Statistical Feature Selection and Machine Learning-Based Intrusion Detection in IIoT Networks.
1. IntroductionThe Industrial Internet of Things (IIoT) has transformed industrial operations by enabling communication and cooperation among connected devices. These advancements improve productivity, automation, and operational efficiency, while expanding the attack surface for cyber threats. The consequences of these threats are not only financial, but they also include service disruption, loss of reputation, and, in some cases, harm to human safety in certain domains. Recent cyber incidents [1], [2] further highlight the growing threat to critical infrastructure.
These attacks underscore the importance of intelligent and sophisticated security solutions that can detect and combat threats in real time. Among these, Intrusion Detection Systems (IDS) are always running and help identify abnormal and malicious behaviors in the IIoT environment before they can cause serious harm [3]. However, conventional IDS solutions are not suitable in the context of IIoT. These systems often exhibit high false-negative rates, struggle with scalability, and may not consistently manage the rapid pace, variability, and dynamic nature of IIoT traffic. In addition, rule-based and signature-based detection methods cannot detect new attack patterns or zero-day attacks.
To overcome these limitations, recent studies have increasingly adopted machine learning-based IDSs that automatically learn attack patterns from network traffic. Supervised learning techniques have demonstrated high detection accuracy, while unsupervised and semi-supervised approaches can identify previously unseen attacks. Furthermore, ensemble and hybrid learning methods improve robustness by combining the strengths of multiple classifiers.
Despite the advancements in machine learning-based IDSs, several challenges remain in the Industrial Internet of Things. Previous studies often evaluated the performance of one machine learning (ML) algorithm in isolation without examining the combined effect of feature selection, handling class imbalance, and stacking ensemble learning on intrusion detection performance. Furthermore, very few studies have focused on analyzing the computational and detection accuracies in the context of realistic IIoT datasets. Therefore, a complete framework that incorporates effective feature selection, data balancing, and ensemble learning techniques is required to build an intelligent, robust, and less computationally intrusive detection system in IIoT environments.
The objective of this study is to explore the performance of statistical feature selection methods, data balancing technique, and a stacking-based ensemble classifier in the WUSTL-IIoT-2021 dataset [4] to improve IDS performance in IIoT networks. The proposed framework is evaluated under imbalanced and balanced data scenarios by considering various detection performance metrics, computational complexity, and robustness.
The key contributions of this study are summarized below.
1) A thorough comparative study of statistical feature selection techniques, namely, correlation matrix analysis and mutual information, for dimensionality reduction for IDS in IIoT.
2) Development of a stacking ensemble intrusion detection system combining Decision Tree, Extra Trees, and Gaussian Naive Bayes with Logistic Regression (LR) as a meta-classifier to enhance the detection accuracy and generalization of the system.
3) Investigation of the effect of SMOTE-based data balancing [5] on different supervised machine learning classifiers in the highly unbalanced environment of IIoT traffic.
4) Performance evaluation based on detection metrics and computational efficiency analysis using both imbalanced and balanced datasets.
In this study, the performance of different machine learning classifiers for intrusion detection in an IIoT network is investigated. Figure 1 shows the taxonomy of the machine learning paradigms considered in this study. This study compares the performance of various classifiers across multiple scenarios. The goal is to identify potential classifiers that can provide accurate, efficient, and adaptable security solutions for IIoT systems.
By addressing the growing need for intelligent and adaptive IDS solutions, this study enhances the security posture of critical infrastructure against continuously evolving cyber threats.
2. Related Work
In recent years, machine learning, ensemble learning, feature selection, and data balancing methods have been gradually adopted in IIoT intrusion detection to achieve high accuracy detection while reducing computational costs. Although these issues have been addressed, challenges such as class imbalance, redundant features, and the generalization property of machine learning models remain active research problems.
A comparative summary of representative IIoT intrusion detection studies is presented in Table I, highlighting the datasets, feature selection methods, data balancing techniques, machine learning algorithms, and key observations. This comparison provides a clear overview of existing approaches and helps position the proposed framework within the current state-of-the-art.
Gaber et al. [6] presented solutions to the issues of imbalanced datasets and resource constraints in IIoT intrusion detection. The authors also suggested bio-inspired feature selection, Particle Swarm Optimization (PSO), Bat Algorithm (BA), and ML classifiers (Random Forest (RF), k-nearest neighbors (k-NN), and multilayer perceptron (MLP)) on the WUSTL-IIOT- 2021 dataset. The results showed better performance compared to the baseline models, particularly the RF classifier coupled with the BA algorithm. This study emphasized the need to address class imbalances using methods such as sampling. Nevertheless, the use of optimization algorithms increases complexity and may cause overhead in real-time implementations.
