Explainable and Data-Efficient Deep Learning for Enhanced Attack Detection in IIoT Ecosystem

Abstract

The Industrial Internet of Things (IIoT) is rapidly evolving, and with this evolution, cyber threats have become a significant issue. IIoT networks, despite improving service quality, are uniquely vulnerable to security threats due to their inherent connectivity and the use of low-power devices. Traditional Deep Learning-based intrusion detection system (IDS), while accurate, suffer from a “black box” issue that hides the reasoning behind their decisions, leading to a decrease in user trust. To address this, our research presents an Explainable and intelligent mechanism for data-efficient intrusion detection in IIoT. Our proposed IDS enhances data efficiency by employing a bidirectional long-short term memory (BiLSTM) model with a self-adaptive attention mechanism. The self-adaptive attention mechanism is a novel feature of our IDS framework, designed specifically for IIoT environments. This mechanism dynamically adjusts its focus to prioritize critical elements within a dataset, allocating more computational resources to data segments likely to contain patterns or anomalies indicative of security threats. When integrated with BiLSTM, which excels at capturing temporal dependencies, the mechanism enhances the IDS’s ability to learn efficiently from limited datasets. This focus on significant data features and temporal patterns reduces the need for extensive training datasets, making it particularly effective in IIoT settings where data may be sparse yet complex. In addition, we enhance the proposed IDS’s transparency by incorporating the Shapley additive explanations mechanism from explainable AI, thereby boosting the IDS’s trustworthiness and interpretability. Our system exhibits outstanding performance on benchmark datasets, such as CICIDS2017 and X-IIoTID, attaining accuracies of 99.92% and 96.54%, respectively.