The IIoT represents a transformative shift in how industrial systems are monitored, controlled, and optimized [ 1 ]. By interconnecting sensors, actuators, controllers, and cloud infrastructure via IP-based networks, IIoT enables real-time data collection, predictive maintenance, remote operation, and intelligent automation across sectors such as manufacturing, energy, healthcare, and transportation. Unlike traditional Industrial Control Systems (ICS), which were often isolated and proprietary, IIoT platforms are characterized by open communication protocols, cloud-based data analytics, and heterogeneous device ecosystems [ 2 ]. Figure 1 illustrates a typical multi-layered architecture of the IIoT, comprising the perception, network, middleware, and application layers, each with specific roles, technologies, and components.
The IIoT has evolved into a foundational pillar of modern industrial automation, enabling data-driven decision-making, real-time process optimization, and predictive operational insights across a wide variety of industrial sectors. IIoT applications span smart manufacturing, remote asset monitoring, predictive maintenance, energy management, and safety-critical control systems, all of which rely on dense networks of sensors, actuators, gateways, and edge-cloud infrastructures. These deployments require stringent guarantees on latency, reliability, and security due to their tight coupling with physical processes. For example, Alam et al. demonstrated the benefits of a Software-Defined Networking (SDN)-based reconfigurable edge architecture for IIoT, showing how programmable networking enhances flexibility, responsiveness, and system-level efficiency in industrial environments [ 3 ]. Similarly, Wan et al. highlighted the use of IIoT in smart manufacturing ecosystems, where edge intelligence and cloud coordination enable adaptive process control and large-scale interoperability [ 4 ]. Other application-oriented studies, such as those by Lee et al., emphasize the increasing role of real-time sensing and cyber-physical integration in enabling -generation industrial automation and monitoring systems [ 5 ]. Collectively, these works underscore the critical dependence of industrial applications on interconnected IIoT infrastructures, thereby reinforcing the need for robust, intelligent security mechanisms. Given the heterogeneity and operational constraints of IIoT deployments, intrusion detection systems must be adaptive, lightweight, and capable of addressing dynamic industrial workloads–motivating the AI-driven IDS approach adopted in this study.
While this digital transformation improves operational efficiency and productivity, it simultaneously exposes industrial systems to a significantly broader and more complex cyber-attack surface . The convergence of Information Technology (IT) and Operational Technology (OT) networks has eroded traditional air-gapped architectures, rendering industrial assets vulnerable to external adversaries [ 6 ]. Attack vectors in IIoT environments now include not only physical access and insider threats but also remote exploits via insecure protocols, weak device configurations, and compromised supply chains [ 7 ].
Moreover, IIoT systems operate in high-stakes environments where disruptions can have dire consequences. For instance, a ransomware attack on a manufacturing plant could halt production lines, a data breach in a smart grid could cause blackouts, and command injection attacks in critical infrastructure could lead to physical sabotage. The dynamic and distributed nature of IIoT–comprising edge nodes, fog devices, and cloud services- complicates security enforcement and incident response [ 8 ]. Compounding the problem, many IIoT devices have limited computational resources and lack the built-in security mechanisms present in general-purpose computing systems [ 9 ].
Recent high-profile incidents, such as the Colonial Pipeline ransomware attack and the Triton malware targeting industrial safety systems, have underscored the urgency of implementing robust, proactive cybersecurity measures tailored to IIoT [ 10 ]. The attack surface is not only expanding in size but also evolving in sophistication, requiring security approaches that are adaptive, context-aware, and capable of learning from new data. This necessitates a paradigm shift in how security is conceptualized and implemented within industrial environments.
Among the various security controls deployed in IIoT networks, Intrusion Detection Systems (IDS) play a pivotal role in identifying unauthorized activities and potential breaches. IDS solutions monitor network traffic, system logs, and device behaviors to detect anomalies or known patterns of malicious behavior [ 11 ]. However, traditional IDS approaches–primarily rule-based or signature-driven–are increasingly inadequate in the face of sophisticated and evolving threats [ 12 ].
Signature-based IDS can only detect previously encountered attacks and requires continual updates, leaving systems vulnerable to zero-day exploits and novel intrusion techniques [ 13 ]. Furthermore, handcrafted rules often lead to high false-positive rates, especially in the diverse, noisy environments characteristic of IIoT deployments. Manual tuning of these systems becomes impractical as networks scale and diversify.
To address these limitations, researchers and practitioners have increasingly turned to Artificial Intelligence (AI) to augment and revolutionize IDS capabilities. AI-based IDS leverages machine learning and deep learning techniques to learn complex patterns of behavior from historical and real-time data [ 14 , 15 ]. These systems can generalize to unseen threats, adapt to evolving attack strategies, and reduce reliance on manually crafted signatures.
In IIoT, AI-powered IDS can offer several critical advantages:
Anomaly Detection : Unsupervised and semi-supervised models can identify deviations from normal behavior, capturing unknown attack patterns without needing labeled datasets.
