Network Dominance and the MITM Exception: A Modality-Aware Analysis of IIoT Intrusion Detection on the DataSense Benchmark
Year: 2026
Type: preprint
Abstract: The Industrial Internet of Things (IIoT) is rapidly expanding the attack surface of critical infrastructure, and intrusion detection systems (IDSs) are increasingly relied upon as the principal automated defence. Recent benchmark datasets such as DataSense provide synchronized network traffic and device telemetry to enable cross-modal IDS research, and a growing body of work assumes that combining these modalities improves detection. However, the per-attack-category contribution of each modality has not been empirically tested on this newest generation of IIoT benchmarks. This paper presents a modality-aware analysis of IIoT intrusion detection on DataSense, partitioning the 84 pre-extracted features into 76 network and 8 telemetry channels (reduced to 64 network and 7 telemetry features after removal of leakage-prone string-valued columns) and constructing three feature configurations: network-only, telemetry-only, and fused. We train Random Forest, XGBoost, LightGBM, and Support Vector Machine classifiers under each configuration for binary, seven-class, and fine-grained eighty-four-class classification, producing 36 experimental conditions. Results show that the network channel alone is nearly sufficient: XGBoost on network-only features achieves 0.9890 macro F1 on binary detection and 0.9819 on the seven-class task, within 0.6 percentage points of the fused configuration in every category. SHAP attribution confirms that network features account for over 99 percent of explanatory weight in six of seven attack categories, with man-in-the-middle (MITM) being the single exception at approximately 10 percent telemetry contribution. The dominance result holds across both 1-second and 10-second window granularities. Practical implication: for cost-constrained IIoT monitoring, the 8 telemetry features as currently engineered in DataSense add minimal value over the network channel, except when MITM-class attacks must be distinguished.
Source: Research Square
Authors: Okoi Michael Obeten, Omowumi Hafsat Aliu
Institution: Auchi Polytechnic
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204252960