated real-world environments. Two balanced test sets are constructed: one comprising 1,000 normal and 1,000 attack sam- ples and another comprising 5,000 normal and 5,000 attack samples. At this layer, the mod- els evaluated include OC-SVM, GMM and LOF. Model performance is assessed using accuracy, True Positive Rate (TPR, also known as Recall), False Positive Rate (FPR) and precision. We conduct multiple iterations for each model using different hyperparameter configurations to ensure robust performance evaluation. 4.2.1 Experiment Results In our experiments, GMM consistently yields the highest performance across both novelty and out- lier detection settings, highlighting its strong abil- ity to model complex traﬀic distributions and adapt to varying contamination levels. OC- SVM achieves perfect recall in the novelty set- ting, demonstrating its effectiveness in detecting all attacks when trained on clean data. How- ever, it produces a high number of false alarms (FPR 0.410), which limits its practical applicabil- ity in this scenario. LOF shows unstable perfor- mance with significant variance across test sub- sets, likely due to its reliance on local density estimation, which is sensitive to heterogeneous and high-dimensional IIoT traﬀic. The top three GMM results for each detection setting are pre- sented in Table 2. Table 2: Top-3 GMM performance per setting. The parameter nc denotes the number of mixture compo- nents, while th_per indicates the threshold percentile used for anomaly classification. The best results are highlighted in bold. SettingParameterAcc.TPRFPRPr. Novelty nc=2, th_per=50.9531.0000.0950.914 nc=4, th_per=50.9501.0000.0990.910 nc=3, th_per=50.9501.0000.1000.909 Outlier nc=2, th_per=50.9441.0000.1120.899 nc=4, th_per=50.8101.0000.3810.724 nc=3, th_per=50.8041.0000.3920.718 4.2.2 Discussion The first DPM layer requires extremely high re- call to prevent attacks from passing to subse- quent stages. At the same time, controlling the FPR is critical to minimize false alarms and pre- vent misclassification of a large proportion of nor- mal traﬀic. Among the evaluated models, GMM achieves a superior balance of high recall and low FPR, making it the most effective choice for this layer. These results demonstrate that a proba- bilistic density-based approach is best suited for the heterogeneous and high-variance IIoT traf- fic patterns observed in the Edge-IIoTset dataset, where accurate modeling of complex distributions is essential for robust anomaly detection. 4.3 DPM Layer 2: Open-Set Recognition for Attack Categorization The second DPM layer further refines the filtering process by separating attack traﬀic (output from the first DPM layer) into two categories: known attack types, which are used for supervised learn- ing later and unknown attack types, which are isolated to prevent unseen attack behaviors from contaminating the supervised classifier. To assess the robustness of our approach, we designed five experimental configurations using the EdgeIIoT dataset. Each configuration varies the proportion of known and unknown attack types to simulate different levels of uncertainty in real-world scenarios. Specifically, the configu- rations are: (i) 1 known attack type and 13 un- known types, (i) 4 known and 10 unknown, (i) 7 known and 7 unknown, (iv) 10 known and 4 un- known and (v) 13 known and 1 unknown. This progressive variation allows us to evaluate how the system performs when the classifier has mini- mal prior knowledge versus when it has extensive prior knowledge of attack behaviors. We evalu- ate four anomaly detection models, i.e., GMM, LOF, OC-SVM and IF. For each configuration, we systematically evaluate all possible combina- tions of known and unknown attack types. For example, in the configuration with 1 known and 13 unknown attacks, there are 14 possible combi- nations (choosing which single attack is known). In contrast, the configuration with 7 known and 7 unknown attacks yields 3,432 possible combi- nations. This exhaustive evaluation ensures that our results are not biased by a specific selection of attack types and provides a comprehensive assess- ment of model performance under varying knowl- edge distributions. 4.3.1 Experiment Results In our experiments, across all configurations, GMM and LOF consistently outperform OC- SVM and IF. Figure 2 presents boxplots summa- rizing the performance across all possible combi- nations of known and unknown attack types. Fig- ure 2 also highlights performance biases in LOF and GMM, suggesting that these models tend to favor specific distributions of known and un- known attacks, which may influence their gener- alization capability. 