A Task-Specific Autoencoder–CatBoost Framework for Intrusion Detection in Imbalanced IIoT

Abstract

Industrial Internet of Things (IIoT) intrusion detection remains challenging because of class imbalance, rare attacks, and heterogeneous evaluation protocols. This study proposes a modular intrusion-detection framework based on task-specific autoencoder representation learning and downstream CatBoost classification. The binary branch learns a 16-dimensional representation from benign traffic and combines it with reconstruction error, whereas the multiclass branch uses a separate 24-dimensional representation learned from malicious traffic. On ML-EdgeIIoT, the extended five-fold group-aware binary evaluation achieved ROC-AUC = 0.9925, AP = 0.9981, and F1 = 0.9829, with a benign FPR of 0.1113. A reconstruction-error ablation increased F1 from 0.9800 to 0.9829 and reduced FPR from 0.1311 to 0.1113. The complete 14-class evaluation achieved macro-F1 = 0.6175 and macro-AUC = 0.9549, while the 15-label cascade reached strict end-to-end attack-type success = 0.6584. External validation on WUSTL-IIoT-2021 yielded a five-label macro-F1 of 0.9408 and strict success of 0.9993. These results support the task-specific modular design while highlighting the remaining difficulty of fine-grained attack attribution and false-alarm reduction.

1. Introduction

The Industrial Internet of Things (IIoT) integrates interconnected devices, sensors, actuators, cyber-physical systems, and edge-computing components to support industrial monitoring and automation [1]. This connectivity also increases exposure to cyber threats, making intrusion detection systems (IDSs) important for protecting industrial networks. Because these environments often require continuous availability, IDS-based monitoring is particularly relevant [2]. Machine learning (ML) and deep learning (DL) have therefore been widely investigated for IoT and IIoT intrusion detection [3,4,5].

Despite recent progress, IDS evaluation in IoT and IIoT remains sensitive to differences in datasets, protocols, and reporting practices, which limit reproducibility and direct comparison across studies [6,7]. Accuracy alone is also insufficient in imbalanced multiclass settings, where dominant classes can mask poor performance on rare attacks [8,9].

Diverse benchmark datasets are therefore important for evaluating IDSs under heterogeneous traffic conditions. CICIoT2023, for example, contains 33 attacks grouped into seven categories [7]. This study uses Edge-IIoTset as the primary benchmark because it was designed for IoT/IIoT cybersecurity research and contains benign and malicious traffic across heterogeneous attack scenarios [10].

Class imbalance remains a major challenge in IIoT intrusion detection because dominant traffic patterns can reduce sensitivity to rare attacks [11]. High-dimensional traffic data may also contain redundant or weakly informative features, increasing computational cost and overfitting risk. Feature extraction and dimensionality reduction are therefore important for learning compact IDS representations [9,12].

Recent IIoT IDS research includes lightweight tabular, deep-learning, ensemble, and hybrid approaches, including ensemble methods for IIoT-MEC environments [13]. Autoencoder-based representation learning has also been combined with supervised classifiers [14,15,16,17], while CatBoost has been investigated in related IoT and IIoT IDS settings [18,19].

Therefore, the contribution of this study does not lie in simply combining an autoencoder with a supervised classifier. Among the closest studies reviewed, separate task-specific autoencoders trained on benign and malicious traffic for binary detection and attack attribution, respectively, have not been explicitly evaluated. This study examines that design under group-aware evaluation, complete 14-class attribution, downstream-classifier sensitivity, end-to-end cascading, external validation, and reconstruction-error ablation.

Based on this gap, the study addresses the following research questions:

• RQ1: Can task-specific autoencoder representations provide compact and informative features for IIoT intrusion detection?
• RQ2: Does adding reconstruction error to the latent representation improve binary intrusion detection compared with using latent features alone?
• RQ3: How effectively can the proposed task-specific autoencoder framework support multiclass attack attribution under imbalanced IIoT traffic, including the complete 14-class setting?

To address these questions, the framework uses separate 16D benign-trained and 24D malicious-trained autoencoder representations for binary detection and attack attribution, respectively. CatBoost is the main classifier, with XGBoost and LightGBM used for sensitivity analysis, alongside group-aware, cascade, WUSTL-IIoT-2021 [20], ablation, and CPU-based evaluations.

2. Related Work

IIoT intrusion-detection research spans conventional machine learning, deep learning, ensemble, and hybrid approaches, with recent studies reporting strong results across public benchmarks [21,22]. These approaches differ substantially in model complexity, feature-learning strategy, class-imbalance handling, and evaluation protocol.

Beyond IDS model design, recent engineering-AI studies also emphasize reproducible benchmarking, deployment constraints, and adaptive industrial decision support. Su and Tseng [23] proposed a physics-informed IIoT benchmarking framework, Liu et al. [24] applied heterogeneous graph learning with deep reinforcement learning to dynamic scheduling, while Jamshidi et al. [25] and Shaikhanova et al. [26] addressed resource-aware and reproducible IDS evaluation. These works support broader evaluation beyond predictive accuracy alone.

