Edge-Optimized Deep and Transfer Learning for Efficient DDoS Detection in IIoT Networks

Abstract

The increasing convergence of Operational Technology (OT) and Information Technology (IT) within the Industrial Internet of Things (IIoT) brings about remarkable improvements in monitoring and automation. However, it also exposes industrial systems to large-scale Distributed Denial of Service (DDoS) attacks. Edge-based defences are essential in satisfying low-latency demands and data sovereignty rules, yet they must function under severe resource limitations and adapt to shifting traffic characteristics without cloud assistance. In this work, we introduce a lightweight hybrid deep learning architecture that fuses a Convolutional Neural Network (CNN) with a Convolutional Block Attention Module (CBAM) and a Multi-Layer Perceptron (MLP) in a single detector. A sequential transfer learning scheme is adopted, including a feature projection layer that handles differences in input dimensionality. The model is pre-trained on the CIC-DDoS2019 dataset, then adapted to the more recent CICIoT23 dataset. Evaluations are performed on both datasets while preserving their natural class imbalance. We provide extensive ablation and variance analysis under identical experimental conditions. The proposed method achieves 99.52% accuracy on CICIoT23 while maintaining 99.65% recall, which is a crucial property for critical systems. Real-time measurements on a CPU-only testbed show an average inference latency of 0.013 ms, inference-only throughput exceeding 93,000 packets/s, and end-to-end batch throughput of approximately 38,000 packets/s. The solution demonstrates effective domain adaptation, sub-millisecond latency, and suitability for resource-constrained IIoT edge gateways.

1. Introduction

The Industrial Internet of Things (IIoT) embodies the fusion of Operational Technology (OT) and Information Technology (IT) by bringing about unprecedented capabilities for monitoring, predictive maintenance, and process optimization in industrial environments, including health care, transport, logistics, oil refinery systems and power grids. However, this integration also broadens the attack surface because formerly isolated industrial networks become accessible through IP-based connectivity [1], which makes them attractive targets for cyber attacks, including large-scale Distributed Denial of Service (DDoS) attacks [2]. Protecting IIoT systems at the edge is imperative for at least two main reasons. First, industrial control loops demand response times in the millisecond range, which is generally considered to be a real-time response, a requirement that cannot be met by cloud-based analysis due to unavoidable network delays. Second, data sovereignty regulations frequently forbid the transfer of sensitive operational data to external cloud infrastructure. Consequently, intrusion detection must be performed directly on edge gateways, i.e., on devices with limited CPU power, modest memory, and no hardware acceleration [2]. Traditional signature-based intrusion detection systems are ineffective against previously unseen attack variants, while anomaly-based methods tend to generate excessive false alarms in dynamic industrial settings, which renders them ineffective [1,3]. Deep learning models have proven highly effective for network intrusion detection, but their computational demands often exceed the capabilities of edge hardware. Moreover, a model trained on existing datasets, such as the CIC-DDoS2019 [4] and CICIoT23 [5] datasets, may generalise well to newer traffic-pattern phenomena, which addresses the issue of domain shift [6].

To position the present work precisely with respect to the state of the art, we emphasise that its novelty does not lie in any individual building block, since CNNs, attention modules, and transfer learning are individually well established, but in the joint co-design of these building blocks under explicit edge-resource and feature-heterogeneity constraints that, to the best of our knowledge, no existing DDoS detection framework satisfies simultaneously. Existing deep transfer learning detectors either require the source and target domains to share a common feature space or circumvent feature mismatch by converting traffic records into images and fine-tuning large vision backbones such as VGG19 or ResNet [7,8,9], which inflates the inference cost to the 5–30 ms range and frequently necessitates GPU or SmartNIC acceleration [10,11]. In contrast, the proposed framework resolves feature-space heterogeneity natively in the tabular domain through a trainable, dataset-specific linear projection layer that is reinitialised per domain while the convolutional extractor is transferred and frozen. This design eliminates both image-conversion overhead and distribution-alignment machinery (e.g., MMD-based adaptation [10]) and yields a complete detector of approximately 67,500 parameters and 276,000 FLOPs per inference, executing in 0.013 ms on a CPU-only platform. The specific contributions of the authors are described as follows:

• A resource-aware unified architecture: We design UnifiedDetector, a single-pass detector that couples a compact, three-layer 1D CNN with a CBAM attention module, a global average-pooling stage, and a projected-feature skip connection feeding a lightweight MLP head. Unlike recurrent hybrids (CNN-LSTM/GRU) whose sequential dependencies dominate inference time, every component is feed-forward and parallelisable, bounding the cost at approximately 276,000 floating-point operations per inference and enabling CPU-only edge execution without hardware accelerators.
• Heterogeneous-feature sequential transfer learning: We introduce a trainable feature projection layer that maps source (78 features) and target (47 features) spaces onto a common 39-dimensional embedding, enabling sequential transfer of the frozen CNN extractor between datasets with incompatible dimensionalities, without traffic-to-image conversion and without cloud offloading. The projection dimension is justified empirically through a dedicated sensitivity sweep (Section 5.3.2), and the freeze depth is verified through ablation.
• Statistically validated, deployment-oriented evaluation: Beyond standard detection metrics (accuracy, precision, recall, F1, AUC, FPR, and TNR), we provide (i) component, projection-dimension, freeze-strategy, and transfer-direction ablations with re-implemented baselines under identical preprocessing, splits, and hardware; (ii) formal statistical significance testing of the proposed model against all baselines using paired tests across seeds with Holm–Bonferroni correction and effect sizes (Section 5.3.1); and (iii) real-time characterisation comprising average and 99th-percentile latency, inference-only and end-to-end throughput, and a Liu–Layland schedulability analysis—a combination that prior DTL-based DDoS studies do not report [7,8,10,12].

Experimental results show that the proposed approach attains 99.52% accuracy on CICIoT23, with an F1 score of 0.9975, precision of 99.86%, recall of 99.65%, FPR of 5.61%, TNR of 94.39%, average inference latency of 0.013 ms, inference-only throughput exceeding 93,000 packets/s, and end-to-end batch throughput of about 38,000 packets/s, which confirms its viability for resource-constrained IIoT edge gateways.

2. Related Work

Conventional DDoS detection can be broadly divided into signature-based and anomaly-based methods. Signature-based systems compare incoming traffic against a database of known attack patterns [13]. They are effective for recognised threats but fail against novel attacks. Anomaly-based systems learn a baseline of normal behaviour and flag deviations. While they can detect unknown attacks, they often suffer from high false-positive rates in complex industrial environments [14]. Deep learning has become a popular tool for network intrusion detection. Convolutional Neural Networks (CNNs) are used to extract spatial features from traffic representations, while Recurrent Neural Networks (RNNs) and Long Short-Term Memory (LSTM) networks capture temporal dependencies. Autoencoders offer an unsupervised approach by learning compact representations of normal traffic and measuring reconstruction errors. Nevertheless, these models are typically computationally intensive and designed for cloud deployment rather than edge execution [15,16]. Attention mechanisms help neural networks focus on the most informative parts of their input. The Convolutional Block Attention Module (CBAM) applies sequential channel and spatial attention to highlight salient features. In network security, attention can amplify bursty attack patterns that might otherwise be masked by background traffic [17,18].

Transfer learning addresses domain shift by reusing knowledge acquired from a source domain and adapting it to a target domain [19]. In cybersecurity, transfer learning has been employed to adjust intrusion detection models to new network environments and to alleviate the scarcity of labelled attack data [20]. However, most existing works do not consider the additional constraints imposed by edge deployment. Recent research has explored lightweight model design for edge deployment through techniques such as pruning, quantisation, and knowledge distillation [17,21], yet few studies provide rigorous real-time validation that includes latency measurements and schedulability analysis. The Liu–Layland model offers theoretical bounds for fixed-priority scheduling in real-time systems, enabling verification that detection tasks can meet their deadlines [22].

The evolution of security architectures for IIoT has shifted from static, centralized paradigms toward autonomous, decentralized frameworks capable of addressing the dynamic nature of modern cyber–physical threats [23]. Recent research increasingly leverages the intersection of Software-Defined Networking (SDN), Deep Reinforcement Learning (DRL), and Federated Learning (FL) to provide adaptive defences at the network periphery [15]. However, the deployment of these sophisticated models is often hindered by the inherent resource constraints of edge gateways and the stringent requirement for sub-millisecond response times in critical industrial control loops. This section provides a critical analysis of seminal contributions in the field, following a structured sequence to identify the specific research gaps that the proposed lightweight hybrid approach aims to address [24].

Farzaneh et al. proposed DTL-5G, a deep transfer learning framework for DDoS detection in 5G-and-beyond networksthat pretrains BiLSTM, CNN, ResNet, and Inception models on a large source dataset from a 5G testbed, then fine-tunes them on the sparse 5G-NIDD target dataset. The study shows that transfer learning improves detection over non-TL baselines, with BiLSTM achieving the strongest gains in accuracy, recall, and F1 score, while Inception achieves the best precision. However, the authors note that the effectiveness of DTL is highly context-dependent when source and target distributions differ and that deciding how many layers to freeze or add increases computational cost. This points to a need for lighter and more adaptive transfer learning strategies that generalize better across heterogeneous 5G and B5G scenarios [12].

