Toward a Hybrid Intrusion Detection Framework for IIoT Using a Large Language Model

Area of Science:

• Cybersecurity
• Industrial Internet of Things (IIoT)
• Machine Learning

Background:

• Industrial Internet of Things (IIoT) connectivity enhances efficiency but introduces significant cybersecurity risks.
• Existing intrusion detection systems (IDS) face challenges in IIoT due to data heterogeneity, high dimensionality, class imbalance, and data leakage.
• Effective IDS are crucial for securing IIoT environments against evolving cyber threats.

Purpose of the Study:

• To propose a leakage-safe, hybrid intrusion detection framework for Industrial Internet of Things (IIoT) environments.
• To integrate text-based and numerical network flow features for robust threat detection.
• To address challenges like data heterogeneity, high dimensionality, and class imbalance in IIoT security.

Main Methods:

• Network flows converted to text descriptions and encoded using Bidirectional Encoder Representations from Transformers (BERT) for semantic embeddings.
• Numerical traffic features standardized and combined with LLM embeddings.
• Class prototypes computed in Principal Component Analysis (PCA) space, with cosine similarity scores added.
• Synthetic Minority Over-sampling Technique (SMOTE) for class imbalance, Random Forest (RF) for feature selection, and Histogram-based Gradient Boosting (HGB) for classification.

Main Results:

• The hybrid framework achieved 98.19% accuracy on the Edge-IIoTset dataset.
• The framework demonstrated 99.15% accuracy on the ToN_IoT dataset.
• The proposed method proved robust and leakage-safe in evaluating IIoT network traffic.

Conclusions:

• The developed leakage-safe hybrid IDS framework effectively detects intrusions in IIoT environments.
• Combining LLM-based text embeddings with numerical features enhances detection capabilities.
• The framework offers a promising solution for securing interconnected industrial systems against cyber threats.