Among recent deep and hybrid IDS methods, Fraihat et al. [27] combined ADASYN, HGS-CS feature selection, a gated Transformer–BiLSTM architecture, and attention-weighted federated learning. The framework reported an average accuracy of approximately 99.27%, with F1-scores frequently above 99%, but relies on a highly composite end-to-end pipeline. Yang et al. [28] introduced NIDS-BAI to address feature redundancy and minority-class detection through feature selection, imbalance-aware preprocessing, and a hybrid attention-based BiGRU/Inception-CNN architecture. The method reported strong detection performance but relies on an integrated end-to-end deep pipeline rather than a separately modularized representation-learning and classification design. Ishtiaq et al. [29] proposed CST-AFNet, combining multi-scale CNNs, BiGRUs, and channel-temporal attention for feature extraction on Edge-IIoTset. The model reported 99.97% accuracy, with macro-precision, recall, and F1-score above 99.3%. However, it was evaluated under a different multiclass configuration including benign traffic, which limits direct comparison with the present group-aware binary and attack-attribution settings. By contrast, Ismail et al. [3] evaluated lightweight supervised ML models across TON_IoT, WUSTL-IIoT-2021, and Edge-IIoTset using Mutual Information-based feature selection and classifiers including Decision Tree, Random Forest, Bagging, Stacking, and LightGBM. The study provides a useful multi-dataset benchmark for tabular IDSs, but does not include a learned latent representation stage. Other studies illustrate the diversity of IIoT IDS design. Ruiz-Villafranca et al. [30] applied TabPFN to IIoT intrusion detection, followed by WFE-Tab [13], a weighted TabPFN ensemble evaluated on Edge-IIoTset. P-DNT [31] combined Pearson-based feature analysis with deep neural and Transformer components, while Khan et al. [32] integrated neural classification with genetic-algorithm feature optimization. Aldaej et al. [33] proposed a two-stage ensemble architecture targeting scalable and resource-aware IoT-edge intrusion detection.

Recent studies have also combined autoencoder-based representation learning with supervised intrusion classification. Narmadha and Balaji [34] used an optimized autoencoder for network anomaly detection, while Alaghbari et al. [14] trained a deep autoencoder on normal traffic and reused its encoder for low-dimensional attack classification. Hasan et al. [16] addressed class imbalance on Edge-IIoTset using a cost-sensitive autoencoder. Moucharraf et al. [15] combined feature selection, deep autoencoder representation learning, and boosting, whereas Shwaysh et al. [17] paired autoencoder-based dimensionality reduction with XGBoost, LightGBM, and CatBoost. CatBoost has also been studied independently in IoT/IIoT IDS settings [18,19].

Alternative learning paradigms have also been explored. Dong et al. [35] applied deep reinforcement learning to abnormal network-traffic detection, while Naha et al. [36] reviewed ML-enabled IoT monitoring applications including predictive maintenance and fault detection. These studies illustrate broader learning and monitoring perspectives beyond conventional supervised IDS pipelines.

Taken together, recent IIoT IDS research spans lightweight tabular models, high-capacity deep architectures, hybrid and ensemble pipelines, and autoencoder-based representation learning with downstream classifiers. Direct comparison remains difficult because studies differ in datasets, preprocessing, class configurations, imbalance handling, evaluation protocols, and reported metrics. Recent reproducibility- and deployment-oriented work further highlights the importance of transparent benchmarking and resource-aware evaluation alongside predictive performance.

Table 1 provides an overview of the representative related works discussed in this study, including their category, techniques, datasets, objectives, and principal limitations. Its purpose is to map the field and clarify methodological tendencies rather than to compare heterogeneous reported scores directly.

Table 1. A comparison with representative related works.

Ref.	Approach	Dataset	Main Relevance/Limitation
[28] Yang et al. (2024)	Attention + BiGRU + Inception-CNN	Edge-IIoTset, CIC-IDS2017, CICIoT2023	Addresses minority-class detection; complex end-to-end architecture.
[33] Aldaej et al. (2024)	Two-stage ensemble	Bot-IoT, CICIDS2018, NSL-KDD, IoTID20	Resource-aware IoT-edge IDS; heterogeneous evaluation settings.
[32] Khan et al. (2025)	ANN + GA feature optimization	IIoT intrusion dataset	Adaptive feature optimization; limited five-class setting.
[3] Ismail et al. (2025)	Feature selection + conventional ML	TON_IoT, WUSTL-IIoT-2021, Edge-IIoTset	Multi-dataset lightweight benchmark; no learned latent representation.
[13] Ruiz-Villafranca et al. (2025)	Weighted TabPFN ensemble	Edge-IIoTset	Strong tabular ensemble; increased ensemble complexity.
[29] Ishtiaq et al. (2025)	CNN + BiGRU + dual attention	Edge-IIoTset	High-capacity deep IDS; computationally demanding.
[27] Fraihat et al. (2026)	Feature selection + Transformer–BiLSTM + FL	Multiple IIoT datasets	Addresses imbalance and distributed learning; highly composite pipeline.
[31] Du et al. (2026)	Pearson analysis + DNN + Transformer	IIoT intrusion dataset	Hybrid deep modeling; high architectural complexity.
[14] Alaghbari et al. (2023)	Deep AE + classifiers	N-BaIoT, MQTTset	Reuses a normal-trained AE for attack classification.
[15] Moucharraf et al. (2026)	Feature selection + Deep AE + XGBoost	N-BaIoT, CICIoT2023	AE-boosting hybrid; no separate task-specific AEs.
[16] Hasan et al. (2025)	Cost-sensitive AE + classifiers	Edge-IIoTset	Imbalance-aware AE; uses one 6D AE rather than separate task-specific AEs.
[17] Shwaysh et al. (2026)	Information Gain + AE + boosting	CICIDS2018	AE with multiple boosters; single feature-learning pipeline.
[18] Kuraś et al. (2026)	ML optimization + feature selection	IIoT network traffic	Performance/efficiency optimization; no AE representation learning.
[19] Abinayaa et al. (2024)	Optimized CatBoost	WSN-DS	DoS-focused IoT detection; no AE-based representation learning.

Table 1 shows that recent IIoT IDS research includes direct tabular classification, deep end-to-end models, autoencoder-based hybrid pipelines, and gradient-boosting classifiers. Therefore, the contribution of this study does not lie in simply combining an autoencoder with a supervised classifier. Among the closest studies reviewed, however, separate task-specific autoencoders trained on benign and malicious traffic for binary detection and attack attribution, respectively, have not been explicitly evaluated. The present work evaluates this task-specific modular design through group-aware splitting, complete 14-class attribution, reconstruction-error ablation, classifier sensitivity, end-to-end cascading, external validation, and computational analysis.