He et al. proposed a deep transfer learning method for small-sample DDoS attack detection that transfers knowledge from a source domain with sufficient SYN-type attack samples to a target domain with limited LDAP-type samples, using a transferability metric to select the best neural network before fine-tuning it on the target data. The study shows that deep transfer learning can substantially reduce the performance drop caused by scarce labelled attacks, with the selected 8LANN model improving target-domain detection performance by about 20.8% after transfer and fine-tuning. Its main limitation is that the evaluation is restricted to a single source-target pair and a tenfold reduction in target samples, so broader generalization across other attack families is not demonstrated [25].

Anley et al. proposed an adaptive transfer learning framework for DDoS detection that preprocesses network traffic into images and fine-tunes custom CNNs, including Conv4, Conv8, Conv18, alongside pretrained VGG16, VGG19, and ResNet50, across multiple cybersecurity benchmark datasets. The study reports strong transfer performance, with transferred models outperforming single-domain training and VGG19 and Conv18 reaching very high accuracy on binary and multi-class tasks. Its main limitation is sensitivity to source-target mismatch, since transfers from smaller or less complex datasets to larger, more complex ones can reduce accuracy [7].

Expanding upon sequential networks, Anaga et al. proposed a systematic comparison of hybrid deep learning architectures (CNN, CNN-GRU, and CNN-LSTM) specifically optimised for Software-Defined Networks (SDNs). Their proposed CNN-LSTM hybrid achieved an excellent 99.73% accuracy on the CICDDoS2019 dataset and 99.95% on the InSDN dataset. However, comprehensive computational analysis exposed an underlying bottleneck, with the sequential processing of recurrent layers resulting in a lengthy 70.49 ms average prediction time per sample [11].

To bypass the intensive data requirements of these sequential variants, deep transfer learning (DTL) paradigms have recently been explored [26]. Feng and Chen designed an adaptive transfer learning framework leveraging Maximum Mean Discrepancy (MMD) feature alignment coupled with an attention mechanism to locate anomalous traits. While their structural approach successfully mitigated target data scarcity, it introduced a significant 29.00 ms propagation delay within university network security infrastructure [10].

To circumvent these latency hurdles, Shen et al. combined Fast Fourier Transform (FFT) with a fine-tuned VGG19 framework to capture complex DDoS characteristics. High-dimensional traffic vectors from the CICDDoS2019 dataset were transformed into image arrays, resulting in an accuracy of 99.11%. A primary constraint of this approach is its heavy dependency on GPU-accelerated parallel computing techniques; without serial bypass acceleration, the framework still incurs an average inference latency of 18.30 ms per sample [8].

Similarly, Bakar et al. utilised transfer learning to map a pre-trained ResNet-18 model to line-rate traffic analysis within an intrusion prevention framework. To protect resource-constrained edge CPUs from severe processing spikes that climbed to 92.6%, the authors offloaded the convolutional calculations to specialised enterprise SmartNIC Data Processing Units (DPUs). While achieving a 99.45% classification yield on CICDDoS2019, the architecture still demanded a 5.50 ms inference window despite hardware acceleration [9].

Liu et al. proposed a DRL-based Multi-layer IoT-DDoS Defense System (DRL-MLDS) that is distinguished by its adherence to IEEE P2668-compliant [27] reward metrics. The methodology utilises a novel Time Window-based Traffic-Capturing and Feature-Extraction (TW-TCFE) process to avoid long-term deadlocks and a Power Law-Based Blocking Time Mechanism (PL-BTM) to refine the handling of malicious samples. Experimental evaluations demonstrate a defence accuracy of approximately 97% against multi-layer IoT-DDoS attacks, significantly improving the Industrial Applicability Index (ADex) from 3.2 to 4.4. While the framework provides a robust standardized approach, its primary weakness lies in the inherent processing overhead of the multi-layer capture phase, which may introduce micro-latencies unsuitable for hard real-time industrial applications [24].

Kheddar et al. provided a comprehensive systematic review of DRL applications in network intrusion detection, focusing on the unique requirements of IoT, IIoT, and Industrial Control Systems (ICS). The authors established a meticulous taxonomy that categorizes algorithms such as DQN, DDQN, and PPO based on their ability to handle non-stationary and partially observable environments. The review highlights that while confusion-matrix metrics remain the evaluation standard, the field lacks a unified benchmark for hardware-specific performance on resource-constrained devices. A significant research gap identified by the authors is the lack of “online” adaptation strategies that can operate effectively without the high computational costs of offline retraining, identifying this as a primary hurdle for edge deployment [28].

Guo et al. introduced the DRL-based QoS-Aware Secure Routing (DQSP) protocol designed specifically for SDN-IoT architectures. The methodology utilizes an RL agent to learn network flow patterns and dynamically optimize routing policies to bypass malicious nodes involved in grey-hole and DDoS attacks. Simulation results on a 200-node topology indicate that DQSP achieves a relative performance gain of at least 10% over traditional protocols like OSPF in terms of end-to-end delay and the packet delivery ratio. Despite its efficacy in path optimization, the study primarily addresses high-rate DDoS threats. Its main weakness is the potential vulnerability to stealthy, low-rate attacks that do not trigger significant traffic disruptions or QoS alerts [29].

Zainudin et al. developed an efficient hybrid Deep Neural Network (DNN) for the classification of DDoS attacks within SDN-enabled IIoT networks. Their methodology integrates an extreme gradient boosting (XGBoost) feature selection unit with a hybrid CNN-LSTM architecture to reduce spatial and temporal feature dimensionality before classification. Evaluated on the CICDDoS2019 dataset, the system achieved high precision and accuracy across various attack vectors. The reported computational latency for real-time operations also remains acceptable for industrial applications, with sub-millisecond precision. However the model requires improvement for DNS attack detection [30].

Ferrag et al. detailed the creation of Edge-IIoTset, a comprehensive and realistic cybersecurity dataset generated from a seven-layer IIoT testbed. The dataset encompasses 14 categories of protocol-related attacks and offers 61 high-correlation features extracted from a total of 1176 attributes to facilitate the training of both centralized and federated learning models. A major strength of this work is the provision of a multi-layer evaluation environment that includes perception, network, and cloud components, reflecting real-world industrial heterogeneity. Nevertheless, as the paper focuses primarily on data generation and baseline algorithm testing, it does not propose a specific optimized hybrid architecture for minimizing the memory footprint on low-power edge gateways [31].

Zhang et al. introduced the RKD-VNE algorithm, which leverages resource knowledge description and DRL to improve virtual network embedding in IIoT scenarios. The approach utilizes a deep belief network-based cyberattack detection scheme to tune embedding parameters and improve system stability during network fluctuations. While the integration of resource knowledge significantly improves the efficiency of node mapping and security during virtualization, the framework’s primary objective is resource management rather than dedicated DDoS mitigation. This leaves a gap for specialized hybrid models that can perform intrusion detection simultaneously with the real-time resource scheduling tasks typical of IIoT edge devices [32].

Al-Zewairi et al. proposed the TON_IoT telemetry dataset, which integrates heterogeneous data sources from the perception, network, and OS layers of a large-scale IIoT network. Unlike traditional packet-only datasets, this work includes telemetry data from sensor readings, supporting multi-classification problems with ground-truth labels. The study demonstrates that data-driven methods can identify intruders with high accuracy using this diverse data. However, an identified weakness is that baseline models evaluated on TON_IoT often report high false-positive rates (FPRs) for subtle, low-rate data manipulation attacks, indicating a need for more sensitive temporal feature-capture mechanisms in hybrid model designs [33].

Abuhasel and Khan proposed a comprehensive security framework for resource management in smart manufacturing environments. The methodology establishes a secure manufacturing cycle by integrating AI-based threat detection with resource-efficient scheduling protocols. While the framework provides a strong theoretical foundation for industrial security and latency issues, its primary weakness is the lack of detailed experimental validation using high-dimensional DDoS datasets. This necessitates further research into specific hybrid deep learning models that can be embedded directly into this manufacturing framework to improve its real-time response capabilities against volumetric threats [34].

Nguyen et al. investigated the integration of Federated Deep Reinforcement Learning (FDRL) for traffic monitoring in SDN-based IoT networks. The “DeepMonitor” system uses a Double Deep Q-Network (DDQN) to optimize flow-rule match-field policies, allowing for detailed traffic analysis at the network periphery while preserving data privacy. The approach achieved a 22.83% improvement in detection accuracy by capitalizing on the diversity of local data. However, the model’s performance remains sensitive to non-IID data distributions across different industrial nodes, which can lead to model divergence and inconsistent security policies in heterogeneous environments [35].

Simpson et al. developed a per-host DDoS mitigation strategy using direct-control RL to manage network flow patterns at a granular level. The agent acts on a per-flow basis in a protocol-agnostic manner, allowing it to optimize performance criteria in non-stationary environments. A major strength is the granularity of control, which significantly advances RL-based prevention. Nevertheless, a critical weakness identified by the authors is the difficulty in safeguarding legitimate UDP traffic, which the agent frequently misclassifies as attack traffic during high-burst periods, which highlights a need for more robust traffic classification layers [36].

Nandanwar and Katarya introduced a DL model specifically for detecting and classifying multi-variant botnet attacks in IIoT environments. The methodology employs an adaptive CNN-GRU model to extract intricate spatial and temporal features from raw network data. The model achieved high accuracy rates of up to 99% on benchmark datasets by learning normal traffic patterns and identifying subtle deviations. Despite its superior precision, a significant weakness is the computational requirement of the GRU layers, which may exceed the memory and power budgets of resource-constrained industrial edge gateways in real-world deployments [37].