Anomaly Detection : Unsupervised and semi-supervised models can identify deviations from normal behavior, capturing unknown attack patterns without needing labeled datasets.
Context Awareness : AI models can integrate contextual information such as time, location, device roles, and usage patterns to make more informed decisions.
Context Awareness : AI models can integrate contextual information such as time, location, device roles, and usage patterns to make more informed decisions.
Real-Time Analysis : With advancements in edge AI and model compression, lightweight models can now operate on constrained devices, enabling timely threat detection closer to the data source.
Real-Time Analysis : With advancements in edge AI and model compression, lightweight models can now operate on constrained devices, enabling timely threat detection closer to the data source.
Scalability and Automation : AI enables the analysis of vast, complex datasets generated by IIoT networks, automating threat detection and response at scale.
Scalability and Automation : AI enables the analysis of vast, complex datasets generated by IIoT networks, automating threat detection and response at scale.
Learning from Evolving Threats : Online learning and continual learning models can update themselves in real-time, making them resilient against adaptive adversaries.
Learning from Evolving Threats : Online learning and continual learning models can update themselves in real-time, making them resilient against adaptive adversaries.
However, deploying AI-based IDS in IIoT presents its challenges. Issues such as adversarial attacks on models, the scarcity of high-quality labeled datasets, explainability, and deployment constraints (e.g., latency, memory, and power consumption) continue to pose significant hurdles. Despite these challenges, the integration of AI into IDS systems is widely recognized as a promising and necessary step toward achieving resilient, intelligent cybersecurity in industrial settings.
1.1 Comparison with existing review articles
Despite growing attention to securing IIoT infrastructure, existing literature surveys of AI-based IDS reveal significant gaps in scope, depth, and future direction. Table 1 provides a structured, feature-wise comparison of ten influential surveys published from 2018 to 2025, highlighting the key contributions and limitations of each. The comparative analysis reveals that while numerous reviews exist, only a few directly address the unique challenges posed by IIoT environments, and even fewer offer a holistic, future-driven synthesis across emerging AI paradigms.
A significant shortfall among existing surveys is their limited focus on the industrial-specific context . Reviews such as those by Saied et al. [ 16 ], Mallidi and Ramisetty [ 17 ], and Sowmya and Mary Anita [ 18 ] either target generic IoT scenarios or emphasize narrow technical layers, which restricts their relevance to industrial settings. These reviews often overlook critical constraints of IIoT, such as real-time requirements, constrained devices, legacy protocols, and heterogeneous architectures spanning edge, fog, and cloud layers. In contrast, the present review is exclusively focused on the industrial domain, addressing architectural demands, system interdependencies, and deployment limitations relevant to manufacturing, energy, and critical infrastructure systems.
Moreover, many prior reviews lack a longitudinal perspective on the field’s evolution. For instance, Nuaimi et al. [ 19 ] conducted a valuable survey focusing on ML/DL-based detection in IIoT; however, their work only covers research up to 2022 and does not trace the trajectory of recent advances, such as explainable AI (XAI), adversarial machine learning, or federated learning. Similarly, earlier works, such as Xu et al. [ 20 ] and Serror et al. [ 21 ], provide excellent overviews of IIoT security at large but offer only static snapshots without examining shifts in algorithmic strategies or deployment trends over time. This review addresses that gap by analyzing a full decade of development, capturing transitional phases from traditional ML toward federated, lightweight, and explainable models.
Taxonomic breadth and depth also differentiate this review from others. While some works present applicable classification schemes (e.g., Alotaibi [ 22 ], Shahin et al. [ 23 ]), these are often one-dimensional, focusing on either attack types or detection algorithms. The taxonomy proposed in this review integrates detection strategies, AI learning paradigms (supervised, unsupervised, ensemble, federated), deployment placement (edge, fog, cloud), and cross-cutting concerns such as explainability and resource constraints. This multi-dimensional approach provides a more comprehensive understanding of how design decisions interact with deployment realities in IIoT.
Another critical deficiency in prior surveys lies in the treatment of resource-constrained environments . Real-world IIoT systems often operate under severe constraints on energy, memory, and processing capabilities. Yet, reviews such as Saied et al. [ 16 ] and Sowmya and Mary Anita [ 18 ] rarely the impact of model complexity or latency on system performance. In contrast, this review explicitly discusses trade-offs among detection performance, computational cost, and responsiveness at different tiers of IIoT (e.g., edge vs. cloud), synthesizing empirical results from recent deployments and simulations.
The need for explainable and robust IDS models has also become paramount, especially in safety-critical industrial contexts. However, most prior reviews either ignore or briefly mention these aspects. For example, while Shahin et al. [ 23 ] mentions the utility of deep learning in IIoT, they do not delve into the challenges of adversarial resilience or interpretability. In contrast, this review devotes specific attention to emerging fields like XAI and adversarial machine learning, identifying both opportunities (e.g., attention mechanisms, Shapley values) and risks (e.g., model inversion, evasion attacks) associated with deploying black-box models in high-stakes environments.