Eid et al. [7] tested six different ML algorithms on the WUSTL-IIOT-2021 dataset for IIoT intrusion detection. Data pre-processing was highlighted, along with a high accuracy of 99.97% using the RF model. This study involved security aspects such as confidentiality, integrity, availability, authentication, and authorization. However, the absence of feature selection integration or real-time processing methods limits the efficiency and scalability of the proposed approach in high-throughput industrial environments.
Hasan et al. [8] presented a lightweight IDS that utilized a deterministic and cost-sensitive autoencoder for feature selection. The model was tested with several ML classifiers on the Edge-IIoTset dataset and achieved the highest accuracy 99.94% using the decision tree (DT) classifier. The model obtained a 0.19 ms per inference instance speed on an edge device (Jetson Nano). However, the evaluated TabNet classifier had an extremely long training time, which highlighted the loss of efficiency during training.
Mohammed et al. [9] proposed a lightweight intrusion detection mechanism that combines PCA with RF and Naive Bayes classifiers. PCA reduced the features to 8-25 with a variance of more than 95% on the CSE-CIC-IDS2018, CIC-IDS2017, and NSL-KDD datasets. The RF classifier achieved an accuracy of 99.96%. However, this study did not address class imbalance, did not provide adaptive learning for changing threats, and was not validated on actual Industrial IoT equipment.
Alatawi [10] suggested an IDS based on ensemble learning (DT, kNN, and LR), transfer learning, and feature engineering. The ensemble achieved an accuracy of 95%, a 15% better detection rate, and 30% less training time when pre-trained on the UNSW-NB15, NSL-KDD, and CI-CIDS2019 datasets. However, ensemble and XAI methods are costly.
Musleh et al. [11] compared image filters, VGG-16 (Visual Geometry Group 16), and DenseNet feature selection methods with the help of several machine learning models (RF, k-NN, SVM and stacked models) for IoT intrusion detection. The application of an image-based dataset further enabled the study of the visual properties of intrusion detection systems. This study achieved an accuracy of 98.3% with the combination of VGG-16 and stacking with the IEEE DataPort dataset. The major drawback is the high computational complexity associated with the extraction of image-based features in lightweight or resource-limited IoT devices.
Despite the significant progress achieved by previous studies in machine learning-based intrusion detection, important research gaps remain. While several studies have addressed machine learning algorithms, optimization-based feature selection methods, or ensemble models, few have explored the combined impact of feature selection, data balancing, and stacking ensemble learning using the WUSTL-IIoT 2021 dataset. In addition, limited attention has been paid to the joint evaluation of detection performance and computational efficiency under both unbalanced and balanced data conditions. The proposed framework addresses these gaps by combining lightweight statistical feature selection methods with SMOTE and a stacking ensemble classifier, followed by a comprehensive comparative evaluation of the detection effectiveness and computational cost.
3. Methodology
This study employs the WUSTL-IIoT-2021 dataset [4] to assess intrusion detection in Industrial IoT environments. The dataset comprises network traffic collected from a realistic IIoT testbed and contains both benign and malicious network activities, where the malicious traffic includes various types of simulated cyber-attacks. In this study, the multiclass classification problem is transformed into a binary classification problem by labeling each instance as either normal or attack. The dataset consists of 1,194,464 observations with 49 features, including 87,016 attack samples and 1,107,448 normal samples. The proposed methodology involves data pre-processing, feature selection, data balancing, and ensemble learning using a stacking classifier. Furthermore, the Synthetic Minority Oversampling
Technique (SMOTE) [5] is employed to address the class imbalance problem and enable a fair evaluation of the machine learning models. A general overview of proposed intrusion detection framework is illustrated in Figure 2.
A. Data Preprocessing
The dataset is a combination of categorical and numerical features with no missing or duplicated records. Categorical and datetime features (StartTime, LastTime, SrcAddr, DstAddr, and Traffic) are encoded to prepare the dataset ready for machine learning models. The StartTime and LastTime columns are converted from strings to datetime objects. Temporal features such as StartHour, StartDay, StartWeekday, and Duration, are extracted and kept as numerical features. The StartDay and StartWeekday columns, which are consistent with the dataset, have been eliminated during preprocessing to avoid redundancy. Among the categorical columns, the high-cardinality values of SrcAddr and DstAddr are encoded using integer mapping. The Traffic column is encoded with the LabelEncoder. This encoding strategy is selected to ensure that critical information is preserved while maintaining compatibility with the model and computational efficiency. After the transformation, the resulting dataset consists of 51 numeric features, 44 of which are from the original data, and 7 more are created from the categorical and datetime features by applying the encoding transformations.
All feature values are normalized in the range [0, 1] using min-max normalization[12] to improve model performance and convergence, particularly distance-based algorithms.