3. A Hybrid Autoencoder–CatBoost Approach for IIoT Intrusion Detection

The proposed framework combines task-specific autoencoder-based representation learning with downstream CatBoost classification for IIoT intrusion detection. Two complementary representation-learning branches are used. In the binary branch, an autoencoder is trained exclusively on benign traffic, and the resulting latent representation is combined with the sample-wise reconstruction error before CatBoost classification. In the multiclass branch, a separate autoencoder is trained exclusively on malicious traffic, and its latent representation is used by CatBoost for attack-type attribution. This separation reflects the distinct objectives of binary intrusion detection and multiclass attack classification considered in recent IDS evaluation studies [37].

The evaluation includes an initial reference setting and an extended robustness setting on ML-EdgeIIoT, derived from Edge-IIoTset [10]. The initial setting retains the original binary task and 12-class malicious-only benchmark, excluding MITM and Fingerprinting. The extended setting restores all 14 attacks and uses five group-aware folds that keep identical 42-feature vectors within the same fold; both branches are then combined into a 15-label cascade. The framework is also retrained on WUSTL-IIoT-2021 [20] for external validation, and CPU-based latency, throughput, and memory overhead are reported. The overall workflow of the proposed framework is illustrated in Figure 1.

Figure 1. Overview of the proposed task-specific IDS framework and evaluation protocol. Separate autoencoders learn benign-oriented and attack-oriented representations for binary intrusion detection and multiclass attack attribution, respectively. The extended evaluation includes group-aware splitting, a 15-label cascade, external validation, and computational assessment (Arrows indicate the direction of data flow and processing through the framework).

3.1. Datasets and Preprocessing

Experiments use ML-EdgeIIoT, a processed configuration derived from Edge-IIoTset [10], containing 157,800 samples and 42 numerical predictors. Attack_label defines binary benign-versus-attack detection, whereas Attack_type defines multiclass attack attribution. Table 2 summarizes the evaluation settings. Only the 42 numerical predictors were retained [38] and normalized to the [0, 1] range using Min-Max scaling (Equation (1)) [39]. For ML-EdgeIIoT, Attack_label and Attack_type are used only as target variables and are excluded from the predictor matrix; the retained 42 predictors are numerical, so no additional categorical-feature encoding is applied.

$$x_{\mathrm{scaled}}={\displaystyle \frac{x-\min \left(x\right)}{\max \left(x\right)-\min \left(x\right)}}$$

(1)

where the scaling parameters are estimated on training data and applied unchanged to validation and test data.

Table 2. Dataset configurations and evaluation settings used in the study.

Component	Description
Primary dataset	ML-EdgeIIoT, derived from Edge-IIoTset [10]
Samples/input	157,800 samples; 42 numerical predictors
Binary target	Attack_label: Benign vs. Attack
Multiclass target	Attack_type
Initial binary reference	Original benign-vs.-malicious benchmark
Initial multiclass reference	Malicious-only attribution over 12 attacks; MITM and Fingerprinting excluded
Extended binary evaluation	Five-fold group-aware benign-vs.-malicious evaluation
Extended multiclass evaluation	Five-fold group-aware attribution over all 14 attacks
Grouping rule	Identical 42-feature vectors remain in the same fold
End-to-end evaluation	15 labels: Normal + 14 attacks
Classifier sensitivity	CatBoost, XGBoost, and LightGBM using identical AE features and outer folds
External benchmark	WUSTL-IIoT-2021 [20]; 1,194,464 samples; 41 numerical predictors
WUSTL targets	Binary Normal/Attack; Normal + DoS, Reconn, CommInj, and Backdoor
WUSTL partition	Group-safe approximately 60%/20%/20% train/validation/test split

For the extended ML-EdgeIIoT evaluation, MITM and Fingerprinting are restored, yielding 14 attack classes. Among 157,800 samples, 152,029 unique 42-feature vectors were identified; 7149 samples belonged to duplicated-vector groups, and 188 groups contained conflicting Attack_type labels. Identical feature vectors are therefore kept within the same fold to prevent duplicate leakage between training and test data.

External validation uses WUSTL-IIoT-2021 [20], containing 1,194,464 samples: 1,107,448 normal and 87,016 attack observations. After removing StartTime, LastTime, SrcAddr, DstAddr, sIpId, and dIpId, 41 numerical predictors remain. Target defines binary Normal/Attack detection, while Traffic provides four attack classes: DoS, Reconn, CommInj, and Backdoor, with Normal retained for the five-label cascade. A group-safe approximately 60%/20%/20% train-validation-test split keeps identical 41-feature vectors within the same partition; preprocessing is fitted on training data only.

3.2. Autoencoder-Based Representation Learning

A fully connected autoencoder learns a compact representation of the numerical traffic features. For an input x ∈ ℝⁿ, the encoder maps x to a latent vector z as defined in Equation (2).

z = f_θ(x)

(2)

The decoder reconstructs the input according to Equation (3).

$$\hat{x}=g_{\varphi }\left(z\right)$$

(3)

Training minimizes the mean squared reconstruction error defined in Equation (4).

$$L_{\mathit{AE}}\left(x\right)={\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1}^n}{\left(x_i-{\widehat{x}}_i\right)}^2$$

(4)

This objective encourages the latent representation to preserve informative structure while reducing redundancy [40,41].

For ML-EdgeIIoT, n = 42. The binary branch uses a 16-dimensional latent space selected during development using validation data only, with test data excluded from selection. The multiclass branch uses a 24-dimensional latent space retained as the strongest evaluated development setting. Both dimensions are kept fixed in the extended experiments to avoid test-driven re-tuning.