Janabi et al. provided a critical survey of intrusion detection systems in SDN environments, mapping specific attack vectors such as flow-table overflow. The authors evaluated the transition from static, rule-based databases to intelligent machine learning agents, emphasising the potential of leveraging public datasets for model validation. While the survey offers a robust mapping of SDN-specific threats, it highlights a persistent weakness in current implementations: the computational bottlenecks associated with processing large traffic volumes. This underscores the research need for lightweight, hybrid models that can maintain high recall without overloading the controller or the edge gateways during volumetric DDoS events [38].

Table 1. Summary of reviewed approaches in DL, DRL, and transfer learning-based DDoS detection for IoT and IIoT environments.

Ref.	Year	Approach	Product/System	Achievement	Limitations	Dataset/Testbed
[12]	2024	DTL-5G	5G DDoS detection with deep transfer learning	DTL improves detection on 5G-NIDD; BiLSTM achieves the largest gains, while Inception achieves the best precision	Layer-freezing choices raise computational cost, and transfer can weaken when source and target distributions differ	6M-flow 5G source, 5G-NIDD target
[25]	2020	Deep transfer learning DDoS detector	Small-sample DDoS detection via SYN-to-LDAP transfer	About 20.8% detection gain after transfer and fine-tuning	Limited to one source–target pair and tenfold reduced target samples	SYN source, LDAP target
[7]	2024	Adaptive TL CNN DDoS detector	Robust DDoS attack detection with adaptive transfer learning	Strong transfer accuracy, with VGG19 best for binary classification and Conv18 strongest for multiclass tasks	Accuracy can drop when source and target datasets differ in size and complexity	KDDCup’99, UNSW-NB15, CSE-CIC-IDS2018, and CIC-DDoS2019
[24]	2023	DRL-MLDS (DRL + PL-BTM)	Multi-layer IoT-DDoS defence	∼97% defence accuracy and IEEE P2668-compliant metrics	Multi-layer capture latency for hard real-time loops	Multi-layer IoT traffic testbed
[28]	2025	DRL-based IDS Review	IoT/IIoT intrusion landscape	Technical taxonomy of DRL (DQN, DDQN, and PPO) efficacy	Absence of hardware-specific performance benchmarks	NSL-KDD, CICIDS, and AWID
[29]	2020	DQSP (CNN-based DRL)	QoS-aware SDN-IoT routing	>10% gain in delay/PDR over OSPF protocol	Targeted at high-rate DDoS; neglects stealthy threats	SDN-IoT (200 nodes)
[30]	2023	Hybrid DNN (CNN-LSTM)	SDN-IIoT DDoS detection	High precision via XGBoost feature weighting	Evaluation of DNS attacks requires improvement	CICDDoS2019 dataset
[31]	2022	Edge-IIoTset generation	Centralized/Federated IIoT security	61 high-correlation features across 14 attacks	Data volume requires aggressive reduction for edge deployment	Edge-IIoTset (7-layer IIoT testbed)
[32]	2022	RKD-VNE (DRL-assisted)	IIoT Virtual Network Embedding	Improved mapping stability and cyberattack detection	Focuses on virtualization rather than DDoS mitigation	Resource knowledge description
[33]	2023	Data-driven IDS	TON_IoT telemetry dataset	Holistic view with OS logs and sensor telemetry	High false positives for data manipulation attacks	Large-scale IIoT network
[34]	2020	Secure IIoT Framework	Smart manufacturing management	Integrated AI threat detection for resource cycles	Lacks validation on recent high-dimensional DDoS data	Smart manufacturing testbed
[35]	2021	DeepMonitor (FDRL)	SDN-IoT traffic monitoring	$+22.83\%$ accuracy gain via DDQN optimization	Performance sensitivity to non-IID data distributions	SDN-based IoT network
[36]	2020	Direct-control RL	Per-host DDoS mitigation	Granular per-flow mitigation in non-stationary environments	Misclassification of legitimate high-burst UDP traffic	HTTP and VoIP traffic
[37]	2024	AttackNet (CNN-GRU)	IIoT botnet detection	∼99% accuracy in multi-variant classification	GRU memory/power overhead for edge gateways	Bot-IoT and benchmarks
[4]	2024	SDN-IDS Survey	SDN intrusion detection	Detailed mapping of flow-table overflow vectors	Neglects low-power multi-hop IIoT requirements	KDD’99, NSL-KDD, and CICIDS
[10]	2026	MMD adaptive transfer learning	University network security	High anomaly detection via adaptive alignment	29.00 ms latency; unsuitable for edge deployment	University network dataset
[8]	2026	FFT + DTL (VGG19)	Traffic-to-image transfer detection	99.11% accuracy on CICDDoS2019	18.30 ms latency; requires GPU acceleration	CICDDoS2019 dataset
[11]	2026	Hybrid CNN-LSTM SDN	Optimised hybrid SDN classification	99.73% on CICDDoS2019; 99.95% on InSDN	70.49 ms inference latency	CICDDoS2019 and InSDN datasets
[9]	2025	ResNet-18 DTL + DPU	Hardware-accelerated intrusion prevention	99.45% on CICDDoS2019; 95 Gbps mitigation	5.50 ms latency; requires enterprise SmartNIC	CICDDoS2019 + SmartNIC DPU testbed

provides summary of related works discussed above.

Viewed collectively, the transfer learning literature for DDoS detection falls into three methodological families, each with a structural weakness when measured against IIoT edge constraints. The first family fine-tunes within a shared feature space [12,25]: it is computationally tractable but cannot, by construction, transfer knowledge between datasets whose feature dimensionalities differ, which is precisely the situation encountered when migrating from CIC-DDoS2019 (78 features) to CICIoT23 (47 features). The second family sidesteps feature heterogeneity by converting tabular flow records into images and fine-tuning large pre-trained vision backbones [7,8,9]: this resolves dimensional mismatch but imports millions of parameters designed for natural-image statistics, inflating inference latency to 5.50–18.30 ms and creating a dependency on GPU or DPU acceleration that typical IIoT gateways do not possess. The third family performs explicit distribution alignment, for example, through MMD-based adaptation [10]: it offers principled domain adaptation but adds an alignment computation whose 29.00 ms propagation delay exceeds the millisecond-scale deadlines of industrial control loops by more than an order of magnitude. A parallel deficiency cuts across all three families and the broader DL literature [11,30,37]: reported gains are almost never accompanied by statistical significance testing against baselines re-implemented under identical conditions, schedulability evidence, or end-to-end (rather than inference-only) throughput figures, which leaves the practical deployability of these methods unverified. The present work is designed to close these specific gaps: a trainable per-domain projection layer provides heterogeneous feature transfer natively in the tabular domain at negligible cost; the entire detector remains within the range of approximately 67,500 parameters and 276,000 FLOPs so that no accelerator is required, and the evaluation couples re-implemented baselines with paired significance tests, ablations, and real-time schedulability analysis.

In summary, the critical review above identifies four recurring gaps. First, accuracy gains from spatial–temporal and DTL models are routinely purchased with inference latencies (5.50–70.49 ms) that violate the millisecond-scale deadlines of industrial control loops [8,9,10,11]. Second, no surveyed transfer learning approach handles heterogeneous tabular feature spaces without resorting to image conversion or restrictive same-dimension assumptions [7,12,25]. Third, federated and DRL-based defences remain sensitive to non-IID data and lack hardware-specific benchmarks for constrained gateways [28,35]. Fourth, comparative claims throughout the literature rest on figures reported under heterogeneous datasets, hardware, and preprocessing, without re-implemented baselines or statistical significance testing. These gaps jointly motivate the present design: a lightweight hybrid detector with native heterogeneous feature transfer evaluated against baselines re-implemented under identical conditions, along with formal significance testing and real-time schedulability evidence.

3. Proposed Method

This section presents the proposed lightweight deep and transfer learning framework designed for real-time detection of DDoS attacks in IIoT edge gateways. The method integrates a hybrid neural architecture with a transfer learning strategy to achieve high detection accuracy while maintaining low computational overhead, which makes it suitable for resource-constrained edge environments. The design emphasises efficient feature utilisation, lightweight model complexity, and fast inference to ensure compatibility with the strict latency requirements of industrial networks.

3.1. System Overview

The proposed system resides on IIoT edge gateways and processes incoming network traffic in real time. Figure 1 depicts the overall architecture of the detection pipeline. Network packets captured at the gateway are first converted into statistical flow-based features. Feature importance analysis using SHAP is employed during the development stage to identify the most informative traffic attributes and guide the feature selection process [39]. This step helps reduce redundancy and improve  the interpretability of the model while maintaining strong discriminative capability.

The extracted features are subsequently normalised using RobustScaler to mitigate the influence of outliers and scale variations commonly observed in network traffic datasets [40]. Robust scaling is particularly suitable for cybersecurity data because traffic features often contain extreme values caused by attack bursts or abnormal network behaviour. After normalisation, the processed feature vectors are forwarded to the unified detector architecture, which performs the final classification. The detector outputs a decision indicating whether the observed traffic corresponds to benign activity or a potential DDoS attack. The lightweight design of the model enables inference with sub-millisecond latency, which makes it suitable for deployment on resource-constrained edge gateways [22].