4.3.2 Discussion In the second DPM layer, GMM and LOF show complementary strengths in recognizing known and unknown attack types. As shown in Fig- ure 2, GMM achieves strong recall for known at- tacks, with an average of 0.813±0.086, whereas LOF demonstrates superior recall for unknown attacks, averaging 0.882±0.080. These results in- dicate that density-based (LOF) and probabilistic (GMM) approaches are better suited to capture the complex distribution of IIoT attack behaviors compared to margin-based (OC-SVM) and tree- based (IF) methods. The complementarity be- tween GMM and LOF suggests that probabilis- tic modeling particularly effective when attack patterns are well-represented in training data, whereas LOF’s density-based approach is more effective in detecting deviations from the training data, making it particularly suitable for identify- ing novel threats. This highlights the potential of hybrid strategies that combine both methods to achieve balanced detection performance across both known and unknown attack spaces. 4.4 Attack Classification Module The attack classification model in the ACM mod- ule processes Known Attack Traﬀic and assigns each sample to its corresponding attack category, performing multiclass classification. In our experimental setup, we evaluate six classification methods (as described in Sec- tion 3.2) under multiple configurations. Specif- ically, we perform 50 random combinations of known attack sets for each scenario involving 4 Known, 7 Known and 10 Known classes. Ad- ditionally, we evaluate all 14 possible combina- tions for the set of 13 known attacks scenario, where only one attack class is excluded each time. Classification performance is evaluated using mi- cro accuracy, macro accuracy, macro F1 and weighted F1 scores. 4.4.1 Experiment Results The boxplots in Figure 3 illustrate the distri- bution of macro‑F1 performance across differ- ent classification algorithms and varying combi- nations of known and unknown attacks, while Ta- ble 3 provides the aggregated results for all 164 combinations. Specifically, these include 50 ran- dom combinations for the 4‑Known, 7‑Known and 10‑Known attack settings, as well as the 14 possi- ble combinations for the complete set of 13 known attacks. Table 3: Aggregated results across all combinations and evaluated algorithms. The best results are high- lighted in bold. ModelMacro-F1Weighted-F1Macro-AccuracyMicro-Accuracy RF0.941±0.0540.944±0.0560.950±0.0480.949±0.050 KNN0.938±0.0330.938±0.0360.937±0.0340.938±0.040 XGBoost0.906±0.0790.910±0.0830.924±0.0680.920±0.072 LightGBM0.905±0.0790.908±0.0830.922±0.0680.918±0.073 SVM0.866±0.0640.883±0.0630.882±0.0590.885±0.060 LR0.862±0.0630.881±0.0610.887±0.0570.882±0.059 4.4.2 Discussion The results indicate that, given suﬀicient training data, both traditional supervised learning meth- ods and ensemble approaches achieve high clas- sification performance. Among these, RF con- sistently outperforms all other models, achiev- ing scores above 0.941 across all evaluated met- rics. The second-best performer is k-N, which demonstrates stable results with an average of 0.938 across metrics. In contrast, linear models such as SVM and LR report the lowest perfor- mance, with all scores falling below 0.887. These results are consistent with prior work in the IoT domain (Guerra-Manzanares et al., 1-134-107-710-413-1 Number of Known vs. Unknown 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall GMM - Known 1-134-107-710-413-1 Number of Known vs. Unknown GMM - Unknown 1-134-107-710-413-1 Number of Known vs. Unknown LOF - Known 1-134-107-710-413-1 Number of Known vs. Unknown LOF - Unknown Figure 2: Recall performance for GMM and LOF methods for GMM and LOF methods 2020), supporting the effectiveness of RF in han- dling high-dimensional, heterogeneous IIoT traf- fic. Its inherent robustness to class imbalance, ability to capture complex non-linear decision boundaries and resistance to overfitting make RF particularly well-suited for this domain. Further- more, RF offers practical advantages such as in- terpretability and scalability, which are essen- tial for real-world deployments where adaptabil- ity and transparency are critical. These features make RF an ideal candidate for the attack clas- sification layer of the system, ensuring reliable detection even in dynamic and evolving threat landscapes. Overall, these findings highlight the superiority of tree-based ensemble methods and instance-based methods in modeling complex re- lationships within IIoT traﬀic, while linear mod- els struggle to achieve comparable performance in these conditions. 