For WUSTL-IIoT-2021, the same 16- and 24-dimensional latent sizes are retained without re-tuning; only the input dimension changes to n = 41.

3.3. Binary Intrusion Detection Setting

The binary branch is evaluated under the initial reference benchmark and the extended five-fold group-aware protocol. Its autoencoder is trained only on benign traffic so that reconstruction error can reflect deviation from learned normal patterns [34]. Each sample is represented by the 16-dimensional latent vector and a scalar reconstruction error defined in Equation (5).

e(x) = L_AE(x)

(5)

These are concatenated to form the final feature vector described by Equation (6).

$$\tilde{x}=\left[z;e\left(x\right)\right]$$

(6)

The fused representation is classified with CatBoost, retained as the fixed downstream learner of the proposed pipeline. CatBoost uses ordered boosting to reduce prediction shift during training [42]. Binary training minimizes the weighted log-loss in Equation (7).

$$L_{\mathrm{bin}}=-{\displaystyle \frac{1}{N}}{\displaystyle \sum _{i=1}^N}{w}_{y_i}\left[y_i\log \left(p_i\right)+\left(1-y_i\right)\log \left(1-p_i\right)\right]$$

(7)

where N is the number of training samples, y_i is the binary label, p_i is the predicted attack probability, and $w_{y_i}$ is the class weight associated with y_i.

Binary performance is evaluated using ROC-AUC [43,44], which summarizes benign-versus-attack discrimination across decision thresholds, as defined in Equation (8).

$$\mathit{AUC}={\int }_0^1\mathit{TPR}\left(\mathit{FPR}\right)\hspace{0.17em}d\left(\mathit{FPR}\right)$$

(8)

The true positive rate (TPR), also referred to as recall, and the false positive rate (FPR) are defined in Equations (9) and (10), respectively.

$$\mathit{TPR}={\displaystyle \frac{\mathit{TP}}{\mathit{TP}+\mathit{FN}}}$$

(9)

$$\mathit{FPR}={\displaystyle \frac{\mathit{FP}}{\mathit{FP}+\mathit{TN}}}$$

(10)

Average precision (AP) is also reported because it summarizes the precision–recall trade-off under class imbalance [44], as defined in Equation (11).

$$\mathit{AP}={\displaystyle {\sum }_{n=1}^N}({\mathrm{R}}_{\mathrm{n}}-{\mathrm{R}}_{\mathrm{n}-1}){\mathrm{P}}_{\mathrm{n}}$$

(11)

where P_n and R_n denote the precision and recall values at the n-th operating point, respectively, and N is the number of evaluated points on the precision–recall curve.

For the extended evaluation, ML-EdgeIIoT is assessed using five group-aware outer folds, with identical 42-feature vectors kept within the same fold to prevent duplicate leakage. Each outer-training partition is further divided into group-safe inner training and validation subsets. The autoencoder is trained only on benign inner-training samples, with benign inner-validation samples used for early stopping. The resulting 16-dimensional latent features and reconstruction error are concatenated and provided to CatBoost.

CatBoost is trained on the inner-training subset only. The malicious-class weight is computed from the benign-to-malicious ratio in that subset, while the decision threshold is selected exclusively on inner validation by maximizing binary F1. The outer fold is used only for final evaluation. After all five folds, the out-of-fold predictions are concatenated to obtain global robustness metrics.

3.4. Multiclass Attack Classification Setting

The multiclass branch is evaluated in the initial 12-class reference and extended 14-class settings. Benign traffic is removed because this stage performs attack attribution; its dedicated autoencoder is therefore trained on malicious traffic to model differences among attack types. This task-specific choice is not assumed to be optimal. The initial setting excludes MITM and Fingerprinting because of their limited support, whereas the extended setting restores both classes, with 1214 and 1001 samples, respectively (Figure 2).

Figure 2. Distribution of the 14 malicious attack categories in ML-EdgeIIoT. MITM and Fingerprinting, highlighted by hatched bars, were excluded from the initial 12-class benchmark because of their limited support and reintroduced in the extended 14-class evaluation.

Both settings use the same malicious-only autoencoder with a 24-dimensional latent representation followed by CatBoost. For the extended evaluation, the established architecture and classifier settings are kept fixed. The same five outer group-aware folds used in the binary analysis are retained, keeping identical 42-feature vectors within the same fold. Predictions from malicious samples across all outer test folds are concatenated to obtain global out-of-fold performance.

For K attack classes, class probabilities are estimated using Equation (12), with K = 12 for the initial benchmark and K = 14 for the extended evaluation.

$$P\left(y=k|x\right)={\displaystyle \frac{\exp \left(s_k\left(x\right)\right)}{{\displaystyle {\sum }_{\mathrm{j}=1}^K}\exp \left(s_j\left(x\right)\right)}}$$

(12)

Training minimizes the multiclass cross-entropy loss defined in Equation (13).

$$L_{\mathrm{multi}}=-{\displaystyle \frac{1}{m}}{\displaystyle \sum _{i=1}^m}{\displaystyle \sum _{k=1}^K}I\left(y_i=k\right)\log P\left(y_i=k\mid x_i\right)$$

(13)

where I(y_i = k) is an indicator function equal to 1 if sample i belongs to class k, and 0 otherwise.