Another pressing issue is the lack of standardized benchmarks and evaluation practices . Many surveys report performance on legacy datasets such as NSL-KDD or UNSW-NB15. While some reviews (e.g., Alnajim et al. [ 24 ]) known datasets, they rarely critique their applicability or propose evaluation frameworks tailored to IIoT. This review fills that void by analyzing existing datasets, identifying gaps (e.g., the lack of hardware-in-the-loop realism), and proposing a set of evaluation metrics beyond accuracy, including detection delay, energy usage, and false alarm cost.
Finally, what further elevates this review is the inclusion of an actionable research roadmap –short-term, mid-term, and long-term recommendations aligned with emerging technologies and industry needs. While other surveys mention future directions, they often do so in a generic manner. For example, Nuaimi et al. [ 19 ] lists open challenges without a structured progression. In contrast, this review proposes practical steps, including short-term (deployment of lightweight edge detectors), mid-term (integration of XAI and FL), and long-term (adaptive IDS with self-healing and zero-trust capabilities).
In summary, this review distinguishes itself by offering a well-structured, longitudinal, and multidimensional synthesis of AI-based IDS in IIoT. By addressing overlooked aspects such as explainability, resource trade-offs, adversarial robustness, and deployment realism, it fills key voids in the literature. It serves as both a foundation and a roadmap for researchers and practitioners aiming to secure industrial environments in the age of intelligent cyber-physical systems.
1.2 Contributions of the paper
This review paper makes several unique and impactful contributions to the field of IIoT cybersecurity, with a particular focus on integrating AI into IDS. While many prior works have surveyed IDS techniques for generic IoT, this review fills a critical gap by focusing explicitly on the unique architectural, operational, and resource constraints of industrial environments. The contributions are summarized as follows:
IIoT-Centric Focus : Unlike existing reviews that generalize across IoT domains, this work centers exclusively on the challenges and solutions relevant to IIoT. It considers industry-specific constraints, such as real-time response requirements, edge-to-cloud deployment hierarchies, and the integration of safety-critical systems.
IIoT-Centric Focus : Unlike existing reviews that generalize across IoT domains, this work centers exclusively on the challenges and solutions relevant to IIoT. It considers industry-specific constraints, such as real-time response requirements, edge-to-cloud deployment hierarchies, and the integration of safety-critical systems.
Comprehensive Longitudinal Coverage : This survey spans a full decade of research, providing a temporal perspective on the evolution of AI-based IDS approaches. It highlights transitional trends from classical ML methods to federated learning, explainable AI, and hybrid architectures suitable for layered IIoT deployments.
Comprehensive Longitudinal Coverage : This survey spans a full decade of research, providing a temporal perspective on the evolution of AI-based IDS approaches. It highlights transitional trends from classical ML methods to federated learning, explainable AI, and hybrid architectures suitable for layered IIoT deployments.
Multi-Dimensional Taxonomy : The paper introduces a novel taxonomy that integrates detection methodology, learning paradigms, deployment placement (edge, fog, cloud), model explainability, and adversarial robustness. This structured classification enables readers to understand the interplay between algorithm design and industrial application constraints.
Multi-Dimensional Taxonomy : The paper introduces a novel taxonomy that integrates detection methodology, learning paradigms, deployment placement (edge, fog, cloud), model explainability, and adversarial robustness. This structured classification enables readers to understand the interplay between algorithm design and industrial application constraints.
Focus on Real-World Constraints : A distinguishing feature of this review is its attention to practical concerns such as detection latency, resource utilization, scalability, and interpretability–factors that are often overlooked in traditional IDS reviews but are critical in industrial settings.
Focus on Real-World Constraints : A distinguishing feature of this review is its attention to practical concerns such as detection latency, resource utilization, scalability, and interpretability–factors that are often overlooked in traditional IDS reviews but are critical in industrial settings.
Critical Benchmarking and Dataset Analysis : The paper evaluates the current landscape of IDS benchmarking for IIoT, identifying limitations in commonly used datasets and metrics.
Critical Benchmarking and Dataset Analysis : The paper evaluates the current landscape of IDS benchmarking for IIoT, identifying limitations in commonly used datasets and metrics.
Exploration of Emerging Technologies : This review goes beyond established methods to explore the role of emerging techniques, including federated learning, graph neural networks, and adversarial defense mechanisms. It synthesizes findings on the applicability, challenges, and readiness of these technologies for IIoT environments.
Exploration of Emerging Technologies : This review goes beyond established methods to explore the role of emerging techniques, including federated learning, graph neural networks, and adversarial defense mechanisms. It synthesizes findings on the applicability, challenges, and readiness of these technologies for IIoT environments.
Structured Research Roadmap : The paper proposes a well-articulated roadmap, outlining short-, mid-, and long-term research directions. These include deploying lightweight edge detectors, integrating explainability into operational pipelines, and designing self-adaptive, resilient IDS models for evolving threat landscapes.