4.5 Incremental Attack Update Module The purpose of the Incremental Attack Update Module is to maintain the detection performance of the attack classification model within the dy- namic IIoT threat landscape by periodically up- dating the classifier knowledge with new at- tack categories. Therefore, in this experiment, we evaluate the system’s capability to contin- uously incorporate new attack categories. To achieve this, we consider two incremental learn- ing schemes (i.e., one-step and multiple-step) and compare the performance of different update strategies (i.e., semi-supervised methods and ac- tive learning). A detailed description of the ex- perimental setup is provided as follows. 1. One-Step Iteration: In this scheme, the up- date process transitions fromNKnown at- tacks and14−NUnknown attacks to14 Known and0Unknown attacks. That is, the model starts with knowledge ofNattacks and aims to integrate all remaining attacks in a single update step. In our experiments, we considerN= 4,7,10,13and evaluate two strategies: semi-supervised learning and active learning, across five random configurations (i.e., se- lecting theNattacks at random) for each run. We evaluate three semi-supervised meth- ods (i.e., self-training, label propgation and label spreading) and uncertainty-sampling- based active learning. 2. Mult-step Iteration: This scheme defines a progressive update process, which simulates the progressive emergence of new attack types as follows: 4K & 10U→7K & 7U→10K & 4U→13K & 1U→14K & 0U, where K refers to Known attacks and U to Unknown attacks. In this case, the model is progressively refined through multiple incremental steps, starting from 4 Known and 10 Umknown attacks and ending at 14 Known and 0 Unknown attacks, as in the One-Step Iteration scheme. As in the previous scheme, we evaluate two strategies: semi-supervised learning and active learning, across five random configurations of the initial Known attacks. In addition, for the multi- step updates, we compare two training logics for handling pseudo-labeled data: (a) Strict Seed-Based Training: Using only the original labeled seed samples in each itera- tion. (b) Incremental Augmentation: Incorporating pseudo-labeled data into subsequent itera- tions. 4.5.1 Experiment Result Table 4 shows the performance of the evaluated methods forN=4Known attacks, while Table 5 reports the same information forN=7Known at- tacks. Similarly, Table 6 shows the performance of the evaluated methods forN=10Known at- tacks, while Table 7 reports the same information forN=13Known attacks. In all cases, the cor- responding Unknown attacks is14−Nand the RFKNNXGBLGBMSVMLR Method 0.6 0.7 0.8 0.9 1.0 Macro F1 4 known 10 unknown RFKNNXGBLGBMSVMLR Method 7 known 7 unknown RFKNNXGBLGBMSVMLR Method 10 known 4 unknown RFKNNXGBLGBMSVMLR Method 13 known 1 unknown Figure 3: Macro F1 performance values for different classification models and Known-Unknown combinations update process is one step, that is, all new un- known attacks are discovered at once and present at the Unknown attack pool. Table 8 provides the results of the multi‑step iteration procedure under two training logics for pseudo‑labeled data: one that strictly relies on seed samples (i.e., seed-based in the table) and another that incorporates pseudo‑labeled data into subsequent iterations (i.e., augmentation). The reported results are averages of 5 random runs. Table 4: Average performance of One-Step Iteration forN=4Known Attacks (5 random runs). The best results are highlighted in bold. MethodMacro F1Balanced AccAcc Self-training0.8859±0.01820.8954±0.01830.8995±0.0140 Label Spreading0.8349±0.03370.8561±0.02580.8590±0.0354 Label Propagation0.8404±0.02100.8632±0.02270.8630±0.0186 Active Learning0.8296±0.03530.8561±0.02150.8548±0.0254 Table 5: Average performance of One-Step Iteration forN=7Known Attacks (5 random runs). The best results are highlighted in bold. MethodMacro F1Balanced AccAcc Self-training0.8648±0.00900.8908±0.01270.8834±0.0100 Label Spreading0.7788±0.02990.8188±0.02740.8065±0.0334 Label Propagation0.8007±0.03730.8350±0.03260.8241±0.0379 Active Learning0.8113±0.02400.8553±0.01440.8504±0.0174 Table 6: Average performance of One-Step Iteration forN=10Known Attacks (5 random runs). The best results are highlighted in bold. MethodMacro F1Balanced AccAcc Self-training0.8617±0.01020.8835±0.01190.8822±0.0076 Label Spreading0.7753±0.05540.8044±0.04240.8042±0.0472 Label Propagation0.8019±0.04260.8270±0.04040.8280±0.0379 Active Learning0.8303±0.01850.8664±0.02210.8655±0.0224 Table 7: Average performance of One-Step Iteration forN=13Known Attacks (5 random runs). The best results are highlighted in bold. MethodMacro F1Balanced Ac cAcc Self-training0.8970±0.00890.9023±0.00610.9053±0.0066 Label Spreading0.8508±0.03820.8752±0.03410.8692±0.0371 Label Propagation0.8590±0.02190.8836±0.02060.8765±0.0222 Active Learning0.8128±0.01690.8377±0.01130.8367±0.0119 Table 8: Performance results of multi-step iteration for different strategies. The best results per step are highlighted in bold. StepStrategyMacro-F1Balanced AccAccuracy First Step (4+10)Both0.91330.92300.9215 Second Step (7+7) Seed-based0.88730.89650.8965 