B. Feature Selection
Statistical methods are preferred over wrapper and embedded methods because they are model-agnostic, computationally efficient, and scalable to high-dimensional data. Investigating measurable connections and dependencies between features and target variables improves the robustness, interpretability, and generalizability of machine learning models[13][14]. To reduce the dimensionality and improve the model efficiency, two statistical feature selection methods, correlation matrix analysis and mutual information, are applied independently and compared. These techniques select the most relevant features but remove redundant and noisy features[15].
1) Correlation Matrix
This statistical method is based on the computation of the Pearson correlation coefficient to estimate the linear relationship between the features. Inter-feature dependencies and highly correlated pairs are visualized using a correlation heatmap, as shown in Figure 3.
If the absolute Pearson correlation coefficient between two features exceeds 0.8, the features are considered highly correlated, and one of them is removed to eliminate redundancy. A threshold of 0.8 is selected because it is widely adopted in feature selection studies to identify multicollinearity while preserving sufficient discriminatory information for classification. This step is important for improving the model interpretability and reducing overfitting.
The details of the features at each stage are shown in Table II. The dataset initially contains 49 features, followed by preprocessing steps. The number of features in the dataset after preprocessing increased by two features. Subsequently, two constant features and nineteen highly correlated features are removed. The systematic pruning process ensures that the classifiers are trained on a focused, non-redundant feature set that captures the relevant variance in the dataset and is free from noise and redundancy.
2) Mutual Information (MI)
Mutual information is a statistical, information-theoretic measure that quantifies nonlinear and linear dependencies between the target variable and features. Unlike correlation, it does not assume a particular functional relationship between variables and is therefore useful for identifying complex relationships.
The information gain score for each feature is represented in the form of a bar chart in Figure 4, where features with higher scores are more influential. Features with low mutual information scores are discarded to decrease redundancy in the feature space. A mutual information threshold of 0.21 is selected based on the distribution of the feature importance scores obtained from the dataset. Features with scores below this threshold contribute minimally to the target classification and are therefore removed to reduce feature redundancy and computational complexity while preserving informative attributes. This process removes 20 features with low mutual information values, as shown in Table II. This subset focuses on the most significant variables for class discrimination to achieve higher classification accuracy with lower computational complexity. Unlike correlation analysis, which captures only linear dependencies between features, mutual information identifies both linear and nonlinear relationships with the target variables. Therefore, the two methods are evaluated independently to compare their effectiveness in selecting informative features for the IIoT intrusion detection.
In each method, a refined feature subset is obtained, and the machine learning models are trained and tested independently for both feature sets. These two approaches enable a comparison of the feature selection strategies in terms of their ability to identify relevant features.
C. Data Balancing
Imbalanced data negatively affect the performance of classification algorithms by biasing predictions toward the majority class [16]. Figure 5 clearly shows that the WUSTL-IIoT-2021 dataset has a large class imbalance. To address this issue, the SMOTE data balancing technique is applied to the training set. SMOTE creates synthetic minority-class samples by interpolating between existing minority samples and their nearest neighbors [5]. It enhances minority-class representation without simply duplicating existing samples. The synthetic instance xnew is generated using Equation 1:
[Please download the PDF to view the formula] (1)
The ith minority class sample is xi, a k-nearest neighbor is [x.sub.nn], and [lambda] is a random number between 0 and 1. This linear interpolation is suitable for allowing an approximate new data point between the existing minority incidences and their neighbors. Consequently, the models learn more effective decision boundaries and improve their ability to detect minority-class intrusion instances, which is crucial for IIoT cybersecurity applications.
This method refines the models to learn better decision boundaries and enhances their ability to detect minority-class intrusions.
D. Machine Learning Classifiers
To obtain a comprehensive evaluation, a set of supervised ML classifiers encompassing different learning paradigms (Figure 1) is used. This selection includes diverse algorithmic paradigms, such as linear, probabilistic, ensemble, and instance-based approaches. This diversity of models ensures that the comparative assessment is not dominated by any particular family of models and covers a balanced representative sample of the ML space for use in intrusion detection within IIoT networks.
Classifiers such as LR, Gaussian Naive Bayes (GNB), AdaBoost, k-NN, and Extreme Gradient Boosting (XG-Boost) are used in this study. The simple and interpretable LR model serves as a strong baseline, showing information on the linear separability of the attack and benign traffic features. The GNB is a probabilistic classifier that performs well on high-dimensional data when feature independence is approximately satisfied. A non-parametric method that captures non-linear relationships is k-NN (instance-based learning), which can be a slow algorithm for a large volume of data because of its computational complexity.