To enhance generalisation across heterogeneous traffic environments, a transfer learning strategy is incorporated into the training process. Instead of training the model entirely from scratch for each dataset, the framework leverages knowledge learned from a source domain and adapts it to a target domain [20]. The transfer learning pipeline therefore consists of three sequential phases:

• Pre-training of the unified detector on the CIC-DDoS2019 dataset to learn general network traffic representations;
• Selective transfer of the CNN feature extractor to preserve previously learned traffic patterns;
• Fine-tuning of the remaining layers using the CICIoT23 dataset to adapt the model to the target domain.

This strategy enables the model to reuse previously learned feature representations while adjusting the decision boundaries to new traffic characteristics, thereby improving detection performance and reducing training time when adapting to new IIoT environments.

Figure 2 illustrates the architecture of the proposed UnifiedDetector model used for real-time DDoS detection. The input feature vector ($\mathbf{x}$) is first passed through a projection layer that maps the original feature dimension (F) into a compact representation of 39 features. This projection step standardises the input dimensionality and improves computational efficiency. The projected features are then reshaped into a tensor of size $(B,1,39)$, enabling convolutional processing. A lightweight convolutional neural network composed of three convolutional layers is subsequently applied to extract hierarchical traffic patterns. To enhance the model’s ability to focus on the most informative feature channels and spatial regions, a Convolutional Block Attention Module (CBAM) is integrated within the CNN block [17]. The resulting feature maps are compressed using a Global Average Pooling (GAP) layer, producing a 128-dimensional feature representation. In parallel, the projected features are routed through a skip connection and concatenated with the pooled CNN features, preserving important low-level information that may otherwise be lost during convolutional processing [41]. The combined feature vector is then passed to a lightweight multilayer perceptron (MLP) classifier, which maps the 167-dimensional representation to a single output neuron. See Figure 3. Finally, a sigmoid activation function produces the probability of the input traffic belonging to the DDoS attack class, enabling binary classification suitable for real-time edge deployment.

3.2. Unified Detector Architecture

The proposed UnifiedDetector consists of three main components: (i) a feature projection layer, (ii) a CNN-based feature extractor enhanced with CBAM attention, and (iii) a multilayer perceptron (MLP) classifier.

3.2.1. Feature Projection Layer

Because different datasets may contain different numbers of input features, the raw feature vector is first projected to a fixed dimensionality of 39 using a linear transformation:

$$z=Wx+b$$

(1)

where $x\in R^F$ denotes the input feature vector, $W\in R^{39\times F}$ is the learnable weight matrix, and $z\in R^{39}$ represents the projected embedding. Dimension 39 was confirmed empirically via a sensitivity analysis sweeping values from 16 to 128 (Section 5.3.2). The value of $d=39$ achieves the highest F1 score ($0.9905\pm 0.0008$) and lowest FPR ($0.0064\pm 0.0162$) among all tested values, with performance degrading consistently both above and below 39, justifying this design choice.

3.2.2. CNN Feature Extractor with CBAM

The projected features are then processed by convolutional layers designed to capture temporal patterns characteristic of DDoS attacks.

• Conv1D ($1\to 32$, kernel size = 5, padding = 2), BatchNorm, ReLU, MaxPool1d (2);
• Conv1D ($32\to 64$, kernel size = 3, padding = 1), BatchNorm, ReLU, MaxPool1d (2);
• Conv1D ($64\to 128$, kernel size = 3, padding = 1), BatchNorm, ReLU;
• CBAM attention module (channel attention followed by spatial attention);
• Global average pooling, producing a 128-dimensional feature vector.

The CBAM module refines the extracted features in two stages. First, channel attention identifies the most informative feature channels:

$$M_c\left(F\right)=\sigma \left(\mathrm{MLP}\left(\mathrm{AvgPool}\right(F\left)\right)+\mathrm{MLP}\left(\mathrm{MaxPool}\right(F\left)\right)\right)$$

(2)

Next, spatial attention highlights important locations within the feature sequence:

$$M_s\left(F\right)=\sigma \left(f^{7\times 7}\left(\left[\mathrm{AvgPool}\right(F);\mathrm{MaxPool}(F\left)\right]\right)\right)$$

(3)

3.2.3. MLP Classifier

The 128-dimensional CNN output is concatenated with the 39-dimensional projected feature vector, producing a 167-dimensional representation passed to a multilayer perceptron.

For pre-training on CIC-DDoS2019:

$$167\to 256\to 128\to 64\to 1$$

(4)

For fine-tuning on CICIoT23:

$$167\to 128\to \mathrm{Dropout}\left(0.3\right)\to 64\to \mathrm{Dropout}\left(0.3\right)\to 32\to 1$$

(5)

The final output logit is converted to a probability using the sigmoid function:

$$p=\sigma \left(z\right)={\displaystyle \frac{1}{1+e^{-z}}}$$

(6)

3.3. Transfer Learning Strategy

To enable knowledge transfer between datasets with different numbers of input features, we introduce a trainable projection layer that maps the original feature vector to a fixed 39-dimensional embedding. As illustrated in Figure 4, the source dataset, which is CIC-DDoS2019, with 78 features, and the target dataset, which is CICIoT23, with 47 features, each has its own projection layer, which is reinitialised during fine-tuning. Only the CNN extractor’s weights are transferred and frozen, while the projection and MLP layers are adapted to the target domain. This design allows the model to reuse generic traffic patterns learned from the source while accommodating different feature spaces. Algorithm 1 details the complete sequential transfer learning procedure.

Algorithm 1 Sequential Transfer Learning for DDoS Detection

Require: Source dataset ${\mathcal{D}}_s$ (CIC-DDoS2019), target dataset ${\mathcal{D}}_t$ (CICIoT23) Ensure: Fine-tuned model ${\mathcal{M}}_{\mathrm{final}}$ for the target domain   1: procedure PreTraining(${\mathcal{D}}_s$)   2:     Initialise a UnifiedDetector with the source architecture ${\mathcal{M}}_s$   3:     Set $\mathrm{best}\_\mathrm{acc}\leftarrow 0$, $\mathrm{patience}\_\mathrm{counter}\leftarrow 0$   4:     for epoch $=1$ to $\max \_\mathrm{epochs}$ do   5:         Train ${\mathcal{M}}_s$ on ${\mathcal{D}}_s$ using Adam (lr ${10}^{-4}$) with BCEWithLogitsLoss   6:         Compute validation accuracy ${\mathrm{acc}}_{\mathrm{val}}$ on a held-out split   7:         if ${\mathrm{acc}}_{\mathrm{val}}>\mathrm{best}\_\mathrm{acc}$ then   8:            $\mathrm{best}\_\mathrm{acc}\leftarrow {\mathrm{acc}}_{\mathrm{val}}$; save ${\mathcal{M}}_{\mathrm{pretrained}}$; $\mathrm{patience}\_\mathrm{counter}\leftarrow 0$   9:         else 10:            $\mathrm{patience}\_\mathrm{counter}\leftarrow \mathrm{patience}\_\mathrm{counter}+1$ 11:            if $\mathrm{patience}\_\mathrm{counter}\ge 7$ then 12:                break 13:            end if 14:         end if 15:     end for 16:     return ${\mathcal{M}}_{\mathrm{pretrained}}$ 17: end procedure 18: procedure FineTuning(${\mathcal{D}}_t$, ${\mathcal{M}}_{\mathrm{pretrained}}$) 19:     Initialise a new UnifiedDetector with the target architecture ${\mathcal{M}}_t$ 20:     Copy the CNN extractor weights from ${\mathcal{M}}_{\mathrm{pretrained}}$ to ${\mathcal{M}}_t$ 21:     Freeze the first six layers of the CNN extractor 22:     Randomly initialise the projection and MLP layers of ${\mathcal{M}}_t$ 23:     Set $\mathrm{best}\_\mathrm{acc}\leftarrow 0$, $\mathrm{patience}\_\mathrm{counter}\leftarrow 0$ 24:     for epoch $=1$ to $\max \_\mathrm{epochs}$ do 25:         Fine-tune ${\mathcal{M}}_t$ on ${\mathcal{D}}_t$ using Adam (lr $3\times {10}^{-4}$) with BCEWithLogitsLoss 26:         Compute validation accuracy ${\mathrm{acc}}_{\mathrm{val}}$ 27:         if ${\mathrm{acc}}_{\mathrm{val}}>\mathrm{best}\_\mathrm{acc}$ then 28:            $\mathrm{best}\_\mathrm{acc}\leftarrow {\mathrm{acc}}_{\mathrm{val}}$; save ${\mathcal{M}}_{\mathrm{final}}$; $\mathrm{patience}\_\mathrm{counter}\leftarrow 0$ 29:         else 30:            $\mathrm{patience}\_\mathrm{counter}\leftarrow \mathrm{patience}\_\mathrm{counter}+1$ 31:            if $\mathrm{patience}\_\mathrm{counter}\ge 7$ then 32:                break 33:            end if 34:         end if 35:     end for 36:     return ${\mathcal{M}}_{\mathrm{final}}$ 37: end procedure 38: ${\mathcal{M}}_{\mathrm{pretrained}}\leftarrow$ PreTraining(${\mathcal{D}}_s$) 39: ${\mathcal{M}}_{\mathrm{final}}\leftarrow$FineTuning(${\mathcal{D}}_t$, ${\mathcal{M}}_{\mathrm{pretrained}}$) 40: return ${\mathcal{M}}_{\mathrm{final}}$

Algorithm 1 details the sequential transfer learning procedure. Only the CNN feature extractor’s weights are transferred. The projection layer is reinitialised because input dimensions differ between datasets, and the MLP classifier is reinitialised to adapt to the target domain’s decision boundary.