Before multiclass filtering, ML-EdgeIIoT contains 157,800 samples: Normal (24,301), Backdoor (10,195), DDoS_HTTP (10,561), DDoS_ICMP (14,090), DDoS_TCP (10,247), DDoS_UDP (14,498), Fingerprinting (1001), MITM (1214), Password (9989), Port_Scanning (10,071), Ransomware (10,925), SQL_injection (10,311), Uploading (10,269), Vulnerability_scanner (10,076), and XSS (10,052). For the initial 12-class benchmark, Normal, MITM, and Fingerprinting are excluded, leaving 131,284 malicious samples; the counts of the 12 retained attack classes are unchanged. The extended 14-class benchmark restores MITM and Fingerprinting, yielding 133,499 malicious samples.

3.5. End-to-End Cascade and External Validation

The binary and multiclass branches are combined into an end-to-end cascade over mixed traffic. Samples predicted as Normal stop at the binary stage; samples predicted as Attack are forwarded to the 14-class attribution branch. The final ML-EdgeIIoT output therefore contains 15 labels: Normal plus 14 attacks. The same five outer group-aware folds are used, and binary-stage errors are retained in the final evaluation.

External validation is performed on WUSTL-IIoT-2021 [20] using the same task-specific AE-CatBoost design with 41 input features. The framework is retrained on WUSTL rather than transferred directly from ML-EdgeIIoT and is evaluated with the group-safe train-validation-test split defined in Section 3.1. Binary detection, four-class attack attribution, and the resulting five-label cascade are evaluated without WUSTL-specific hyperparameter re-tuning.

3.6. Evaluation Metrics

Multiclass performance is evaluated using accuracy, macro-F1, and one-vs-rest macro-AUC [45,46], as defined in Equations (14)–(19).

$$\mathit{Accuracy}={\displaystyle \frac{{\displaystyle {\sum }_{k=1}^K}T{P}_k}{N}}$$

(14)

For each class k:

$${\mathit{Precision}}_k={\displaystyle \frac{{\mathit{TP}}_k}{{\mathit{TP}}_k+{\mathit{FP}}_k}}$$

(15)

$${\mathit{Recall}}_k={\displaystyle \frac{{\mathit{TP}}_k}{{\mathit{TP}}_k+{\mathit{FN}}_k}}$$

(16)

$$F{1}_k={\displaystyle \frac{2{\mathit{Precision}}_k{\mathit{Recall}}_k}{{\mathit{Precision}}_k+{\mathit{Recall}}_k}}$$

(17)

$$\mathit{MacroF}1={\displaystyle \frac{1}{K}}{\displaystyle {\sum }_{k=1}^K}F{1}_k$$

(18)

$$\mathit{MacroAUC}={\displaystyle \frac{1}{K}}{\displaystyle {\sum }_{k=1}^K}AU{C}_k$$

(19)

Macro-averaged metrics are emphasized because they provide a more informative view of IDS performance under class imbalance than accuracy alone [25,43].

For the extended 14-class and end-to-end evaluations, per-class precision, recall, F1-score, support, and Weighted-F1 are also reported. Cascade performance additionally includes attack recall, benign FPR, conditional attribution accuracy over true attacks forwarded to the multiclass stage, and strict end-to-end attack-type success, defined as the proportion of all true attacks that are both detected and correctly attributed.

3.7. Training, Reporting, and Computational Evaluation

All preprocessing and model selection use training and validation data only, with outer test folds reserved for final evaluation. The main extended ML-EdgeIIoT and WUSTL-IIoT-2021 experiments retain the established AE-CatBoost configurations without test-driven re-tuning [26]. A separate classifier-sensitivity analysis compares CatBoost, XGBoost, and LightGBM using identical AE features and the same outer folds. Each booster is evaluated over four depth/learning-rate combinations selected on inner validation only; the outer fold is evaluated once after selection.

For binary comparison, classifier selection uses validation ROC-AUC and the decision threshold is chosen by validation F1; for 14-class attribution, selection uses validation macro-F1. This analysis is reported separately and does not replace the fixed CatBoost results of the main framework. A separate binary ablation compares the 16D latent representation alone with the 17D latent-plus-reconstruction-error representation under the same five-fold group-aware protocol; within each fold, the same AE and CatBoost settings are used, so only the classifier input changes.

Deployment-oriented computational feasibility is assessed on a CPU-only system through single-sample inference latency, batched and full-cascade throughput, and process-memory overhead. Timing measurements are performed after model warm-up, while memory is measured in an isolated process using model-loading RSS increase and additional peak RSS during inference. These measurements characterize offline tabular inference rather than live packet-stream deployment.

4. Results

This section reports the initial reference benchmarks and the extended evaluations defined in Section 3. Results cover binary detection and reconstruction-error ablation, multiclass attack attribution, classifier sensitivity, the 15-label cascade, external validation on WUSTL-IIoT-2021, and offline CPU-based computational feasibility. For group-aware ML-EdgeIIoT experiments, global out-of-fold results are emphasized, with class-wise and fold-level summaries where relevant.

4.1. Binary Detection Results

The initial binary reference achieved ROC-AUC = 0.9776 and AP = 0.9960. Under the extended five-fold group-aware protocol, using the validation-selected threshold in each outer fold, global OOF performance reached ROC-AUC = 0.9925, AP = 0.9981, precision = 0.9799, F1 = 0.9829, attack recall = 0.9859, FNR = 0.0141, and benign FPR = 0.1113. Across folds, ROC-AUC averaged 0.9925 ± 0.0045 and AP 0.9981 ± 0.0018. Because the two settings use different evaluation protocols, these results are complementary rather than directly comparable.

Despite strong discrimination, the 11.13% benign FPR remains an important operational limitation. The corresponding ROC and Precision–Recall curves are shown in Figure 3.

Figure 3. Binary detection performance under the extended five-fold group-aware evaluation on ML-EdgeIIoT: (a) ROC curve, where the dashed diagonal line represents the no-skill (random-classifier) baseline; (b) Precision–Recall curve. Both curves are computed from global out-of-fold predictions, with each sample predicted only when assigned to a held-out outer fold.