Ensemble methods, such as AdaBoost and XGBoost, are robust approaches that combine several weak learners. AdaBoost adapts to misclassified instances through the re-weighting of training instances in each iteration, whereas an advanced gradient boosting framework, XGBoost, provides accuracy and scalability with built-in protection against overfitting. The use of these models is especially helpful for IIoT intrusion detection because they can deal with heterogeneous data distributions and imbalanced classes.
In addition to these classifiers, the current study propose a stacking classifier. Stacking is a technique that trains a meta-learner on the predictions of multiple heterogeneous base classifiers to exploit their complementary strengths. This is especially important in the IIoT scenarios, where attack patterns are diverse, and none of these classifiers consistently perform best for all types of attacks. The stacking classifier is designed to achieve better generalization, obtain fewer false negatives, and provide a more robust IDS system using a combination of linear, probabilistic, instance-based, and ensemble learners.
The inclusion of both conventional machine learning classifiers and the proposed stacking ensemble facilitates a comprehensive comparative evaluation for IIoT intrusion detection.
E. Proposed Stacking Classifier
To improve the performance of the IDS in IIoT networks, the proposed ensemble-based stacking classifier presented in Figure 6 consists of multiple heterogeneous base classifiers and a meta classifier. Two models are used in the ensemble base layer: Randomized Tree Learners and GNB. Randomized Tree Learners are a collection of trees that include Decision Tree (DT) and Extra Trees (ET) classifiers. Both tree-based models are trained with a maximum depth of three to avoid overfitting and learn the nonlinear decision boundaries. While the DT makes deterministic splits based on the feature importance, the ET model introduces randomness in selecting feature thresholds and thus helps to reduce the variance and improve the model generalization to data that it has not seen before.
GNB is the third base learner, which introduces probabilistic learning into the ensemble. It assumes independence among features, enables rapid calculations, and augments tree-based models through diversity. This makes it particularly suitable for large, high-dimensional traffic features, as found in typical IIoT datasets, where lightweight and fast predictions are often required.
At the meta level, LR is used to combine the outputs of the base classifiers. The meta classifier learns how to combine the predictions of the base classifiers and provides calibrated probability estimates that are essential for the successful use of intrusion detection. LR, as a meta-classifier, offers interpretability and is computationally efficient and stable, which is desirable for online IDS deployment scenarios where transparency and speed are paramount.
This design stems from the concept of a balance between complexity and generalization. Deterministic and randomized tree-based models guarantee good feature interaction learning, whereas the diversity of models arises from the probabilistic classifier. The LR meta classifier effectively combines the predictions of the base classifiers while reducing overfitting and improving robustness under class imbalance.
Furthermore, decision-level fusion is performed by combining the predictions of multiple base classifiers, thereby improving prediction accuracy and stability. This complementary combination allows the strengths of individual classifiers to offset the weaknesses of others. This diverse approach is particularly suitable for IIoT environments, where attacks range from simple anomalies to stealthy and sophisticated cyber-attacks. Consequently, the proposed stacking classifier improves detection accuracy, robustness, and reliability while reducing the false-negative rate, making it well suited for real-world IIoT intrusion detection applications.
4. Results and Discussion
The machine learning models are developed and evaluated using Python [17], which is well supported by a comprehensive ecosystem of scientific libraries and frameworks such as Scikit-learn [18], NumPy [19], and Pandas [20]. All machine learning classifiers are implemented using their default hyperparameter settings provided by the Scikit-learn library without further hyperparameter tuning to ensure a fair comparative evaluation. To validate the results of this experiment, the WUSTL-IIoT-2021 dataset is divided into training and testing subsets using an 80:20 train-test split. The evaluation focuses on a wide range of performance metrics that not only measure the accuracy of the classification, but also the computational cost and scalability of the model, ensuring its reliability, efficiency, and ability to be implemented in real-time scenarios within the context of IIoT security.
A. Performance Metrics
Various key metrics are used to evaluate the models, all selected to measure different aspects of classification quality. As a group, they provide a comprehensive assessment of classification performance across multiple dimensions. Accuracy is the total number of correctly classified examples divided by the total number of examples. It is the overall correctness of a model; however, it may not accurately reflect the model's correctness in the case of an imbalanced dataset. To minimize false alarms, the precision should be high (the number of predicted positive cases is actually positive). Recall (or sensitivity) is the ability of a model to detect true positive cases. Recall is particularly important in IDS because if a case is classified as not an intruder, it may lead to serious consequences. The class distribution is generally skewed; therefore, the F1 score, which is the harmonic mean of precision and recall, is a better metric for the model's overall performance.
