Anefficient ensemble tree-based framework for intrusion detection in industrial internet of things networks

Abstract

The increasing complexity of cyber threats in industrial internet of things (IIoT) environments necessitates robust, scalable, and efficient intrusion detection systems (IDS). This study presents a novel ensemble tree-based framework that integrates gradient boosting-based machine learning models, including XGBoost, LightGBM, AdaBoost, and CatBoost, with mutual information (MI) feature selection and synthetic minority over-sampling technique (SMOTE) to enhance multiclass intrusion detection performance. The framework is designed to handle large-scale, imbalanced datasets efficiently while maintaining high classification accuracy. Performance evaluation using the telemetry of network (ToN)-IoT benchmark dataset demonstrates that the proposed models achieve a high accuracy of 99.43%, with a strong precision-recall balance and an F1-score, ensuring minimal false positive rates of 0.08%. By leveraging MI for optimal feature selection and SMOTE for data balancing, this approach effectively enhances detection capabilities in highly dynamic network environments. The lightweight architecture and reduced execution time make the framework well-suited for deployment in edge or fog nodes within smart industrial environments. The proposed solution provides a scalable and adaptable methodology for securing IIoT networks, making it applicable for real-time intrusion monitoring and further cybersecurity advancements in industrial systems.