Augmentation0.90850.91500.9158 Third Step (10+4) Seed-based0.87410.88940.8900 Augmentation0.88600.90210.9004 Final Step (13+1) Seed-based0.86370.88470.8830 Augmentation0.88520.89080.8960 4.5.2 Discussion The experimental results demonstrate that the proposed Incremental Attack Update Module ef- fectively balances adaptability to new attack cat- egories with retention of prior knowledge. In the One‑Step Iteration setting, self‑training con- sistently achieves the highest performance across different values ofN, indicating its strength in leveraging limited labeled data to generalize to unseen attacks. Active learning also performs competitively, particularly when the number of known classes increases, suggesting that uncer- tainty‑driven sample selection can mitigate label scarcity. In contrast, label propagation and la- bel spreading show weaker performance, reflect- ing their sensitivity to noisy pseudo‑labels in het- erogeneous attack distributions. The Multi‑Step Iteration experiments high- light the benefits of progressive integration. Augmentation strategies, which incorporate pseudo‑labeled data into subsequent iterations, generally outperform strict seed‑based training, especially in intermediate steps (e.g., 7K+7U and 10K+4U). This indicates that incremental en- richment of the training set improves assimila- tion of new attack categories without severely compromising accuracy on previously known classes. However, seed‑based training demon- strates stronger stability in preserving perfor- mance on earlier classes, underscoring a trade‑off between knowledge retention and adaptability. Overall, the results confirm three key proper- ties of the proposed incremental learning pipeline: • Adaptability: the system can continuously in- tegrate new attack categories with minimal degradation. • Retention: previously learned knowledge re- mains stable, particularly under seed‑based training. • Robustness under data scarcity: high accu- racy is maintained even when labeled data is limited, validating the effectiveness of semi‑supervised and active learning strategies. These results suggest that combining self‑training with incremental augmentation in multi‑step updates provides a good balance between scalability and resilience, reinforcing the pipeline’s suitability for dynamic IIoT threat environments. 5 LIMITATIONS There are several limitations to this study. First, all experiments were conducted using the Edge‑IIoTset dataset, which, while comprehen- sive, may not fully capture the diversity and evolving nature of real‑world IIoT traﬀic and at- tack behaviors. Second, the evaluation of the first DPM layer was restricted to three anomaly de- tection models and the second layer to four mod- els, excluding other advanced or DL approaches that could provide different insights. Third, the novelty and outlier detection paradigms assume either completely clean training data or lightly contaminated environments, which may oversim- plify the complexities of real deployment sce- narios where contamination levels vary unpre- dictably. The incremental update experiments fo- cused only on two incremental learning schemes, one-step and multi-step iterations, without ex- ploring alternative paradigms such as continual lifelong learning or hybrid approaches. While these limitations exist, they are delib- erate choices made to ensure the study remains focused, reproducible and computationally feasi- ble. The exclusive use of the Edge‑IIoTset dataset provides a controlled and standardized bench- mark, allowing for fair comparison across models and incremental learning schemes, even if it can- not fully capture the diversity of real‑world IIoT traﬀic. Similarly, restricting the evaluation to a small set of commonly used anomaly detection models enables a clear analysis of fundamental ML paradigms before extending to more complex DL approaches, which often introduce additional variables and resource demands. The assump- tions in novelty and outlier detection paradigms, clean versus lightly contaminated training data, are widely adopted in anomaly detection research as they represent two fundamental scenarios that balance realism with feasibility. Finally, focus- ing on one‑step and multi‑step incremental learn- ing schemes provides a structured foundation for evaluating adaptability and retention, while leav- ing continual lifelong learning and hybrid ap- proaches as directions for future work. 6 CONCLUSIONS This study proposes MI 2 DAS, a multi‑layer in- trusion detection architecture for industrial IoT, designed to tackle important challenges such as high‑dimensional heterogeneous data, class im- balance, limited labeled samples and the emer- gence of zero‑day threats. The proposed MI 2 DAS architecture integrates three layers that enable effective