The area under the Receiver Operating Characteristic Curve (ROC-AUC) measures the model's discrimination across a wide range of thresholds and provides an overall measure of performance. This is further developed by the Matthews Correlation Coefficient (MCC), which considers all four confusion matrix values (TP, TN, FP, FN) and provides a balanced performance measure, even when the dataset is extremely imbalanced. Its possible values range from -1 to +1, with +1 indicating a perfect prediction, 0 indicating a random prediction, and -1 indicating the exact opposite prediction of the labels generated[21][22].
In addition to the classification metrics, the computational efficiency of each classifier is also assessed. The training and testing times in seconds are recorded to assess the suitability of the deployment of the models in real-time IloT applications. This dual focus on accuracy and efficiency ensures that the models are effective and feasible for large-scale and latency-sensitive industrial environments.
The performance metrics adopted in this study are computed using Equations (2)-(6)[21][22].
Accuracy = [TP+ TN/TP + TN + FP + FN] (2)
Precision = [TP/TP + FP] (3)
Recall = [TP/TP + FN] (4)
F1-Score = 2 * [Precision * Recall/Precision + Recall] (5)
[Please download the PDF to view the formula] (6)
These metrics are used to assess and compare the performance of various classifiers. The analysis of these metrics allows the identification of models that are not only effective in achieving high intrusion detection rates but also efficient and generalizable.
B. Performance Evaluation using Correlation Matrix as Feature Selection Method
Figure 7 shows the ML classification performance for different ML models when features are selected using the correlation matrix-based feature selection method. The figure presents the F1-score, recall, precision, and accuracy for both the imbalanced and balanced datasets. The performance of all models improves after applying SMOTE to balance the training dataset. Figure 8 compares the corresponding training and testing times in seconds. In addition, k-NN has a substantially higher testing time, which makes it computationally expensive compared to other models. The proposed stacking classifier achieves high classification performance while maintaining a moderate computational cost.
Figure 9 shows the heatmaps of the MCC values for six classification models trained on the unbalanced and balanced datasets using features selected by the correlation mattix-based feature selection method. The upper heatmap illustrates the performance of models on unbalanced dataset, whereas the lower heatmap highlights the improvements observed after applying the data balancing technique. Remarkably, classifiers such as AdaBoost and k-NN maintain high MCC values in both scenarios, whereas LR exhibits a moderate decrease in the balanced dataset. The proposed stacking classifier consistently achieves high MCC values, demonstrating its robustness and balanced classification performance.
C. Performance Evaluation using Mutual Information as Feature Selection Method
The assessment of the ML classifiers using mutual information (MI) for feature selection is illustrated in Figures 10 and 11. These figures provide insights into both the detection capability and computational efficiency of the unbalanced and balanced datasets. Figure 10 shows that among the ensemble methods, AdaBoost, XGBoost, and the proposed stacking classifier achieve higher accuracy and Fl-score, with only a negligible decrease after data balancing. In contrast, the less complex models, LR and GNB, exhibit comparatively moderate performance, particularly on the balanced dataset, indicating their limited ability to capture complex data patterns.
Figure 11 shows that the computational time of k-NN is substantially higher than that of the other classifiers in both data settings, particularly during testing. Although AdaBoost provides strong predictive performance, it requires a significantly longer training time. The proposed stacking classifier achieves an effective balance between predictive accuracy and computational efficiency, making it suitable for real-world IIoT intrusion detection scenarios where both detection performance and resource efficiency are critical.
Figure 12 illustrates the MCC heatmaps for the evaluated classifiers using mutual information-based feature selection. The upper heatmap corresponds to the unbalanced dataset, whereas the lower heatmap represents the balanced dataset after applying SMOTE. Ensemble models such as AdaBoost, XGBoost, and the proposed stacking classifier achieve near-perfect MCC values, demonstrating their robustness and excellent classification performance across different data scenarios. These results highlight the effectiveness of ensemble learning techniques, which combine the strengths of multiple classifiers to reduce both false positives and false negatives. In contrast, simpler classifiers such as LR and GNB exhibit comparatively lower MCC values. However, their performance improves considerably after data balancing, emphasizing the importance of preprocessing techniques such as SMOTE for enhancing minority class detection. Although these classifiers provide useful baseline performance, more sophisticated ensemble methods are required to effectively capture complex attack patterns present in IIoT network. Overall, the results demonstrate that ensemble learning, combined with appropriate feature selection and data balancing, provides a robust and stable solution for intrusion detection in IIoT settings.