Structured Research Roadmap : The paper proposes a well-articulated roadmap, outlining short-, mid-, and long-term research directions. These include deploying lightweight edge detectors, integrating explainability into operational pipelines, and designing self-adaptive, resilient IDS models for evolving threat landscapes.
Significance : To the best of our knowledge, this is the first survey that integrates architectural, algorithmic, operational, and evaluation aspects of AI-based IDS in IIoT into a unified and actionable framework. It serves as both a state-of-the-art reference and a strategic guide for researchers, practitioners, and policymakers seeking to enhance industrial cybersecurity in the era of intelligent, interconnected systems.
1.3 Organization of the paper
The remainder of this paper is structured as follows. Section 2 presents the foundational background on IIoT systems, highlighting their architecture and associated cybersecurity challenges. Section 3 presents the deployment considerations in IIoT IDS. In Sect. 4 , a comprehensive taxonomy of AI-based intrusion detection systems tailored for IIoT environments is developed, categorizing existing approaches by learning type, detection strategy, and deployment level. Section 5 critically reviews available datasets and testbeds used in IIoT IDS research, identifying their limitations and applicability. Section 6 provides a comparative evaluation of selected IDS models based on key performance metrics and detection characteristics. In Sect. 7 , the paper discusses current open challenges hindering the deployment of real-world IDS in IIoT, including issues related to dataset scarcity, explainability, and adversarial robustness. Section 8 then outlines a detailed roadmap for future research, emphasizing directions such as lifelong learning, federated IDS, and human-centric AI. Finally, Section 9 concludes the paper by summarizing key insights and outlining the path forward for developing resilient, intelligent intrusion detection solutions for IIoT systems.
2 Foundations of IIoT and intrusion detection
The IIoT has become a cornerstone of digital transformation in industrial sectors, enabling unprecedented levels of automation, connectivity, and intelligence. At its core, IIoT integrates traditional industrial systems with Internet-enabled sensors, actuators, and control units to enable real-time monitoring and adaptive control of physical processes. Unlike consumer-grade IoT systems, IIoT architectures are deployed in critical domains such as manufacturing, energy, oil and gas, transportation, and smart grids, where failures can result in substantial economic losses or threats to public safety [ 25 , 26 ].
The architecture of a typical IIoT system is organized across several logical layers, each responsible for different aspects of functionality and security. The perception or sensing layer comprises the hardware devices–sensors, RFID tags, cameras, and actuators—that interact directly with the physical environment. These devices are responsible for capturing parameters such as temperature, humidity, vibration, pressure, and energy consumption. The network layer connects these sensors to processing units and cloud platforms using industrial communication protocols such as Modbus, OPC-UA, BACnet, and MQTT. This layer serves as the backbone of IIoT communications, yet it is often built on legacy protocols not originally designed with cybersecurity in mind [ 27 ].
The intermediate processing layers, edge and fog computing, play a pivotal role in local data processing and decision-making. By handling computations closer to the data source, these layers significantly reduce latency and bandwidth consumption while enabling real-time actuation and anomaly detection. For example, in a smart factory, an edge-based system might halt an assembly line within milliseconds of detecting unsafe conditions. At the top of the stack lies the cloud or data-center layer, which is responsible for long-term data storage, large-scale analytics, and training of machine learning models. This layer typically interacts with enterprise systems such as ERP, MES, and SCADA platforms. The application layer interfaces with human users through dashboards, alarms, and control interfaces, allowing plant operators and system administrators to visualize performance metrics and respond to incidents [ 28 ].
Industrial use cases vary widely across sectors, but all rely on the core premise of data-driven automation. In smart grids, IIoT enables load balancing, dynamic pricing, and predictive maintenance by monitoring energy consumption patterns in real time. In manufacturing, IIoT systems help manage inventory, detect defects, optimize robotic workflows, and ensure compliance with quality standards. Oil and gas industries utilize IIoT for leak detection, asset tracking, and environmental monitoring in remote or hazardous locations. Similarly, the transportation sector integrates IIoT in intelligent traffic systems, predictive vehicle maintenance, and real-time logistics management. These diverse applications underscore the importance of cybersecurity as any disruption can have cascading effects across economic and operational dimensions [ 29 ].
Despite the immense value that IIoT offers, its deployment presents a unique set of security challenges not typically encountered in conventional IT or general IoT systems. One of the most pressing concerns is the integration of legacy systems, many of which were designed decades ago with little or no consideration for modern cybersecurity threats. These systems often lack basic features such as authentication, encryption, or secure firmware update mechanisms, making them susceptible to protocol exploits and remote manipulation [ 27 ]. Moreover, the physical nature of IIoT systems means that cyberattacks can produce real-world consequences, ranging from shutting down power grids to causing safety hazards in manufacturing environments [ 30 ].