These results show that the learned latent representation combined with reconstruction error retains strong binary discrimination under group-aware evaluation. However, the observed benign FPR confirms that further false-alarm reduction is still needed for operational use. A binary ablation under the same group-aware protocol compared the 16D latent representation alone with the 17D latent-plus-reconstruction-error representation. Adding reconstruction error increased global OOF F1 from 0.9800 to 0.9829 and ROC-AUC from 0.9912 to 0.9925, while reducing benign FPR from 0.1311 to 0.1113. These differences are descriptive; no statistical significance test was performed.

4.2. Multiclass Attack Classification Results

The initial 12-class reference benchmark achieved accuracy = 0.7226, macro-F1 = 0.6905, and macro-AUC = 0.9561. After restoring MITM and Fingerprinting, the extended 14-class group-aware evaluation achieved global OOF accuracy = 0.6654, macro-F1 = 0.6175, and macro-AUC = 0.9549. The relatively high macro-AUC indicates preserved score-level separability, whereas the lower hard-label metrics reflect the greater difficulty of complete attack attribution. No dedicated multiclass probability-calibration or class-specific threshold optimization was applied; therefore, the macro-AUC–macro-F1 gap is interpreted as a difference between score-level separability and hard-label classification performance rather than as evidence of well-calibrated class probabilities. Because the class composition and evaluation protocols differ, the two settings are complementary rather than directly comparable.

Class-wise performance remains heterogeneous. DDoS_ICMP and DDoS_UDP are among the most reliably attributed classes, whereas Fingerprinting and MITM remain more difficult, with F1-scores of 0.5966 and 0.4737, respectively. The row-normalized confusion matrix for the extended 14-class evaluation is shown in Figure 4.

Figure 4. Row-normalized confusion matrix for the extended 14-class five-fold group-aware evaluation on ML-EdgeIIoT. The matrix is computed from global out-of-fold predictions, with each sample evaluated only in its held-out outer fold. Values are percentages within each true class.

MITM remains particularly difficult to attribute, consistent with conflicting Attack_type labels observed among some identical feature vectors.

To assess sensitivity to the downstream booster, CatBoost, XGBoost, and LightGBM were compared under the controlled protocol defined in Section 3.7. For binary detection, global OOF performance was very similar across classifiers: ROC-AUC = 0.9927, 0.9927, and 0.9929, and F1 = 0.9820, 0.9821, and 0.9818, respectively. LightGBM yielded the lowest benign FPR (0.1047). Differences were larger for 14-class attribution, where macro-F1 reached 0.6634, 0.6819, and 0.6946, with macro-AUC = 0.9584, 0.9586, and 0.9604, respectively. Thus, binary discrimination shows little numerical variation across boosters, whereas attack attribution is more sensitive to the downstream classifier. These results are descriptive and do not imply statistical superiority of any classifier.

Because this sensitivity analysis uses an equal-budget inner-validation selection procedure, its CatBoost values are not intended to replace the fixed-configuration results reported in Table 3 and Table 4.

Table 3. Binary detection performance of the main AE-CatBoost framework under the initial and extended evaluation protocols.

Protocol	ROC-AUC	AP	Precision	F1	Attack Recall	FNR	Benign FPR
Initial reference benchmark	0.9776	0.9960	—	—	—	—	—
Extended 5-fold group-aware OOF	0.9925	0.9981	0.9799	0.9829	0.9859	0.0141	0.1113

OOF: out-of-fold. Threshold-dependent metrics were not retained for the initial reference benchmark.

Table 4. Multiclass attack-attribution performance of the main AE-CatBoost framework under the initial and extended evaluation protocols.

Protocol	Classes	Accuracy	Macro-F1	Macro-AUC
Initial reference benchmark	12	0.7226	0.6905	0.9561
Extended group-aware OOF	14	0.6654	0.6175	0.9549

The controlled classifier-sensitivity results are summarized in Table 5.

Table 5. Controlled downstream-classifier sensitivity analysis under the five-fold group-aware protocol.

Task	Classifier	AUC *	F1 *	Additional Metrics
Binary	CatBoost	0.9927	0.9820	AP = 0.9984; recall = 0.9867; FPR = 0.1259
Binary	XGBoost	0.9927	0.9821	AP = 0.9984; recall = 0.9857; FPR = 0.1193
Binary	LightGBM	0.9929	0.9818	AP = 0.9984; recall = 0.9827; FPR = 0.1047
14-class	CatBoost	0.9584	0.6634	Accuracy = 0.6956
14-class	XGBoost	0.9586	0.6819	Accuracy = 0.7120
14-class	LightGBM	0.9604	0.6946	Accuracy = 0.7192

* AUC and F1 denote ROC-AUC and binary F1 for binary detection, and macro-AUC and macro-F1 for 14-class attribution. Values are global out-of-fold results from the separate classifier-sensitivity analysis.

4.3. End-to-End Cascade Results

The complete 15-label cascade was evaluated on the full ML-EdgeIIoT dataset using the same five-fold group-aware protocol. Global out-of-fold results reached an accuracy of 0.6939, a macro-F1 of 0.6273, and a Weighted-F1 of 0.6793. The binary stage achieved an attack recall of 0.9859 with a benign FPR of 0.1113, while conditional attribution accuracy reached 0.6679. Overall, 65.84% of all true attacks were both detected and correctly attributed. Of 133,499 true attacks, 1885 were missed at the binary stage and 43,714 were misclassified after detection, indicating that most remaining errors arise during fine-grained attribution. Fingerprinting and MITM remained particularly difficult, with final recalls of 0.4426 and 0.3114, respectively. The corresponding end-to-end cascade results are summarized in Table 6.

Table 6. End-to-end 15-label cascade performance on ML-EdgeIIoT.

