Work

Attention-based and contrastive deep learning models for real-time anomaly detection in Edge-IIoT networks

Year: 2026

Type: article

Abstract: The rapid expansion of Industrial Internet of Things (IIoT) systems has increased the cyber-attack surface of critical infrastructure, requiring intrusion detection systems (IDS) that are accurate, robust, and efficient under resource-constrained edge environments. Traditional approaches suffer from limited generalization, poor handling of class imbalance, and lack of statistical reliability and interpretability. This paper proposes a modular deep learning framework integrating TabTransformer, Variational Autoencoder, and contrastive learning, combined through multi-trial training (N = 10), statistical aggregation, and F1-weighted ensemble fusion. Experiments on the Edge-IIoTset dataset ( $$\approx $$ 1.9M samples, 15 classes) achieve 97.60% accuracy and 83.42% F1-score, with multi-trial aggregation reducing the uncertainty associated with single-run reporting. From a computational perspective, training is performed using large-batch optimization (batch size = 16,384) with early stopping (patience = 50), while inference requires a single forward pass per model followed by constant-time fusion. The framework operates on compact tabular inputs ( $$\approx $$ 96 features), resulting in a lightweight memory footprint (on the order of a few megabytes per model) and enabling efficient deployment. The inference pipeline processes batches in a few milliseconds on GPU-class hardware, ensuring real-time responsiveness for high-throughput IIoT traffic streams while maintaining low computational overhead and energy demand. Ablation analysis shows that removing ensemble fusion reduces F1-score by approximately 1%:2%, while eliminating multi-trial aggregation significantly increases variance, highlighting the importance of statistical robustness. Furthermore, SHAP-based explainable AI (XAI) provides insight into feature-level contributions, enhancing transparency and supporting human-in-the-loop security operations. Overall, the proposed framework achieves a balanced trade-off between predictive performance and computational efficiency, delivering a reproducible, interpretable, and deployment-oriented IDS solution for real-time IIoT environments. Practical deployment considerations, including model export to ONNX format and quantization for edge hardware, are outlined as immediate next steps.

Source: Scientific Reports

DOI: 10.1038/s41598-026-70891-x

Authors: Ahmad Reda Alzighaibi, Adam Marks, Abdullateef I. Almudaifer, Hossam Magdy Balaha, Nadhir Ben Halima, Mostafa A. Elhosseini