Another critical issue is the heterogeneous and distributed architecture of IIoT. The presence of numerous edge devices, mobile endpoints, and cloud integrations creates a vast and fragmented attack surface. Threat actors can exploit vulnerabilities at any layer, and breaches in one component can propagate across the entire system. The use of insecure communication channels, insufficient access controls, and poor credential management further exacerbate the risk. Additionally, the operational demands of industrial systems—such as high availability, low latency, and deterministic timing–restrict the implementation of conventional security measures like frequent patching or network reboots, making proactive detection even more essential [ 26 ]. Compounding these challenges is the fact that IIoT systems must operate under strict resource constraints. Many edge devices have limited processing power and memory, which restricts their ability to run sophisticated encryption algorithms or machine learning models. In this context, lightweight and efficient security mechanisms become paramount. At the same time, regulatory requirements and compliance standards—such as IEC 62443 or NIST guidelines–impose additional obligations on system integrators and operators, demanding comprehensive risk assessments and intrusion monitoring solutions.
The combination of high-stakes environments, legacy constraints, and evolving threat landscapes necessitates robust cybersecurity mechanisms tailored specifically to IIoT. Among the most critical of these mechanisms are IDS, which serve as real-time sentinels capable of monitoring network traffic, device behavior, and control logic to identify signs of unauthorized access or malicious activity [ 1 ]. As the following sections elaborate, modern IDS must be designed to operate within the physical, computational, and temporal constraints of IIoT systems while remaining adaptable to novel threats and deployment architectures. A conceptual architecture illustrating the layered deployment of IDS across IIoT environments, including the perception, networking, and application layers, is depicted in Fig. 2 . This structure highlights the interaction between distributed IIoT nodes, network defenses such as NGFW ( -Generation Firewalls), and ML/DL-based detection engines located in the application layer.
To summarize, Figure 3 illustrates a comprehensive classification of security requirements in IIoT environments. At the core are fundamental domains, including data security and sharing, access control, authentication, network security, and resilience, which form the backbone of secure IIoT operations. Surrounding these are supporting functions and attributes, ranging from security monitoring and maintainability to smart maintenance, that ensure the sustainability and adaptability of security mechanisms. The outermost ring highlights contextual and environmental factors, including data transport, wireless communication, availability, privacy, and real-time performance constraints, which influence the implementation of these core requirements. This layered depiction emphasizes that IIoT security is not limited to traditional protection measures but extends to operational, architectural, and contextual dimensions that must be jointly considered to build resilient and trustworthy systems.
2.1 Attack landscape in industrial IoT environments
Given the criticality of IIoT systems and their complex, multi-layered infrastructure, they are prime targets for a wide array of cyberattacks. These threats not only compromise data confidentiality and system availability but can also have devastating physical consequences. A prominent category of attacks is Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) , which aim to exhaust system resources or network bandwidth, rendering services unavailable. Industrial devices with open ports and default credentials can be easily conscripted into botnets, as demonstrated by the infamous Mirai malware, which has evolved variants targeting IIoT-specific protocols [ 30 ]. Figure 4 illustrates a DDoS attack scenario in an IIoT environment, where an attackerremotely compromises IIoT devices and exploits their resources to generate malicious traffic thatoverwhelms target servers, thereby disrupting services for legitimate users.
Another significant threat is spoofing , where adversaries impersonate legitimate devices or controllers by forging IP addresses or hijacking sessions. In industrial environments where authentication is minimal or absent, attackers can inject malicious commands or falsify sensor data, disrupting control logic and misleading operators. Closely related are Man-in-the-Middle (MitM) attacks, where adversaries intercept and potentially alter communications between IIoT nodes. These attacks are especially concerning in process control environments, where tampered control signals can lead to operational instability or safety hazards [ 25 ]. Figure 5 depicts a MiTM attack in an IIoT environment, where an attacker intercepts andredirects the communication between an IIoT device and a computer device, disrupting theoriginal communication path and enabling unauthorized monitoring or manipulation ofexchanged data.
In IIoT environments, phishing attacks pose a significant threat to credential theft and unauthorized access to control systems, cloud analytics platforms, and sensitive operational data. As shown in Fig. 6 , a typical phishing detection pipeline operates between the Mail Transfer Agent (MTA) and the Mail User Agent (MUA) within the industrial network infrastructure. Incoming emails are first subjected to preliminary processing , which identifies potentially malicious features such as embedded URLs, login forms, or suspicious attachments. The message is then analyzed by a content scanner , which applies semantic and behavioral analysis to detect impersonation attempts, spoofed vendor identities, or attempts to manipulate urgency. In IIoT contexts, phishing emails may masquerade as maintenance alerts, equipment updates, or communications from third-party suppliers in the supply chain. To counter these threats, the system uses techniques such as phonetic hashing (e.g., hashDB) to flag domains that closely resemble legitimate industrial addresses. Based on the risk score, the email is either blocked or passed to the recipient. Early-stage phishing detection is essential in IIoT to prevent downstream attacks, including lateral movement, command injection, and APTs targeting industrial control systems.