Metric	Value
Accuracy	0.6939
Macro-F1	0.6273
Weighted-F1	0.6793
Attack Recall	0.9859
Benign FPR	0.1113
Conditional Attribution Accuracy	0.6679
Strict End-to-End Attack-Type Success	0.6584

Conditional attribution accuracy is computed over true attacks forwarded to the multiclass stage, whereas strict end-to-end success requires both correct attack detection and correct attack-type attribution.

4.4. External Cross-Benchmark Validation on WUSTL-IIoT-2021

The AE-CatBoost framework was retrained and evaluated on WUSTL-IIoT-2021 using its 41-feature space and the group-safe split defined in Section 3.1, without dataset-specific hyperparameter re-tuning. Binary detection achieved ROC-AUC = 0.999995, AP = 0.999934, and F1 = 0.9990. Four-class attribution reached macro-F1 = 0.9767, while the five-label cascade achieved macro-F1 = 0.9408 and strict end-to-end success = 0.9993. These results show strong performance on the evaluated WUSTL setting but should be interpreted in light of its high-class separability and limited support for some rare classes. The corresponding cross-benchmark validation results are summarized in Table 7.

Table 7. External cross-benchmark performance on WUSTL-IIoT-2021.

Task	Main Metrics
Binary detection	ROC-AUC = 0.999995; AP = 0.999934; F1 = 0.9990; FPR = 0.00012
4-class attack attribution	Accuracy = 0.9998; Macro-F1 = 0.9767; Macro-AUC = 0.99999
5-label end-to-end cascade	Accuracy = 0.9998; Macro-F1 = 0.9408; Conditional Attribution = 0.9998; Strict Success = 0.9993

4.5. Deployment-Oriented Computational Feasibility

Computational feasibility of the complete WUSTL-IIoT-2021 five-label cascade was evaluated on a CPU-only system with 8 physical cores, 16 logical cores, and 15.73 GB RAM. Median single-sample latency was 6.51 ms for true-benign and 9.35 ms for true-attack samples, with 95th-percentile latencies of 9.24 ms and 15.90 ms, respectively. Batched full-cascade inference reached a median throughput of 147,528 samples/s and an amortized time of 0.0068 ms/sample. Model loading increased process RSS by 22.20 MB, with an additional inference peak of 9.07 MB. These measurements describe offline tabular inference and exclude packet capture, feature extraction, and network I/O.

Model-storage size and training time were not measured, and no edge-device deployment was performed; these aspects remain outside the present computational evaluation. The corresponding deployment-oriented computational measurements are summarized in Table 8.

Table 8. Deployment-oriented computational measurements of the complete WUSTL-IIoT-2021 five-label cascade.

Metric	Result
CPU configuration	8 physical/16 logical cores
System RAM	15.73 GB
Median latency—true-benign	6.51 ms
95th-percentile latency—true-benign	9.24 ms
Median latency—true-attack	9.35 ms
95th-percentile latency—true-attack	15.90 ms
Full-cascade median throughput	147,528 samples/s
Batched amortized processing time	0.0068 ms/sample
Median full-test processing time	1.62 s
Model-loading RSS increase	22.20 MB
Additional inference peak RSS	9.07 MB

5. Discussion

This study evaluates a modular IDS based on task-specific autoencoder representation learning and downstream boosting. Separate autoencoders are trained on benign traffic for binary detection and malicious traffic for attack attribution.

The extended evaluation examines this design under group-aware splitting, all 14 attack classes, reconstruction-error ablation, end-to-end cascading, classifier sensitivity, external validation, and CPU-based computational analysis.

For ML-EdgeIIoT, the extended binary evaluation achieved ROC-AUC = 0.9925 and AP = 0.9981. The reconstruction-error ablation showed modest gains over latent-only features, increasing global OOF F1 from 0.9800 to 0.9829 and reducing the benign FPR from 0.1311 to 0.1113, although this remaining false-positive rate is still an operational limitation. The complete 14-class evaluation was more difficult, with macro-F1 = 0.6175 and macro-AUC = 0.9549; MITM and Fingerprinting remained among the hardest classes, consistent with conflicting labels observed among some identical feature vectors. The classifier-sensitivity analysis showed little variation in binary ROC-AUC across CatBoost, XGBoost, and LightGBM (0.9927–0.9929), but larger differences in 14-class macro-F1 (0.6634–0.6946), indicating greater sensitivity of attack attribution to the downstream booster.

The 15-label cascade achieved attack recall = 0.9859, conditional attribution accuracy = 0.6679, and strict end-to-end success = 0.6584, indicating that most residual errors occurred during attack attribution. On WUSTL-IIoT-2021, retraining without WUSTL-specific re-tuning yielded ROC-AUC = 0.999995 for binary detection, macro-F1 = 0.9767 for four-class attribution, and macro-F1 = 0.9408 with strict success = 0.9993 for the five-label cascade. These results reflect the evaluated WUSTL setting, which shows greater class separability and limited support for some rare classes, and should not be directly compared with ML-EdgeIIoT. CPU-only inference showed median latencies of 6.51 ms for true-benign and 9.35 ms for true-attack samples, with a batched throughput of 147,528 samples/s; these measurements exclude packet capture, feature extraction, and network I/O.

To contextualize the main ML-EdgeIIoT evaluation, Table 9 summarizes representative studies using Edge-IIoTset or closely related hybrid IDS settings. The WUSTL external validation, classifier-sensitivity analysis, and end-to-end cascade address complementary evaluation questions and are therefore discussed separately rather than treated as directly comparable benchmarks.

Table 9. Methodological positioning of the proposed framework against representative IDS studies.