The superior performance of the proposed stacking ensemble is attributed to its ability to leverage the complementary strengths of multiple base classifiers. The Decision Tree effectively captures nonlinear decision boundaries, Extra Trees enhance generalization through randomized ensemble learning, and Gaussian Naive Bayes efficiently models probabilistic relationships among network traffic features. The Logistic Regression meta-classifier combines the predictions of these base learners, reducing individual model bias and improving the overall classification performance. Furthermore, the application of statistical feature selection removes redundant and irrelevant attributes, whereas SMOTE mitigates class imbalance by generating synthetic minority-class samples. The synergy among these techniques enables the proposed framework to achieve high detection accuracy, robust classification performance, and improved computational efficiency for IIoT intrusion detection.
The overall results obtained using both feature selection methods under unbalanced and balanced data settings are summarized in Tables III and IV. Table III reports the classification performance metrics, while Table IV presents the corresponding training and testing times.
5. Conclusion and Future Work
This study presents a comprehensive evaluation of machine learning-based intrusion detection models for IIoT environments. The study investigates how statistical feature selection and data balancing influence intrusion detection performance. Both statistical feature selection methods, correlation matrix analysis and mutual information, effectively reduce the number of features while preserving classification performance, thereby improving computational efficiency. Feature reduction also decreases model complexity, making the proposed framework more suitable for deployment in resource-constrained IIoT environments. Among the evaluated machine learning classifiers, the proposed stacking ensemble achieves superior detection performance and better generalization under both unbalanced and balanced data settings. It leverages the complementary strengths of multiple classifiers, reducing the limitations of individual models while improving robustness across diverse attack scenarios.
Furthermore, the SMOTE-based data balancing strategy enhances minority-class detection, further demonstrating the importance of data preprocessing in the effective design of intrusion detection systems. This enables improved detection of rare but critical attacks that are often overlooked by conventional models, thereby reducing false negatives and enhancing system reliability.
The proposed framework offers a practical solution for IIoT intrusion detection by combining lightweight statistical feature selection with ensemble learning, making it suitable for deployment in resource-constrained industrial environments. The improved detection performance and reduced computational complexity demonstrate the potential of this approach to enhance the reliability and resilience of IIoT cybersecurity systems.
Despite the promising performance of the proposed framework, several limitations should be acknowledged. The proposed framework was evaluated using the WUSTL-IIoT 2021 dataset, and further validation on additional benchmark datasets and real-world industrial environments is required to assess its generalizability. Moreover, although the stacking ensemble improves detection performance, it introduces additional computational overhead compared with individual classifiers. These aspects should be considered when deploying the framework in large-scale or realtime IIoT environments.
Future research will focus on validating the proposed framework in real-time industrial environments and across multiple IIoT benchmark datasets to further evaluate its robustness and generalizability. Future work will also investigate deep learning models to capture more complex intrusion patterns. In addition, federated learning techniques will be explored to preserve data privacy while enabling distributed model training across multiple IIoT devices. Finally, hybrid frameworks integrating optimization algorithms with deep neural networks (DNNs) for automated hyperparameter optimization will be investigated to further improve adaptability against evolving cyber threats.
References
[1] E. Ng, "Dbs vendor ransomware attack potentially exposes 8,200 customer statements," [Online]. Available: https://www.reuters.com/technology/cybersecurity/dbs-vendor-ransomware-attack-potentially-exposes-8200-customer-statements-2025-04-07/, reuters, Apr. 7, 2025.
[2] M. Davey, "Ivf patient details leaked after cyber-attack on australian fertility clinic genea," [Online]. Available: https://www.theguardian.com/society/2025/feb/26/genea-data-breach-hack-ivf-patient-details-leaked-ntwnfb, the Guardian, Feb. 26, 2025.
[3] K. Bansal and A. Singhrova, "Review on intrusion detection system for IoT/IIoT - brief study," Multimedia Tools and Applications, vol. 83, no. 8, pp. 23 083-23 108, 2024.
[4] M. Zolanvari, M. A. Teixeira, L. Gupta, K. M. Khan, and R. Jain, "WUSTL-IIoT-2021 dataset for IIoT cybersecurity research," [Online]. Available: http://www.cse.wustl.edu/jain/iiot2/index.html, St. Louis, MO, USA, Oct. 2021.
[5] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, "SMOTE: Synthetic minority over-sampling technique," Journal of Artificial Intelligence Research, vol. 16, pp. 321-357, 2002.
[6] T. Gaber, J. B. Awotunde, S. O. Folorunso, S. A. Ajagbe, and E. Eldesouky, "Industrial internet of things intrusion detection method using machine learning and optimization techniques," Wireless Communications and Mobile Computing, vol. 2023, 2023.
[7] A. M. Eid, A. B. Nassif, B. Soudan, and M. N. Injadat, "IIoT network intrusion detection using machine learning," in 2023 6th International Conference on Intelligent Robotics and Control Engineering (IRCE), Aug. 2023, pp. 196-201.