Ransomware attacks pose a significant threat to IIoT systems, as they can disrupt both digital control infrastructure and physical industrial processes [ 31 ]. As illustrated in Fig. 7 , the IIoT Edge Gateway functions as a central node that communicates with controllers, sensors, cloud services, SCADA APIs, and human operators using various protocols, including HTTP, MQTT, and SMTP. This extensive connectivity increases the attack surface for threat actors [ 32 ]. A typical ransomware infection often begins with a phishing email received through the cloud or a local mail server, which delivers a malicious attachment or embedded link. Upon execution, the malware encrypts configuration files or locks access to system services running on the gateway. In advanced cases, the ransomware spreads laterally to cloud-connected services, SCADA dashboards, or even to the control loops managing actuators and sensors. Given the limited defenses on edge devices and the operational pressure to avoid downtime, many IIoT environments are highly susceptible to vulnerabilities. Effective mitigation requires secure email handling, intrusion detection systems capable of identifying lateral movement, and offline backups of critical configuration and control logic data.
The IIoT introduces a diverse range of communication protocols, components, and interconnected devices, many of which were never designed with cybersecurity as a foundational principle. Among the most prominent threats are protocol-level attacks, which exploit weaknesses in legacy industrial protocols such as Modbus, DNP3, and OPC-UA. These protocols often lack encryption, authentication, or session management, leaving IIoT systems exposed to command injection, spoofing, and replay attacks [ 27 ]. The problem is further amplified by the adoption of lightweight internet-based protocols like MQTT and CoAP, which—if misconfigured—can be vulnerable to Man-in-the-Middle (MitM) attacks or session hijacking. Ensuring secure protocol configurations and enforcing encryption at the network layer are thus essential to defend against these types of attacks [ 26 ].
Beyond communication protocols, IIoT systems are deeply dependent on a global supply chain of vendors, firmware sources, and third-party software libraries. This introduces a wide attack surface for adversaries seeking to compromise systems before they even reach the deployment stage. In a supply chain attack, malicious actors may tamper with firmware, insert backdoors into device drivers, or inject vulnerable libraries into control software [ 33 ]. Once deployed, these compromised components can serve as hidden entry points for long-term exploitation, allowing attackers to bypass perimeter defenses and move laterally within the network. The challenge lies in the lack of transparency in many vendor relationships and the difficulty of verifying the integrity of every software and hardware element [ 34 ]. Therefore, strategies such as validating software bills of materials, performing digital signature checks, and maintaining strict procurement policies are vital for reducing supply chain risks.
Even when protocols and supply chains are secured, system-level vulnerabilities remain a critical concern. Many IIoT deployments rely on edge gateways and controllers running outdated operating systems or default configurations, making them susceptible to privilege escalation, remote code execution, or malware deployment. Once a system is compromised, attackers can manipulate control logic, disrupt sensor data, or use the infected node to launch broader attacks against the infrastructure [ 34 ]. The persistent use of legacy systems, coupled with delayed security patching due to uptime requirements, often leaves IIoT environments exposed for extended periods. Strengthening these systems through network segmentation, regular security audits, and behavior-based intrusion detection can significantly improve the overall security posture of IIoT deployments.
IIoT environments face a diverse and evolving set of cyber threats targeting humans, devices, networks, supply chains, and cloud services. Table 2 summarizes these key threats, their objectives, and the latest mitigation techniques grounded in recent research.
Phishing remains a critical entry point for adversaries, especially when targeting IIoT operators through spoofed maintenance alerts or vendor notifications. Modern detection leverages transformer-based language models and multi-agent systems to analyze URL semantics, content, and metadata, achieving detection accuracy above 97% with low false-positive rates [ 35 , 36 ]. On the other hand, Ransomware has evolved with AI-driven stealth capabilities, such as the Reinforcement-Learning-based "RansomAI" platform, which adapts encryption timing and methods to avoid detection [ 37 ]. Countering this threat requires hybrid ML frameworks combining autoencoders and reinforcement learning for early anomaly detection in edge devices [ 38 ].
Protocol-based attacks continue to exploit legacy protocols, such as Modbus or MQTT. Recent advances in behavior-based anomaly detection for Modbus sequences, coupled with DTLS 1.3 enhancements tailored for constrained devices, significantly reduce spoofing and command injection risks [ 39 , 40 ].
Supply chain breaches–like firmware backdoors or tainted third-party tools—are increasingly addressed through real-time anomaly monitoring and rigorous SBOM validation with AI-assisted risk scoring [ 41 ].
System-level intrusions exploit outdated or misconfigured edge systems. Cutting-edge LSTM-CNN-Attention models now surpass 99% accuracy in detecting malicious processes, while distributed peer-to-peer monitoring adds a lightweight alternative [ 38 ]. Data interception threats, especially in wireless IIoT segments, are mitigated by using optimized DTLS 1.3 profiles with session resumption, which maintains performance without compromising security [ 40 ].
DoS and DDoS attacks targeting IIoT infrastructure now see high-accuracy detection (>99.7%) through time-series ML analysis applied to recent CIC IoT 2023 datasets [ 42 ]. Finally, MitM communications attacks are addressed by deploying AI-based anomaly detectors at edge gateways, which provide real-time detection of forged or manipulated messages with high precision [ 43 ].