Ref (Year)	Evaluation Setting	Reported Metric(s)	Selected Reported Result(s)	Comparability Notes
[3] Ismail et al. (2025)	Multi-dataset evaluation using TON_IoT, WUSTL-IIoT-2021, and Edge-IIoTset	Precision, recall, micro-F1, model size, training time	LGBM micro-F1 = 97.8% on TON_IoT	Lightweight supervised ML without task-specific AE representation learning.
[13] Ruiz-Villafranca et al. (2025), WFE-Tab	Edge-IIoTset-based IIoT-MEC evaluation using WFE-Tab	Accuracy, precision, recall, F1-score	F1-score = 99.81%	Weighted TabPFN ensemble; no task-specific AE representation learning.
[29] Ishtiaq et al. (2025), CST-AFNet	Multiclass Edge-IIoTset evaluation including benign traffic	Accuracy, macro-precision, macro-recall, macro-F1	Accuracy = 99.97%; macro-averaged precision, recall, and F1 above 99.3%	Deep CNN-BiGRU attention model; class configuration and evaluation protocol differ from the proposed group-aware setting.
[14] Alaghbari et al. (2023)	N-BaIoT and MQTTset; anomaly detection followed by attack classification	Accuracy, precision, recall, F1, execution time	AE feature reduction caused only a small (~0–2%) decrease in accuracy/F1.	Uses one normal-trained AE for both tasks; the proposed framework uses separate task-specific AEs.
[16] Hasan et al. (2025)	Edge-IIoTset; binary and multiclass classification	Accuracy, F1, inference time	DT: accuracy = 99.94%, F1 = 99.94%; Jetson Nano: 0.185 ms binary, 0.187 ms multiclass	Uses one cost-sensitive 6D AE, whereas the proposed framework uses separate 16D and 24D task-specific AEs.
[17] Shwaysh et al. (2026)	CICIDS2018; Information Gain + AE + boosting classifiers	ROC-AUC, accuracy, recall	ROC-AUC > 0.90; DDoS: accuracy = 99%, recall = 80%; botnet/brute-force recall = 37%/28%	Uses one AE pipeline with three boosters; the proposed framework uses separate task-specific AEs with controlled booster comparison.

Table 9 positions the proposed framework against representative IDS studies without implying direct numerical comparability across heterogeneous protocols. Among the AE-based studies considered, the main distinguishing design choice is the use of separate autoencoders trained on benign and malicious traffic for binary detection and attack attribution, respectively. The contribution therefore lies in this task-specific modular design and its evaluation under group-aware splitting, complete 14-class attribution, reconstruction-error ablation, classifier sensitivity, end-to-end cascading, external validation, and computational analysis, rather than in numerical superiority over prior work. The findings should be interpreted within several limitations. ML-EdgeIIoT is a processed Edge-IIoTset configuration and contains duplicated feature vectors, including some with conflicting attack labels, which may complicate fine-grained attribution. External validation was limited to WUSTL-IIoT-2021, where the observed strong class separability and limited support for some rare attacks restrict broader generalization claims. The computational evaluation covers offline tabular inference only and excludes packet capture, feature extraction, and network I/O; it therefore does not establish real-time deployment. Robustness to adversarial perturbations, noisy or missing features, concept drift, and previously unseen attack types was not evaluated and remains an important direction for future work.

Taken together, the results show strong binary discrimination but greater difficulty in fine-grained attack attribution. The 14-class and cascade evaluations highlight persistent challenges associated with rare classes and label ambiguity, while the binary FPR indicates that false-alarm reduction remains necessary. These findings support the framework as a modular IDS design while leaving room for further validation and operational refinement.

6. Conclusions and Future Work

This study developed a modular IIoT intrusion-detection framework based on task-specific autoencoder representation learning and CatBoost classification. Separate autoencoders are trained on benign traffic for binary detection and malicious traffic for attack attribution. The framework was evaluated through initial reference benchmarks and complementary group-aware, 14-class, cascade, classifier-sensitivity, external, ablation, and computational analyses.

The research questions can be answered as follows. For RQ1, the task-specific autoencoders reduced the 42-feature input to 16D and 24D representations that supported binary detection and attack attribution. For RQ2, the ablation analysis showed that adding reconstruction error to the 16D latent representation produced modest overall gains: global OOF F1 increased from 0.9800 to 0.9829, while the benign FPR decreased from 0.1311 to 0.1113. For RQ3, multiclass attack attribution remained challenging under class imbalance. The initial 12-class reference achieved macro-F1 = 0.6905 and macro-AUC = 0.9561, while the complementary 14-class group-aware evaluation achieved macro-F1 = 0.6175 and macro-AUC = 0.9549, indicating the greater difficulty of complete fine-grained attribution.

The complementary analyses provide further context. Binary performance varied little across CatBoost, XGBoost, and LightGBM, whereas 14-class attribution was more sensitive to the downstream classifier. The 15-label cascade achieved strict end-to-end attack-type success = 0.6584, while WUSTL-IIoT-2021 validation yielded five-label macro-F1 = 0.9408 and strict success = 0.9993; these external results should be interpreted in light of the greater class separability and limited support of some rare WUSTL classes. CPU measurements also demonstrated low-cost offline tabular inference, but do not establish real-time packet-stream deployment. Taken together, these findings support the framework as a transparent and extensible IDS design rather than as a universally optimal solution.

Future work should extend validation to additional IoT/IIoT datasets and investigate strategies for reducing false alarms and improving rare-class attribution. Live packet-stream evaluation should include packet capture, feature extraction, and network I/O to assess operational latency beyond offline tabular inference. Further work should examine adversarial robustness and integrate explainable AI methods such as SHAP or LIME to support feature- and sample-level interpretation.

A complementary direction will specifically assess the framework under zero-day conditions using open-set and leave-one-attack-type-out protocols, with explicit evaluation of unknown-attack detection and rejection.