4. Experimental Setup

This section describes the datasets, preprocessing procedures, training configuration, baseline implementations, and evaluation metrics used to assess the proposed UnifiedDetector model. The goal is to ensure reproducibility and to evaluate the system under realistic industrial IoT traffic conditions.

4.1. Datasets

Two cybersecurity datasets were used to evaluate the proposed model: CIC-DDoS2019 and CICIoT2023.

CIC-DDoS2019 dataset: The CIC-DDoS2019 dataset contains modern reflection and amplification attacks captured in 16 PCAP files, covering DNS, LDAP, MSSQL, NetBIOS, NTP, SNMP, and UDP amplification attacks. After loading, we obtained 431,371 samples, each with 78 numerical features. The natural attack ratio is 77.32%. Evaluations on the test set which performed with our final model yield a true-positive (TP) count of 49,759, true-negative (TN) count of 13,175, false-positive (FP) count of 1500, and false-negative (FN) of 272, corresponding to 97.26% accuracy, 97.07% precision, 99.46% recall, a 98.25% F1 score, 10.22% FPR, and 89.78% TNR. The natural class imbalance was preserved to better reflect real-world traffic distributions [4].

CICIoT2023 dataset: The more recent CICIoT2023 dataset focuses specifically on IoT-oriented attack traffic. It comes pre-split into training, validation, and test sample sets, totalling 7,845,673 samples with 47 numerical features. The attack ratio is 97.65%. Evaluations on the test set yield TP = 1,145,068, TN = 26,155, FP = 1554, and FN = 4074, corresponding to 99.52% accuracy, 99.86% precision, 99.65% recall, a 99.75% F1 score, 5.61% FPR, and 94.39% TNR. The smaller size of the feature set compared to CIC-DDoS2019 motivated the use of the feature projection layer in the transfer learning architecture [5].

4.2. Data Preprocessing

Prior to training, both datasets underwent identical preprocessing steps to ensure consistency between the pre-training and transfer learning stages. These steps were designed to clean the data, normalise feature distributions, and identify the most informative variables. The preprocessing pipeline consisted of several stages. Missing or infinite values were replaced with zero. Labels were converted to binary format: 0 for benign traffic and 1 for attack traffic. Feature normalisation was performed using RobustScaler, which relies on the median and interquartile range (IQR) to reduce the influence of outliers [40]. Feature selection was guided by SHAP analysis to identify the most influential features for the classification task [39].

4.3. Training Configuration

Model training was performed using a consistent configuration to ensure fair evaluation across datasets. The following hyperparameters were used during both the pre-training and fine-tuning stages.

• Loss function: Binary Cross-Entropy with Logits (BCEWithLogitsLoss);
• Optimiser: Adam;
• Learning rates: ${10}^{-4}$ for pre-training and $3\times {10}^{-4}$ for fine-tuning;
• Batch sizes: 256 for training and 512 for validation/testing;
• Early stopping patience: 7 epochs;
• Maximum epochs: 25 for pre-training and 20 for fine-tuning.

4.4. Baseline Models and Variance Analysis

To provide a fair comparison, we implemented several baselines under identical preprocessing setups, data splits, and hardware configurations. Each baseline was trained on a 20% stratified subset of the CICIoT23 training set (1,098,394 samples) to keep computation practical, while validation and test sets remained full (1,176,851 samples each). All baselines used the same early stopping (patience 7), learning rate ($3\times {10}^{-4}$), and batch sizes.

• MLP only: A multilayer perceptron with the same input dimension, architecture (128 → 64 → 32 → 1), and dropout (0.3);
• CNN without CBAM: The same architecture as UnifiedDetector but with the CBAM module removed;
• Training from scratch: UnifiedDetector trained on CICIoT23 without any pre-training;
• Full fine-tuning:Pre-trained weights are loaded, but all layers are unfrozen and trained on the target dataset.

To assess stability, we repeated the proposed selective transfer learning three times with different random seeds (42, 123, and 101,112). The seeds produced consistent results. We report the means and 95% confidence intervals of test F1 score for the three seeds. In addition, the per-seed test F1 scores of the proposed model are compared against each baseline using paired two-tailed t-tests, with Holm–Bonferroni correction for multiple comparisons and Cohen’s $d_z$ effect sizes; the full procedure and results are presented in Section 5.3.1.

4.5. Detection Metrics and Real-Time Performance

The following standard classification metrics were computed:

• Accuracy: ${\displaystyle \frac{TP+TN}{TP+TN+FP+FN}}$;
• Precision: ${\displaystyle \frac{TP}{TP+FP}}$;
• Recall: ${\displaystyle \frac{TP}{TP+FN}}$;
• F1 score: $2\times ;{\displaystyle \frac{\mathrm{Precision}\times \mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}}$;
• AUC: Area Under the ROC curve;
• False-Positive Rate (FPR): ${\displaystyle \frac{FP}{FP+TN}}$;
• True-Negative Rate (TNR): ${\displaystyle \frac{TN}{TN+FP}}$.

Threshold Calibration: In industrial control environments, missing an attack may have severe operational consequences. Therefore, we calibrated the detection threshold to prioritise high recall. We set an attack recall target of 95% and selected a threshold that achieves at least this recall while maximising the F1 score on the validation set:

$${\tau }^{*}=arg\underset{\tau }{max}\{\mathrm{F}1\left(\tau \right)\mid \mathrm{Recall}\left(\tau \right)\ge 0.95\}$$

(7)

To stabilise probability outputs, temperature scaling with $T=30$ was applied before probability conversion:

$$p=\sigma \left({\displaystyle \frac{z}{T}}\right)$$

(8)

Real-Time Performance Metrics: Since the proposed system is intended for deployment on edge gateways, real-time inference performance was evaluated on CPU-only hardware. We distinguish two metrics: (1) inference-only latency, which is the time required for the neural network to complete a forward pass only; and (2) end-to-end batch throughput, which includes the total time including data loading, normalisation, and inference divided by the number of samples. The latter (≈38,000 packets/s) provides a more realistic lower bound for a complete detection pipeline. Packet capture, flow construction, and mitigation actions are not included in this study and would add additional latency.

Schedulability Analysis: To assess real-time feasibility, the detector was modelled as a periodic task with a period of $T=1$ ms, representing a typical packet inter-arrival time in industrial networks. The execution time (C) corresponds to the measured average inference latency. System utilisation is $U=C/T$. For a fixed-priority real-time system with n tasks, the Liu–Layland schedulability bound is expressed as follows [42]:

$$U_{\mathrm{bound}}=n(2^{1/n}-1)$$

(9)

With $n=2$ tasks (detector and background system tasks), $U_{\mathrm{bound}}\approx 0.828$. The system is schedulable when $U\le U_{\mathrm{bound}}$. We acknowledge that the Liu–Layland model assumes periodic tasks with fixed priorities and ignores interrupt overhead, queuing delays, OS scheduling jitter, and bursty traffic. In practice, these factors can increase effective utilisation. However, the measured utilisation of 0.013 is two orders of magnitude below the theoretical bound, leaving a large margin for overheads. Therefore, the detector remains schedulable under most realistic conditions, though a more detailed simulation with real-time OS models is recommended for production deployment.

5. Results

This section presents the experimental results obtained from the training and evaluation of the proposed model on the the CIC-DDoS2019 [4] and CICIoT23 [5] datasets. We first describe the pre-training process on the source dataset, followed by transfer learning and fine-tuning on the target dataset. Then, we present the ablation study, variance analysis, final test performance, and real-time characteristics.

5.1. Pre-Training on CIC-DDoS2019

Table 2. Pre-training progression on CIC-DDoS2019.

Epoch	Training Loss	Validation Accuracy (%)	Best Model
1	69.3784	95.2307	Saved
2	27.2047	96.4547	Saved
3	17.2459	95.0128	-
4	14.8275	91.2914	-
5	8.8822	95.4656	-
6	7.9988	96.7144	Saved
7	6.3079	94.7795	-
8	4.4269	94.3282	-
9	2.9816	93.8862	-
10	2.2365	95.8087	-
11	1.9430	96.9199	Saved
12	1.5481	92.7379	-
13	1.3358	94.6929	-
14	0.8768	97.3063	Saved
15	0.9037	93.9712	-

Training epochs. Best validation accuracy: 97.3063% at epoch 14.

shows the pre-training progress on CIC-DDoS2019. The best validation accuracy of 97.3063% was reached at epoch 14. Training stopped at epoch 21 after seven epochs without improvement. The learning rate on this dataset is not as desired, but because it is not the final dataset where the model is fine-tuned, its effect is insignificant.