2.2 Intrusion detection systems in IIoT: types and architectures
To counter these diverse and evolving threats, IDS plays a pivotal role in modern IIoT security architectures. IDSs are specialized tools that monitor network traffic, system logs, and device behaviors to detect suspicious or malicious activity. They can be broadly categorized into three types: signature-based, anomaly-based, and hybrid detection systems.
Signature-based IDS operates by comparing observed traffic or behaviors against a database of known attack patterns, also known as "signatures." Tools like Snort or Suricata are well-established in this category. While highly effective against known threats with stable behavior profiles, signature-based systems struggle to detect zero-day attacks or polymorphic malware. Their dependence on regular signature updates and inability to generalize to novel threat vectors make them less suitable for rapidly evolving IIoT environments [ 28 ].
Anomaly-based IDS, in contrast, establishes a model of normal behavior using statistical methods or machine learning and triggers alerts when deviations are observed. This category is particularly advantageous in IIoT systems where legitimate traffic may vary across different machines or operations, and where emerging threats lack historical signatures. However, these systems are prone to false positives, especially in highly dynamic environments. Moreover, the quality and representativeness of the training data significantly influence their effectiveness [ 44 ].
A hybrid IDS aims to combine the strengths of both approaches by layering signature detection for known threats with anomaly detection for unknown behaviors. In IIoT networks, hybrid IDSs are often implemented at both edge and cloud layers, providing a balance between performance, scalability, and accuracy. Recent advances also integrate behavior-based rules and context-aware models that account for operational parameters such as production schedules, device roles, and physical location [ 25 ].
Another critical dimension is the deployment architecture. Network-based IDS (NIDS) operates by analyzing traffic at aggregation points such as routers or gateways. These systems are scalable and non-intrusive but may struggle with encrypted traffic or lack device-specific context. Host-based IDS (HIDS), on the other hand, resides on individual endpoints and monitors logs, file integrity, and system calls. While they offer deeper visibility into local behavior, they can incur performance overhead and may not detect lateral movement across the network. In IIoT systems, a combination of both NIDS and HIDS is often used to achieve comprehensive coverage [ 26 ].
The emergence of edge computing has further influenced the design of IDS. Edge-based IDS processes data close to where it is generated, enabling real-time detection with reduced latency and lower bandwidth usage. This is particularly useful in IIoT environments where timely responses are critical. However, resource limitations on edge devices necessitate the use of lightweight models and efficient algorithms. Federated learning is increasingly adopted in this context, allowing edge nodes to collaboratively train intrusion detection models without sharing raw data, preserving privacy and reducing network congestion [ 44 ]. Table 3 presents a comparative analysis of IDS types and architectures in IIoTenvironments. It contrasts signature-based, anomaly-based, and hybrid IDS approaches acrosskey features, including detection methodology, zero-day attack capability, false-positive rates,adaptability, resource usage, deployment layers, learning types, and deployment complexity,highlighting the strengths and limitations of each with respect to IIoT security requirements.
2.2.1 Limitations of traditional IDS in IIoT and the importance of AI-driven detection
Traditional IDS development, particularly in complex environments, encounters fundamental limitations when deployed in IIoT environments. Signature-based IDS relies on predefined attack patterns and continuously matches incoming traffic against stored rules. Although effective in conventional enterprise networks, this paradigm becomes problematic in IIoT due to the strict resource constraints of edge devices. Many IIoT nodes operate with limited CPU capacity, restricted memory, and modest energy budgets, making it impractical to maintain or update large signature databases or perform deep packet inspection without disrupting primary control functions. In addition, IIoT communication often relies on lightweight protocols such as MQTT, CoAP, and Modbus, where reduced header sizes, bandwidth limitations, and intermittent connectivity further limit the feasibility of signature-heavy inspection.
Beyond computational limitations, static approaches struggle with the highly dynamic and heterogeneous nature of IIoT traffic. Industrial devices differ widely in hardware capabilities, communication patterns, and operational contexts, which causes substantial variability in benign behavior. Static IDS cannot generalize across such diverse environments and typically degrade when confronted with encrypted traffic, protocol deviations, or behavioral drift. More critically, a signature-hunting system operators make informed decisions and reduces attacks or previously unseen threat variants, as no corresponding signatures exist. This limitation is particularly severe in IIoT settings where attackers frequently exploit device firmware, cloud gateways, and cyber-physical interfaces.
AI- and machine-learning-based IDS address these challenges by shifting detection from explicit rule matching to adaptive behavioral modeling. Instead of relying on predefined patterns, ML models learn statistical relationships from simple spoofing to sophisticated APTs–requiring robust, sophisticated methods to identify subtle deviations that may indicate emerging or unknown threats. Furthermore, lightweight learning architectures–such as compressed deep neural networks, incremental learning, and federated training–enable the deployment of ML models on resource-constrained IIoT nodes without incurring significant overhead. Deep learning techniques, including CNNs, LSTMs, and graph-based models, further enhance detection accuracy by capturing multi-dimensional features and contextual interactions within cyber-physical processes. In doing so, AI-driven IDS provides a scalable, adaptive, and resource-efficient alternative to traditional IDS, aligning more closely with the operational realities and security requirements of modern IIoT systems.
