Trust-Aware Cyber Threat Identification in Industrial IoT Environments Through Adaptive Representation Learning

Abstract

Industrial Internet of Things systems are increasingly exposed to network-based attacks that may disrupt sensing, control, and data transmission processes. Traditional intrusion detection methods often focus on classification accuracy but provide limited explanation of why specific traffic patterns are identified as malicious, which restricts their use in safety-critical industrial environments. This study develops an explainable hybrid ensemble intrusion detection model for Industrial IoT network security. The framework combines XGBoost, Gradient Boosting, and Balanced Random Forest classifiers to improve robustness against class imbalance, while SHAP values are applied to quantify the contribution of protocol-level, statistical, and temporal traffic features. The model is evaluated on the ToN-IoT and Edge-IIoTset datasets, containing 461,043 and 2,219,201 labeled traffic samples, respectively. The original feature space is reduced from 79 to 36 features using mutual information ranking and correlation filtering. Experimental results show that the proposed model achieves 97.93% accuracy, 96.88% macro-F1, and 98.57% AUC on ToN-IoT, outperforming single XGBoost and CNN-based baselines by 1.76% and 2.41% in macro-F1, respectively. For Edge-IIoTset, the framework maintains a detection rate of 98.21% under mixed attack categories, including DDoS, reconnaissance, injection, and man-in-the-middle attacks. The SHAP analysis indicates that packet inter-arrival time, source-to-destination byte ratio, TCP window size, and protocol service frequency are key features for distinguishing abnormal industrial traffic. These findings suggest that explainable ensemble models can improve both detection reliability and decision transparency in Industrial IoT security monitoring.