5.2. Fine-Tuning on CICIoT23

After transfer, fine-tuning on CICIoT23 converged much faster (

Table 3. Fine-tuning progression on CICIoT23

Epoch	Training Loss	Validation Accuracy (%)	Best Model
1	0.1312	98.8399	Saved
2	0.0233	99.1689	Saved
3	0.0198	99.1792	Saved
4	0.0182	99.3052	Saved
5	0.0165	99.4707	Saved
6	0.0149	99.3117	-
7	0.0137	99.3761	-
8	0.0135	99.5039	Saved
9	0.0131	99.4761	-
10	0.0128	99.4890	-
11	0.0144	99.4895	-
12	0.0124	99.4970	-
13	0.0119	99.4834	-
14	0.0117	99.4392	-
15	0.0121	99.4819	-

Training stopped at epoch 15. Best validation accuracy: 99.5039% at epoch 8.

). The best validation accuracy of 99.5039% came at epoch 8. The learning rate also became stable during transfer.

5.3. Ablation Study and Variance Analysis

Table 4. Component ablation study on CICIoT23 (mean ± 95% CI over 3 seeds).

Variant	Acc	F1	FPR	FNR
MLP only	$0.9574\pm 0.0070$	$0.9778\pm 0.0038$	$0.0967\pm 0.0875$	$0.0413\pm 0.0093$
CNN without CBAM	$0.9562\pm 0.0042$	$0.9771\pm 0.0021$	$0.0730\pm 0.2131$	$0.0431\pm 0.0011$
No projection layer	$0.9577\pm 0.0438$	$0.9778\pm 0.0232$	$0.0331\pm 0.1399$	$0.0425\pm 0.0428$
No skip connection	$0.9844\pm 0.0030$	$0.9919\pm 0.0016$	$0.0378\pm 0.0988$	$0.0151\pm 0.0037$
Full model (proposed)	$0.9817\pm 0.0015$	$0.9905\pm 0.0008$	$0.0064\pm 0.0162$	$0.0186\pm 0.0019$

summarizes the mean F1 score, accuracy, FPR, and FNR with 95% confidence intervals over three seeds of all baselines on CICIoT23. The proposed full model achieves the highest F1 score ($0.9905\pm 0.0008$) and lowest FNR ($0.0186\pm 0.0019$), outperforming the MLP-only baseline (F1 $=0.9778\pm 0.0038$) and the CNN-without-CBAM variant (F1 $=0.9771\pm 0.0021$). The MLP and CNN-without-CBAM baselines lag behind, confirming the benefit of both the CBAM attention module and the projection layer. Removing the projection layer causes the largest increase in FNR ($0.0425\pm 0.0428$), indicating it is critical for stable cross-dataset generalisation.

The skip-connection row in Table 4 warrants explicit interpretatio, because the variant without the skip connection attains a nominally higher attack-class F1 ($0.9919\pm 0.0016$ vs. $0.9905\pm 0.0008$) and a lower FNR ($0.0151$ vs. $0.0186$), yet the skip connection is deliberately retained in the proposed design. Three observations from the per-seed results justify this choice. First, the apparent F1 advantage is marginal in absolute terms ($\Delta$F1 $=0.0014$) and does not survive correction for multiple comparisons in the significance analysis of Section 5.3.1 (Holm-adjusted $p=0.086$), whereas the benign-class effect described next is operationally substantial. Second, removing the skip connection degrades benign-traffic discrimination markedly: the mean FPR rises by almost six-fold, from $0.0064$ to $0.0378$, and becomes highly seed-dependent, with per-seed FPR values of $0.0074$, $0.0828$, and $0.0231$ without the skip versus $0.0014$, $0.0138$, and $0.0040$ with it. The confidence interval on FPR widens accordingly from $\pm 0.0162$ to $\pm 0.0988$. Because CICIoT23 is dominated by attack traffic (97.65%), the attack-class F1 is largely insensitive to benign-side errors, so this six-fold FPR deterioration is almost invisible in F1 yet directly governs the false-alarm burden that Section 6.2 identifies as the principal operational cost in industrial deployments. Third, the mechanism is architecturally interpretable. The convolutional path applies three pooled convolution stages followed by global average pooling, which aggregates activations across the feature axis; this compression preserves the bursty, high-magnitude patterns characteristic of volumetric attacks but discards the absolute scale and identity of individual flow statistics (e.g., packet-rate and byte-count magnitudes) on the basis of which benign traffic is most reliably distinguished. The skip connection restores this information by routing the 39-dimensional projected features directly to the classifier, so the MLP head decides on the concatenation of CBAM-refined convolutional abstractions and unpooled low-level features. Consistent with the general role of identity shortcuts in improving feature reuse and gradient propagation [41], this also shortens the gradient path to the projection layer during fine-tuning, which explains the visibly tighter seed-to-seed dispersion of the full model across all four reported metrics. In summary, the skip connection trades a statistically non-significant 0.0014 reduction in attack-class F1 for a six-fold reduction in mean FPR and a substantially more stable detector, a trade-off that is unambiguously favourable in the intended deployment context.

Variance analysis over three seeds (42, 123, 101,112) gave a mean test F1 of $0.9905\pm 0.0008$ for the proposed model, indicating excellent reproducibility. The low variance (std $<$ 0.001) confirms stable convergence across initialisations.

5.3.1. Statistical Significance Analysis

To formally verify that the observed differences between the proposed model and the ablation baselines are not artefacts of random initialisation, we conducted paired statistical tests on the per-seed test F1 scores. Because all variants were trained and evaluated under identical preprocessing setups, data splits, and hardware configurationswith the same three seeds (42, 123, and 101,112), the seed-level observations are naturally paired, and a paired two-tailed t-test ($df=2$) is the appropriate parametric procedure; non-parametric alternatives such as the Wilcoxon signed-rank test are uninformative at $n=3$, where the smallest attainable two-sided p-value is 0.25. To control the family-wise error rate across the four simultaneous comparisons, raw p-values are adjusted using the Holm–Bonferroni procedure, and we report Cohen’s $d_z$ on the paired differences as a standardised effect size.

Table 5. Paired two-tailed t-tests on per-seed test F1 (proposed full model vs. each ablation variant; $n=3$ paired seeds, $df=2$, $\alpha =0.05$, Holm–Bonferroni-corrected).

Comparison (Full Model vs.)	$\Delta$F1	t	Raw p	Holm-adj. p	Cohen’s ${\mathit{d}}_{\mathit{z}}$
CNN without CBAM	$+0.0134$	$26.63$	$0.0014$	$0.0056$	$15.38$
MLP only	$+0.0128$	$11.92$	$0.0070$	$0.0210$	$6.88$
No skip connection	$-0.0014$	$-4.67$	$0.0430$	$0.0860$	$-2.69$
No projection layer	$+0.0127$	$2.29$	$0.1494$	$0.1494$	$1.32$

summarises the results.

The proposed model is statistically significantly superior to the two capacity-reduced baselines after correction—versus the CNN-without-CBAM variant ($t\left(2\right)=26.63$, Holm-adjusted $p=0.0056$, $d_z=15.38$) and versus the MLP-only baseline ($t\left(2\right)=11.92$, Holm-adjusted $p=0.0210$, $d_z=6.88$)—with very large effect sizes in both cases. The nominal F1 advantage of the no-skip variant does not reach significance after correction ($\Delta$F1 $=-0.0014$, Holm-adjusted $p=0.0860$), supporting the interpretation in Section 5.3 that the skip connection can be retained for its six-fold FPR reduction without a statistically meaningful F1 penalty. The comparison against the no-projection variant is, likewise, not significant ($p=0.1494$) despite a mean F1 gap of $+0.0127$; this is attributable to the pronounced seed-to-seed instability of that variant (per-seed F1 values of 0.9710, 0.9740, and 0.9885), whose inflated variance dominates the paired statistic. The instability itself, an FNR confidence interval an order of magnitude wider than the full model’s ($\pm 0.0428$ vs. $\pm 0.0019$), is precisely the failure mode the projection layer is designed to remove, so the absence of mean-level significance should be read jointly with this variance evidence rather than as parity between the variants. We acknowledge that three seeds provide limited statistical power and that paired tests on additional seeds, together with prediction-level procedures such as McNemar’s test on the shared test set, would further strengthen these conclusions; the very large effect sizes observed for the CBAM and MLP comparisons nevertheless indicate that the reported architectural gains are robust to initialisation randomness rather than artefacts of a favourable seed.

5.3.2. Projection-Dimension Sensitivity

Table 6. Projection-dimension sensitivity on CICIoT23 (mean ± 95% CI over 3 seeds).

d	Params	F1	FPR	FNR
16	63,448	$0.9829\pm 0.0185$	$0.0316\pm 0.1302$	$0.0329\pm 0.0348$
24	64,856	$0.9850\pm 0.0183$	$0.0269\pm 0.1077$	$0.0289\pm 0.0330$
32	66,264	$0.9868\pm 0.0184$	$0.0102\pm 0.0229$	$0.0258\pm 0.0351$
39	67,496	$0.9905\pm 0.0008$	$0.0064\pm 0.0162$	$0.0186\pm 0.0019$
48	69,080	$0.9771\pm 0.0117$	$0.0290\pm 0.0637$	$0.0441\pm 0.0209$
64	71,896	$0.9776\pm 0.0032$	$0.0234\pm 0.0934$	$0.0432\pm 0.0068$
96	77,528	$0.9760\pm 0.0037$	$0.0463\pm 0.0981$	$0.0458\pm 0.0049$
128	83,160	$0.9779\pm 0.0053$	$0.0878\pm 0.0251$	$0.0412\pm 0.0107$

reports the effect of varying the projection dimension from 16 to 128. The proposed value of $d=39$ achieves the highest F1 ($0.9905\pm 0.0008$) and lowest mean FPR ($0.0064\pm 0.0162$) among all tested values. Performance degrades consistently for both smaller and larger dimensions, confirming that 39 represents an effective balance between representational capacity and model compactness.