[8] T. Hasan, A. Hossain, M. Q. Ansari, and T. H. Syed, "Enhanced intrusion detection in IIoT networks: A lightweight approach with autoencoder-based feature learning," in Proceedings of the 10th International Conference on Internet of Things, Big Data and Security (IoTBDS), INSTICC. SciTePress, 2025, pp. 207-214.
[9] T. J. Mohammed, A. Alnoor, F. Abdelfattah, X. Chew, and K. W. Khaw, "Lightweight principal component analysis-driven ensemble framework for real-time intrusion detection in industrial IoT networks," Cybersecurity, vol. 9, no. 1, p. 46, 2026.
[10] M. N. Alatawi, "Enhancing intrusion detection systems with advanced machine learning techniques: An ensemble and explainable artificial intelligence (AI) approach," Security and Privacy, vol. 8, no. 1, p. e496, 2025.
[11] D. Musleh, M. Alotaibi, F. Alhaidari, A. Rahman, and R. M. Mohammad, "Intrusion detection system using feature extraction with machine learning algorithms in IoT," Journal of Sensor and Actuator Networks, vol. 12, no. 2, p. 29, 2023.
[12] S. G. K. Patro and K. K. Sahu, "Normalization: A preprocessing stage," arXiv, vol. abs/1503.06462, 2015.
[13] X. Cheng, "A comprehensive study of feature selection techniques in machine learning models," Artificial Intelligence and Digital Technology, vol. 1, no. 1, pp. 65-78, 2024.
[14] P. Hu and J. Zhu, "A filter-wrapper model for high-dimensional feature selection based on evolutionary computation," Applied Intelligence, vol. 55, no. 7, pp. 1-13, 2025.
[15] H. Zhou, X. Wang, and R. Zhu, "Feature selection based on mutual information with correlation coefficient," Applied Intelligence, vol. 52, no. 5, pp. 5457-5474, 2022.
[16] K. Bansal and A. Singhrova, "Improving industrial control system security: A data balanced machine learning approach," in Proceedings of Data Analytics and Management, ser. Lecture Notes in Networks and Systems, A. Swaroop, B. Virdee, S. D. Correia, and Z. Polkowski, Eds., vol. 1601. Cham: Springer, 2025, pp. 91-104.
[17] Python Software Foundation, "Python programming language," [Online]. Available: https://www.python.org/, 2025.
[18] F. Pedregosa, G. Varoquaux, A. Gramfort et al., "Scikit-learn: Machine learning in python," Journal ofMachine Learning Research, vol. 12, pp. 2825-2830, 2011.
[19] C. R. Harris, K. J. Millman, S. J. van der Walt et al., "Array programming with numpy," Nature, vol. 585, no. 7825, pp. 357-362, 2020.
[20] T. pandas development team, "pandas-dev/pandas: Pandas," Zenodo, 2020.
[21] C. M. Bishop and N. M. Nasrabadi, Pattern Recognition and Machine Learning. New York, NY, USA: Springer, 2006.
[22] D. Chicco and G. Jurman, "The advantages of the matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation," BMC Genomics, vol. 21, p. 6, 2020.
Komal Bansal (1) and Anita Singhrova (1)
(1) Department of Computer Science and Engineering, Deenbandhu Chhotu Ram University of Science & Technology, Murthal, Haryana, India
E-mail address: komal.bansal22@gmail.com, anitasinghrova.cse@dcrustm.org
Received 10 September 2025, Revised 4 July 2026, Accepted 18 July 2026
http://dx.doi.org/10.12785/ijcds/1571201159
TABLE I. Comparison of representative intrusion detection studies for
IIoT environments
Study Dataset Feature Data
Selection Balancing
Gaber et WUSTL-IIoT PSO, BA Resampling
al.[6]
Eid et WUSTL-IIoT - -
al.[7]
Hasan et Edge-IIoTset Autoencoder Cost-sensitive
al.[8] Autoencoder
Mohammed CSE-CIC-IDS2018 PCA -
et al.[9] CIC-IDS2017
NSL-KDD
Alatawi[10] UNSW-NB15 Feature -
NSL-KDD Engineering
CICIDS2019
Musleh et IEEE DataPort VGG16, SMOTE
al.[11] DenseNet
Proposed WUSTL-IIoT Correlation SMOTE
Framework Matrix
Mutual
Information
Study ML Algorithm Key Observation
Gaber et RF, MLP, k-NN High detection accuracy;
al.[6] optimization-based feature selection
increased computational cost.
Eid et ANN, SVM, High detection accuracy but did not
al.[7] k-NN, NB, incorporate feature selection or data
LR, DT balancing techniques.
Hasan et DT, XGB, Lightweight IDS; TabNet incurred high
al.[8] LightGBM, training time; evaluated on a
TabNet, non-industrial dataset.