discrimination between normal and at- tack traﬀic, fine‑grained classification of attack types and continual learning to adapt to emerg- ing threats. Using the Edge‑IIoT dataset, our experiments show that GMM achieves superior performance in normal‑attack separation at the edge (accuracy = 0.953, TPR = 1.000), while GMM and LOF complement each other in dis- tinguishing known from unknown attacks. For known attack classification, the RF model out- performed alternatives, achieving a macro-F1 of 0.941 ± 0.054. Furthermore, semi‑supervised and active learning approaches effectively iden- tified novel attacks with minimal labeling over- head, maintaining stable performance in both sin- gle‑step and multi‑step incremental updates. Fu- ture work will explore DL‑based anomaly detec- tion methods to further improve recognition ac- curacy against complex and evolving attack pat- terns. REFERENCES Ahmed, H. A., Hameed, A., and Bawany, N. Z. (2022). Network intrusion detection using oversam- pling technique and machine learning algorithms. PeerJ Computer Science, 8:e820. Al, S. and Dener, M. (2021). Stl-hdl: A new hybrid network intrusion detection system for imbalanced dataset on big data environment. Computers & Security, 110:102435. Ali, M. L., Thakur, K., Schmeelk, S., Debello, J., and Dragos, D. (2025). Deep learning vs. machine learning for intrusion detection in computer net- works: A comparative study. Applied Sciences, 15(4):1903. Angurala, M., Sharma, Y., and Mishra, S. (2024). Empowering industries: Unveiling the potential of industrial internet of things. In 2024 INDIACom, pages 166–170. IEEE. Cecílio, J. and Souto, A. (2024). Security issues in industrial internet-of-things: Threats, attacks and solutions. In 2024 IEEE MetroInd4. 0 & IoT, pages 458–463. IEEE. Chandola, V., Banerjee, A., and Kumar, V. (2009). Anomaly detection: A survey. ACM Computing Surveys, 41(3):15. Deng, Z. and Liu, J. (2022). A novel intrusion de- tection system for next-generation in-vehicle net- works. In Proc. IEEE GLOBECOM. European Commission (2025).The next generation internet of things.https: //digital-strategy.ec.europa.eu/en/policies/ next-generation-internet-things. Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L., and Janicke, H. (2022). Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and feder- ated learning. IEEE Access, 10:40281–40306. Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., and Nõm, S. (2020). Using medbiot dataset to build effective machine learning-based iot bot- net detection systems. In ICISSP, pages 222–243. Springer. Halbouni, A., Gunawan, T. S., Habaebi, M. H., et al. (2022). Cnn-lstm: hybrid deep neural network for network intrusion detection system. IEEE Access, 10:99837–99849. Kapoor, D., Gupta, D., and Uppal, M. (2025). Ana- lyzing the impact of edge, fog and cloud computing on predictive maintenance in the industrial inter- net of things. Discover Computing, 28(1):207. Kasongo, S. M. and Sun, Y. (2020). Performance analysis of intrusion detection systems using a fea- ture selection method on the unsw-nb15 dataset. Journal of Big Data, 7(105). Kim, J., Kim, J., Kim, H., et al. (2020). Cnn- based network intrusion detection against denial- of-service attacks. Electronics, 9(6):916. Lo, W. W., Layeghy, S., Sarhan, M., Gallagher, M., and Portmann, M. (2022). E-graphsage: A graph neural network based intrusion detection system for iot. In 2022 IEEE/IFIP NOMS, pages 1–9. IEEE. Mohy-eddine, M. et al. (2022). An effective intrusion detection approach based on ensemble learning for iiot edge computing. J. Comp. Vir. and Hack. Tech. Rath, K. C., Khang, A., and Roy, D. (2024). The role of internet of things (iot) technology in industry 4.0 economy. In Advanced IoT Technologies and Applications in the Industry 4.0 Digital Economy, pages 1–28. Rathi, S., Thapaswi, S., Kambhampati, M., et al. (2025). Realizing the potential of internet of things (iot) in industrial applications. Discover Internet of Things, 5(1):1–16. Sáez-de Cámara, X. et al. (2023). Clustered feder- ated learning architecture for network anomaly de- tection in large-scale heterogeneous iot networks. Computers & Security, page 103299. Shone, N., Ngoc, T. N., Phai, V. D., and Shi, Q. (2018). A deep learning approach to network in- trusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1):41–50. Sinha, S. (2025). State of iot 2025. https:// iot-analytics.com/number-connected-iot-devices. Sisinni, E., Saifullah, A., Han, S., Jennehag, U., and Gidlund, M. (2018). Industrial internet of things: Challenges, opportunities, and direc- tions. IEEE transactions on industrial informatics, 14(11):4724–4734. Talukder, M. A. et al. (2024). Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embed- ding and feature extraction. Journal of Big Data, 11(33).

Instant research discovery