5.3.3. CNN Freeze Strategy

Table 7. CNN freeze-strategy ablation on CICIoT23 (mean ± 95% CI over 3 seeds).

Strategy	Accuracy	F1	FPR	FNR
No transfer (scratch)	$0.9817\pm 0.0015$	$0.9905\pm 0.0008$	$0.0064\pm 0.0162$	$0.0186\pm 0.0019$
Full fine-tune (no freeze)	$0.9623\pm 0.0378$	$0.9803\pm 0.0201$	$0.0052\pm 0.0150$	$0.0385\pm 0.0385$
Freeze first 3 layers	$0.9662\pm 0.0337$	$0.9824\pm 0.0178$	$0.0021\pm 0.0055$	$0.0346\pm 0.0347$
Freeze first 6 (proposed)	$0.9650\pm 0.0359$	$0.9817\pm 0.0190$	$0.0032\pm 0.0067$	$0.0358\pm 0.0368$
Freeze all layers	$0.9568\pm 0.0017$	$0.9774\pm 0.0009$	$0.0004\pm 0.0007$	$0.0442\pm 0.0017$
Progressive unfreeze	$0.9687\pm 0.0441$	$0.9836\pm 0.0234$	$0.0010\pm 0.0015$	$0.0321\pm 0.0451$

compares six CNN layer-freezing strategies during fine-tuning. Full fine-tuning without any freezing degrades performance (F1 $=0.9803\pm 0.0201$) compared to the proposed freeze-first-6 strategy (F1 $=0.9817\pm 0.0190$), confirming that preserving the lower convolutional layers reduces overfitting during domain adaptation. Freezing all layers is the weakest strategy (F1 $=0.9774$), while progressive unfreezing (F1 $=0.9836$) performs comparably to the proposed approach with greater training complexity. Training from scratch on the 20% subsample achieves a similar F1 ($0.9905$), indicating that the transfer advantage is most pronounced when labelled target data are scarce; at full data scale, the proposed strategy achieves faster convergence (8 epochs vs. 25 epochs from scratch).

5.3.4. Transfer-Direction Analysis

Table 8. Transfer-direction analysis (mean ± 95% CI over 3 seeds).

Direction	Target	F1	FPR	FNR
CIC-DDoS2019 → CICIoT23 (proposed)	CICIoT23	$0.9823\pm 0.0178$	$0.0520\pm 0.1133$	$0.0335\pm 0.0319$
No transfer (scratch)	CICIoT23	$0.9860\pm 0.0187$	$0.0062\pm 0.0178$	$0.0275\pm 0.0359$
No transfer (scratch)	CIC-DDoS2019	$0.9682\pm 0.0081$	$0.0922\pm 0.0200$	$0.0362\pm 0.0106$

reports the F1, FPR, and FNR for the proposed CIC-DDoS2019 → CICIoT23 transfer direction against scratch baselines on both datasets. The proposed transfer does not degrade performance relative to scratch on CICIoT23 (F1 gap of 0.0037), while scratch training on CIC-DDoS2019 alone produces a notably lower F1 ($0.9682\pm 0.0081$), demonstrating that the source dataset alone is insufficient for the target task. The primary benefit of transfer learning in this setting is convergence speed (8 epochs with transfer vs. 25 epochs from scratch at full data scale) rather than final accuracy gain on the 20% subsample.

5.3.5. Class-Imbalance and Benign-Class Analysis

Given the high attack ratio in CICIoT23 (97.65%), we report per-class metrics separately at $\tau =0.50$. The attack class achieves Precision $=1.0000$, Recall $=0.9813$, and F1 $=0.9905$. The benign class achieves Precision $=0.5625$, Recall $=0.9986$, and F1 $=0.7196$. The low benign precision reflects the deliberate design choice to prioritise attack recall.

Table 9. Attack recall, benign recall, FPR, and F1 at selected detection thresholds on CICIoT23.

$\mathit{\tau }$	Attack Rec	Benign Rec	FPR	F1
0.1	0.9829	0.9916	0.0084	0.9913
0.3	0.9818	0.9976	0.0024	0.9908
0.5	0.9813	0.9986	0.0014	0.9905
0.7	0.9807	0.9994	0.0006	0.9903
0.9	0.9794	0.9996	0.0004	0.9896

shows how the attack recall and FPR trade off across detection thresholds. Operators requiring a lower FPR can raise $\tau$ at the cost of a small reduction in attack recall.

5.4. Test Results

Table 10. Test performance on CIC-DDoS2019 and CICIoT23; inference-only throughput and batch throughput shown separately.

Metric	CIC-DDoS2019	CICIoT23
Accuracy	97.2615%	99.5218%
Precision	0.9707	0.9986
Recall	0.9946	0.9965
F1 Score	0.9825	0.9975
AUC	0.9817	0.9990
True Positives (TP)	49,759	1,145,068
True Negatives (TNs)	13,175	26,155
False Positives (FPs)	1500	1554
False Negatives (FNs)	272	4074
False-Positive Rate (FPR)	10.22%	5.61%
False-Negative Rate (FNR)	0.54%	0.35%
Average Inference Latency	0.013 ms	0.013 ms
P99 Latency	0.020 ms	0.020 ms
Inference-only Throughput	88,617 packets/s	93,255 packets/s
End-to-end Batch Throughput	-	37,860 packets/s

Thresholds: $\tau =0.5006$ (CIC-DDoS2019) and $\tau =0.4985$ (CICIoT23). The batch throughput for CICIoT23 is calculated from the total evaluation time (31.07 s for 1,176,851 samples).

summarises the final test results for both datasets. The threshold was fixed at $\tau =0.5006$ for CIC-DDoS2019 and $\tau =0.4985$ for CICIoT23, calibrated using the temperature-scaled probabilities.

Both datasets exhibit very high recall, with only a few attacks missed. Accuracy is 97.26% on CIC-DDoS2019 and 99.52% on CICIoT23, and the F1 score reflects this strong performance as highlighted in Figure 5. Latency remains around 0.013 ms, and inference-only throughput exceeds 88,000 packets/s on the source dataset and 93,000 packets/s on the target. The end-to-end batch throughput, including data loading and preprocessing on the CICIoT23 test set, is approximately 37,860 packets/s, which still satisfies real-time requirements for many IIoT scenarios.

5.5. Confusion Matrices

Figure 6 shows the confusion matrices. FNs are very low in both cases, which is consistent with the high recall values.

5.6. Comparison of Performance Metrics

Figure 7 compares the four main metrics side by side.

5.7. Latency and Throughput Analysis

Latency and inference-only throughput are plotted in Figure 8. Both datasets stay well below the 1 ms threshold, with average latencies of 0.013 ms and P99 latencies of 0.020 ms.

Batch evaluation of the CICIoT23 test set, which contains 1,176,851 samples, required 31.07 s and approximately 265 MB of RAM. The corresponding end-to-end batch throughput is

$$\mathrm{Throughput}={\displaystyle \frac{\mathrm{1,176,851}}{31.07}}\approx \mathrm{37,860}\mathrm{packets}/\mathrm{s}.$$

For comparison, the inference-only throughput reported in Table 10 is ≈88,000–93,000 packets/s; the two figures differ because the latter excludes data loading and normalisation overhead.

The memory footprint is dominated by the Python runtime and dataset loader rather than the model itself, confirming that the detector remains lightweight and suitable for deployment on edge gateways.

5.8. Computational Complexity

The total FLOPs per inference are estimated as follows:

• CNN (without attention): $F\times C\times K=20\times 128\times 5=\mathrm{12,800}$ ops;
• CBAM attention: Approximately $2\times C\times K$ for channel attention and $2\times 7\times 7\times 1$ for spatial attention, totalling about 1200 extra FLOPs (negligible);
• MLP: $H^2\times M={256}^2\times 4=\mathrm{262,144}$ ops;
• Total: Approximately 276,000 FLOPs per inference.

Memory access is dominated by the MLP weights (∼262 k parameters × 4 bytes ≈ 1 MB). Actual runtime on the Intel Core i7 (Lenovo Legion laptop, Lenovo Group Ltd., Beijing, China) testbed shows an end-to-end batch throughput of ∼38,000 packets/s and memory usage of ∼265 MB for the entire evaluation pipeline, dominated by the Python runtime and dataset loader, not the model itself.

Using the measured average latency of 0.013 ms as the execution time (C) and a period of $T=1$ ms, utilisation is $U=0.011$, which is well below the Liu–Layland bound of $U_{\mathrm{bound}}=0.828$ for two tasks. Therefore, the detector is fully schedulable under fixed-priority real-time scheduling.

6. Discussion

6.1. Interpretation of Results

The experimental results reveal several important observations regarding the effectiveness and practicality of the proposed UnifiedDetector architecture for IIoT environments.

First, the model achieves near-perfect recall of 99.65% on CICIoT23 and 99.46% on CIC-DDoS2019, meaning that only a very small fraction of attacks is missed. In the context of industrial control systems (ICSs), this property is particularly important because undetected attacks can lead to severe consequences, including service disruption, physical damage to equipment, or cascading failures in interconnected infrastructure [16]. Achieving such a high recall ensures that the system prioritises safety and operational continuity.