BiLSTM
Mohammed RF, Naive Bayes Reduced feature dimensionality but did
et al.[9] not address class imbalance and
nonlinear feature relationships.
Alatawi[10] DT, k-NN, Transfer learning and ensemble learning
LR Ensemble improved detection performance but
increased computational overhead due to
ensemble and explainable AI methods.
Musleh et RF, k-NN, High detection accuracy but high
al.[11] SVM, computational complexity for
Stacking resource-constrained IoT devices.
Proposed Stacking Lightweight statistical feature
Framework Ensemble selection, SMOTE-based data balancing,
and stacking ensemble learning jointly
improve detection performance while
maintaining computational efficiency.
TABLE II. Summary of the feature selection process
Step Selection Criterion Features
1 Initial WUSTL-IIoT 49
feature set
2 After preprocessing 51
and categorical encoding
3 Constant feature removal 49
4 Correlation Matrix 19
([rho]> 0.8)
5 Mutual Information 20
(MI > 0.21)
TABLE III. Classification performance comparison of different machine
learning classifiers using correlation matrix and mutual information
feature selection under imbalanced and balanced data settings.
Correlation Matrix
Model Imbalanced
Acc Pre Rec F1 MCC
LR 0.975 0.975 0.975 0.975 0.817
GNB 0.979 0.978 0.979 0.978 0.836
AdaBoost 1.000 1.000 1.000 1.000 0.999
k-NN 0.997 0.997 0.997 0.997 0.976
XGBoost 0.999 0.999 0.999 0.999 0.990
Proposed 0.998 0.984 0.984 0.984 0.983
Stacking
Correlation Matrix
Model Balanced
Acc Pre Rec F1 MCC
LR 0.921 0.925 0.921 0.923 0.764
GNB 0.964 0.964 0.964 0.963 0.884
AdaBoost 0.997 0.997 0.997 0.997 0.992
k-NN 1.000 1.000 1.000 1.000 0.999
XGBoost 0.993 0.993 0.993 0.993 0.979
Proposed 0.996 0.984 0.995 0.989 0.987
Stacking
Mutual Information
Model Imbalanced
Acc Pre Rec F1 MCC
LR 0.931 0.923 0.931 0.902 0.213
GNB 0.925 0.866 0.925 0.891 0.004
AdaBoost 1.000 1.000 1.000 1.000 1.000
k-NN 1.000 1.000 1.000 1.000 0.997
XGBoost 1.000 1.000 1.000 1.000 0.999
Proposed 1.000 0.999 0.995 0.997 0.997
Stacking
Mutual Information
Model Balanced
Acc Pre Rec F1 MCC
LR 0.822 0.836 0.822 0.763 0.293
GNB 0.799 0.727 0.799 0.714 0.038
AdaBoost 1.000 1.000 1.000 1.000 1.000
k-NN 1.000 1.000 1.000 1.000 0.999
XGBoost 1.000 1.000 1.000 1.000 0.999
Proposed 1.000 1.000 0.999 0.999 0.999
Stacking
TABLE IV. Computational performance comparison of different machine
learning classifiers using correlation matrix and mutual information
feature selection under imbalanced and balanced data settings.
Correlation Mutual
Matrix Information
Model Imbalanced Balanced Imbalanced
Train Test Train Test Train Test Train
Time Time Time Time Time Time Time
(s) (s) (s) (s) (s) (s) (s)
LR 24.27 0.05 23.20 0.08 42.28 0.10 31.98
GNB 0.59 0.28 0.68 0.21 0.92 0.42 1.52
AdaBoost 373.65 12.93 359.41 11.98 537.21 17.50 4.74
k-NN 21.68 611.61 18.98 592.08 31.37 641.20 1794.60
XGBoost 5.66 0.05 5.66 0.04 6.23 0.03 5.93
Proposed 43.12 0.54 87.43 0.65 62.23 0.66 68.97
Stacking
Mutual Information
Model Balanced
Test Time (s)
LR 0.15
GNB 0.70
AdaBoost 0.40
k-NN 411.90
XGBoost 0.04
Proposed 0.69
Stacking
 Printer friendly
 Cite/link
 Email
 Feedback
| |
| Author: | Bansal, Komal; Singhrova, Anita |
|---|---|
| Publication: | International Journal of Computing and Digital Systems |
| Article Type: | Report |
| Date: | Jan 1, 2026 |
| Words: | 6052 |
| Previous Article: | Exploring Techniques for Mapping Automatic Question Generation to Bloom's Taxonomy. |
| Next Article: | Hierarchical Personalized Federated Learning Framework for Intrusion Detection Systems in Heterogeneous Attack Environments. |
| Topics: | |