2.3 The role of artificial intelligence in IIoT intrusion detection
AI has emerged as a transformative force in IDS development, particularly in complex, resource-constrained environments such as IIoT. Traditional machine learning methods, such as Decision Trees, Support Vector Machines (SVMs), and Random Forests, have been applied to classify traffic patterns, detect anomalies, and correlate events. More recently, deep learning models such as Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and Transformers have demonstrated high accuracy in identifying complex temporal and spatial relationships within network traffic and device logs [ 28 ].
These AI-driven approaches excel in environments where patterns evolve or where traditional rule-based methods fall short. For instance, CNNs have been used to detect spatial correlations in multi-channel sensor data, while LSTMs are effective in modeling sequential command behavior in control systems. Additionally, adversarial learning and ensemble methods have been introduced to enhance resilience against evasion techniques and improve model generalization [ 44 ].
To address explainability and trust–a crucial requirement in safety-critical IIoT systems–researchers have begun integrating Explainable AI (XAI) techniques. Models augmented with SHAP values, LIME, or saliency maps provide insights into why a specific alert was raised, helping system operators make informed decisions and reducing the likelihood of misinterpretation. Moreover, ongoing research is exploring the integration of reinforcement learning for adaptive response strategies and the use of blockchain for distributed, tamper-proof logging and alerting [ 27 ].
The Industrial Internet of Things introduces a dynamic, complex, and high-stakes operational environment where security cannot be an afterthought. The wide range of threats targeting IIoT systems–from simple spoofing to sophisticated APTs–requires robust, intelligent intrusion detection mechanisms. IDS solutions must be tailored to IIoT’s specific architectural and operational constraints, emphasizing lightweight computation, real-time performance, and adaptability to emerging threats. The integration of AI, edge computing, and federated learning represents a promising path forward, enabling the development of scalable, accurate, and interpretable IDS frameworks suited to the evolving demands of industrial cybersecurity.
3 Deployment considerations in IIoT IDS
Designing and deploying an IDS for the IIoT presents a complex array of challenges, combining constraints imposed by operational technologies, edge computing limitations, and the need for real-time responsiveness [ 45 ]. A successful IIoT IDS must operate effectively across the edge-fog-cloud continuum, balancing detection accuracy, energy efficiency, latency demands, and integration with legacy industrial systems.
The hierarchical structure of IIoT ecosystems, as illustrated in Fig. 8 , comprises three major domains: the Network Control Domain , the Information & Operation Domain , and the Business & Application Domain . This layered architecture necessitates a strategic distribution of intrusion detection functions to balance latency, computational constraints, and detection accuracy.
At the edge of the Network Control Domain, sensors, actuators, and controllers generate real-time data and execute time-sensitive tasks. Here, lightweight anomaly detectors—such as those based on One-Class Support Vector Machines (OCSVM) or Local Outlier Factor (LOF) [ 46 ]—can be embedded directly within controllers or edge gateways to flag anomalies with low latency and minimal resource overhead. However, due to hardware limitations, these systems struggle with deep packet inspection or the detection of advanced, multi-stage attacks. The Information & Operation Domain, particularly the platform tier responsible for data transformation and analytics, offers greater computational flexibility. Fog-level gateways and local servers within this domain are well-suited for running more sophisticated detection models, including CNN-LSTM hybrids and transformer-based ensembles. These models can process aggregated telemetry data from multiple edge nodes, enabling more context-rich, accurate detection in near real-time.
Finally, the Business & Application Domain, which includes enterprise-level control and service portals, can host centralized analytics and threat correlation engines in the cloud [ 47 ]. These components are ideal for executing long-term behavioral analysis, attack attribution, and cross-domain correlation using historical data.
Recent findings by Mallidi and Ramisetty [ 48 ] emphasize that multilevel IDS deployments—where edge devices perform initial detection and forward flagged data for deeper analysis at higher tiers–offer the most effective trade-off between performance and resource consumption in IIoT environments. This tiered detection strategy not only minimizes false positives but also ensures timely responses to both known and unknown threats.
In contrast, relying solely on cloud-based IDS, though offering comprehensive analytics and archival trend tracking, introduces unacceptable latency and bandwidth burdens [ 49 ]. Transmitting raw industrial telemetry to the cloud during an ongoing attack can delay detection and cause network congestion. Distilling telemetry on-premises and forwarding only alerts or summarized metrics can mitigate these issues, but cloud-centric approaches remain susceptible to outages and connectivity interruptions. Statistical findings from hybrid fog-edge-cloud deployments in related domains, such as healthcare IoMT, have demonstrated latency reductions of over 60% and reliability improvements due to diversified processing paths.
Energy-efficient intrusion detection has emerged as a key challenge in IIoT, where many devices operate on batteries or resource-limited modules [ 50 ]. The concept of “Green IDS,” which emphasizes minimal energ...
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
