Research on IIoT Network Attack Detection Based on Class Imbalance Processing and Attention Mechanism

Technical Summary: Research on IIoT Network Attack Detection Based on Class Imbalance Processing and Attention Mechanism

Problem Statement
The Industrial Internet of Things (IIoT) faces significant security challenges due to the heterogeneity of traffic, complex attack patterns, and, most critically, severe class imbalance in network datasets. In standard datasets like TON-IoT, minority attack categories (e.g., Man-in-the-Middle or MITM) are vastly underrepresented compared to majority classes (e.g., DoS, DDoS, Normal traffic). This imbalance causes traditional classifiers to bias toward majority classes, achieving high overall accuracy while failing to detect critical minority attacks. For instance, the study notes that under original imbalanced conditions, a model might achieve 0.837 accuracy but yield a mere 0.005 recall for the MITM attack, effectively ignoring a high-risk threat. Additionally, existing deep learning models often struggle with redundant high-dimensional features and the subtle differences between similar attack types (e.g., DoS vs. DDoS).

Methodology
The authors propose a unified detection framework that integrates data preprocessing, class imbalance processing, feature selection, and a hybrid deep learning architecture. The methodology proceeds through the following stages:

1. Data Preprocessing: Raw IIoT traffic data undergo cleaning, encoding of categorical labels, and Min-Max normalization to standardize feature scales.
2. Class Imbalance Processing: To address the scarcity of minority samples, the study employs data-level oversampling and loss-level adjustment.
   • Oversampling: SMOTE (Synthetic Minority Over-sampling Technique) and Borderline-SMOTE are used to synthesize new samples for minority classes, specifically targeting decision boundaries to improve discriminative learning.
   • Loss Adjustment: Class weights and Focal Loss are integrated into the training objective to penalize misclassifications of minority and hard-to-detect samples more heavily than easy majority samples.
3. Feature Selection: To reduce redundancy and computational cost, a hybrid feature selection approach using Random Forest and XGBoost is applied. Feature importance scores from both models are aggregated to select a key subset of discriminative traffic features.
4. Model Architecture (CNN–BiLSTM–Attention):
   • CNN: A 1D Convolutional Neural Network extracts local spatial patterns from the selected traffic features.
   • BiLSTM: A Bidirectional Long Short-Term Memory network captures temporal dependencies and bidirectional relationships within the traffic sequence.
   • Attention Mechanism: An attention layer is applied to the BiLSTM outputs to assign adaptive weights to different hidden states, allowing the model to focus on the most informative features for specific attack categories.
5. Training Strategy: The model is trained using the Adam optimizer with early stopping to prevent overfitting, utilizing the weighted cross-entropy or focal loss functions.

Key Contributions
The paper outlines four primary contributions:

1. Integrated Framework: Construction of an IIoT attack detection framework that synergizes class imbalance processing, feature selection, and attention-based deep learning.
2. Imbalance Mitigation: The introduction of SMOTE, Borderline-SMOTE, and class-aware learning strategies specifically tailored to enhance the recognition of minority attack categories.
3. Hybrid Deep Learning Model: The design of a CNN–BiLSTM–Attention model that combines local feature extraction, bidirectional sequence modeling, and adaptive feature weighting.
4. Comprehensive Evaluation: Extensive experiments on the TON-IoT dataset demonstrating that the proposed method outperforms traditional machine learning baselines (Bayes, Random Forest) and other deep learning architectures (MLP, CNN–BiLSTM) in both overall performance and minority-class detection.

Experimental Results
Experiments were conducted on the TON-IoT dataset (46,000 samples, 10 classes). Key findings include:

• Impact of Imbalance Processing: Without imbalance processing, the model achieved 0.837 accuracy but only 0.005 recall for MITM attacks. Applying Borderline-SMOTE improved the MITM recall to 0.584 and the Macro-F1 score to 0.801.
• Model Performance: The proposed model achieved an Accuracy of 0.869, a Macro-F1 of 0.852, and a Matthews Correlation Coefficient (MCC) of 0.853.
• Comparison: The proposed model outperformed baselines including Bayes (0.742 Acc), Random Forest (0.838 Acc), and a CNN–BiLSTM–Attention model without the specific imbalance/feature selection enhancements (0.856 Acc).
• Ablation Study: Removing any core component (imbalance processing, feature selection, attention, or BiLSTM) resulted in performance degradation. Notably, removing imbalance processing caused the Macro-F1 to drop to 0.759, highlighting its critical role.
• Class-Specific Performance: The model performed well on Ransomware, Scanning, and XSS (F1 > 0.94). However, challenges remained for MITM (F1 = 0.443) and DDoS (F1 = 0.677), primarily due to class imbalance and traffic pattern similarities with other attacks.

Significance and Claims
The paper claims that the proposed method significantly improves the reliability of IIoT attack detection by addressing the "accuracy paradox" where high overall accuracy masks the failure to detect minority attacks. By combining sample-level balancing (SMOTE) with optimization-level balancing (Focal Loss) and a robust feature representation model, the framework achieves a more balanced multi-class recognition capability. The authors assert that this approach is particularly valuable for security-sensitive industrial scenarios where missing a rare but dangerous attack (like MITM) can have severe consequences. The study concludes that while the method enhances overall robustness, future work should focus on further optimizing the precision of minority classes and resolving confusion between similar attack vectors like DoS and DDoS.