Second, the results demonstrate the effectiveness of the proposed transfer learning strategy. The CNN-based feature extractor trained on CIC-DDoS2019 successfully captures general traffic patterns that remain relevant when applied to the CICIoT2023 dataset. This is evidenced by the rapid convergence during fine-tuning, where the model reaches a validation accuracy of 99.50% within only eight epochs. Such fast convergence suggests that the lower layers of the network have learned meaningful representations of network traffic behaviour that generalise across datasets. The ablation study further confirms that selective transfer provides faster convergence than training from scratch (8 epochs vs. 25 epochs at full data scale) and outperforms full fine-tuning in terms of F1 score. The freeze-first-6 strategy (F1 $=0.9817\pm 0.0190$) is consistently better than unfreezing all layers (F1 $=0.9803\pm 0.0201$). Training from scratch on the 20% subsample achieves a comparable final F1, indicating that the convergence-speed advantage of transfer learning is most prominent when the full training set is used. Importantly, the architectural advantages are not artefacts of favourable initialisation: the paired significance analysis in Section 5.3.1 shows that the gains of the full model over the MLP-only and CNN-without-CBAM baselines remain significant after Holm–Bonferroni correction (adjusted $p=0.0210$ and $p=0.0056$), with very large paired effect sizes ($d_z=6.88$ and $15.38$).

Third, the measured inference latency confirms the feasibility of deploying DL-based detectors on edge gateways. The average inference latency of approximately 0.013 ms per packet is significantly below the typical millisecond-scale packet-arrival intervals observed in industrial networks [2,22]. The inference-only throughput exceeding 93,000 packets/s demonstrates that the model can handle high-volume traffic scenarios commonly associated with DDoS attacks, while the end-to-end batch throughput of about 38,000 packets/s provides a realistic lower bound for a full detection pipeline.

Finally, the schedulability analysis provides additional confidence in the model’s suitability for real-time deployment. By modelling the detector as a periodic task within a fixed-priority scheduling framework, we verified that the system utilisation (0.013) remains well below the Liu–Layland bound (0.828). This indicates that the detection task can be executed alongside other gateway processes without missing real-time deadlines, an important requirement for industrial automation systems where timing constraints are strict [42].

6.2. Trade-Offs and Limitations

Although the detector achieves very high recall, this comes with FPR values of 10.22% on CIC-DDoS2019 and 5.61% on CICIoT23. These values reflect a deliberate design choice to prioritise attack detection over false-alarm reduction. In critical infrastructure, failing to detect an attack is typically far more dangerous than incorrectly flagging legitimate traffic [36]. Many industrial deployments accept FPRs of up to 5–10% when followed by a human-in-the-loop confirmation or a temporary rate limit. As shown in Table 9, raising $\tau$ from 0.1 to 0.9 reduces FPR from 0.0084 to 0.0004 while maintaining attack recall above 0.979, giving operators a clear mechanism to control the trade-off. We provide the cost-sensitive threshold selection as an optional tunable feature in the code repository.

Another limitation of the current system is that it performs binary classification only, distinguishing between benign and malicious traffic. While this is sufficient for detecting the presence of an attack, it does not provide information about the specific attack type. Identifying the attack category (e.g., DNS amplification, SYN flood, or UDP flood) would allow network administrators to apply more targeted mitigation strategies [4,5]. Therefore, extending the architecture to support multi-class classification represents a valuable direction for future work.

Furthermore, although the datasets used in this study are among the most comprehensive publicly available cybersecurity datasets, they cannot fully capture the diversity of real-world industrial traffic. Operational networks may exhibit different traffic patterns, device behaviours, and attack variants that are not present in benchmark datasets. As a result, additional validation in real production environments will be necessary to fully assess the robustness and generalization capability of the proposed detector.

Critical concerns for any ML-based intrusion detection system include robustness against adversarial manipulation, concept drift, and evolving attack patterns. Our evaluation does not include adversarial attacks (e.g., crafted perturbations to evade detection) or online adaptation to concept drift. The model is static after deployment and does not update its parameters in response to changing traffic distributions. Future work will evaluate robustness using adversarial example generation techniques such as FGSM and PGD and will explore online learning mechanisms such as incremental fine-tuning or federated learning to handle concept drift.

The experiments were conducted on two datasets (CIC-DDoS2019 and CICIoT23). While these datasets cover a wide range of modern DDoS attacks, they do not represent all possible IIoT traffic environments. The design of the projection layer is dataset-agnostic and should generalise to other numerical feature sets (e.g., Edge-IIoTset, UNSW-NB15, or BoT-IoT). However, direct validation on additional datasets is necessary to confirm generalisation. We plan to conduct such experiments in future work. Our experiments were conducted on an Intel Core i7 CPU as a representative edge-class processor. However, many IIoT gateways employ ARM-based controllers (e.g., Raspberry Pi or Jetson Nano). Direct validation on such hardware is not performed in this work and is left for future research.

A further limitation is that both CIC-DDoS2019 and CICIoT23, despite being widely used, are controlled benchmark datasets. They may not fully capture the traffic dynamics, device behaviours, or attack variants present in real operational IIoT networks. Reported performance metrics could be inflated due to dataset-specific artefacts (e.g., clean labelling and fixed feature sets). Validation on real industrial traffic or high-fidelity emulation is therefore necessary before deployment and is part of our ongoing work.

6.3. Comparison with Prior Work

Table 11. Comparison of the proposed UnifiedDetector with state-of-the-art approaches (hardware and datasets differ across methods).

Approach	Reference	Accuracy (%)	Latency (ms)	Edge-Ready
Multi-Layer DRL	[24]	97	0.850	Yes
Hybrid DNN (CNN-LSTM)	[30]	99.52	0.179	Yes
AttackNet (CNN-GRU)	[37]	99.75	8.00	No
Edge-IIoTset	[31]	95.12	0.450	Partial
Adaptive TL	[10]	high	29.000	No
FFT + DTL (VGG19)	[8]	99.11	18.300	Partial
Hybrid CNN-LSTM SDN	[11]	99.73	70.490	No
ResNet-18 DTL + DPU	[9]	99.45	5.500	Yes
Proposed (CNN-CBAM)	Ours	99.52	0.013	Yes

compares our results to representative approaches from the literature. The proposed method achieves the highest accuracy while keeping latency far lower than other DL-based competitors and matching the speed of lightweight signature-based systems. Importantly, we provide direct baseline re-implementations under identical conditions, which are not offered by most prior works.

Beyond the headline figures, three critical observations qualify this comparison. First, the latency gap is structural rather than incidental. The slowest competitors are dominated by sequential recurrent computation (70.49 ms for the CNN-LSTM hybrid [11]), large vision backbones operating on image-converted traffic (18.30 ms for FFT + VGG19 [8]; 5.50 ms for ResNet-18, even with DPU offloading [9]), or distribution-alignment overhead (29.00 ms for MMD-based adaptive transfer [10]). The proposed detector avoids all three cost sources by design, processing tabular features in a single feed-forward pass of approximately 276,000 FLOPs, which accounts for the two- to four-order-of-magnitude latency advantage (0.013 ms) without hardware acceleration. Second, the comparison in Table 11 must be interpreted with the caveat stated in its caption: the cited accuracies and latencies were reported by the original authors under heterogeneous datasets, hardware platforms, and preprocessing pipelines, so they indicate the achievable operating envelope of each method class rather than a strictly controlled benchmark. This caveat is exactly why our evaluation additionally re-implements MLP, CNN-without-CBAM, scratch-training, and full fine-tuning baselines under identical preprocessing, splits, seeds, and hardware and subjects the differences to formal paired significance testing with multiple-comparison correction (Section 5.3.1). To the best of our knowledge, none of the compared studies provides this combination of internally controlled baselines and statistical validation. Third, the closest accuracy competitor, AttackNet [37], exceeds our accuracy by 0.23 percentage points but at 8 ms latency and with GRU memory requirements, which its authors acknowledge as prohibitive for edge gateways, while the only sub-millisecond competitor [30] reports 0.179 ms, which is roughly sixteen times our inference latency, on the older CICDDoS2019 benchmark without cross-dataset transfer capability. The proposed method is therefore not uniformly dominant on every metric in isolation, but it is the only approach in the comparison that simultaneously satisfies sub-0.1 ms CPU-only inference, heterogeneous-feature cross-dataset transfer, and statistically validated gains over controlled baselines.

These results have practical implications. Sub-millisecond latency means DL can now run on existing edge hardware without acceleration. Transfer learning lets models adapt to new traffic patterns without sending data to the cloud, which helps with data sovereignty. Finally, the light computational footprint (≈275,000 ops) means deployment does not necessarily require hardware upgrades.

7. Conclusions

This paper presented a lightweight hybrid transfer and deep learning framework for real-time DDoS detection in IIoT edge environments. The proposed UnifiedDetector architecture integrates a CNN with a CBAM [17] and an MLP to capture complex traffic patterns while maintaining the strict computational efficiency required for edge deployment [2,21]. A key contribution of this work is the feature projection layer, which facilitates sequential transfer learning between datasets of varying dimensions [20]. By reusing knowledge from the CIC-DDoS2019 dataset [4], the model achieves rapid convergence on the modern CICIoT2023 benchmark [5], effectively addressing the challenge of domain shift in dynamic IIoT networks [19].

Experimental results demonstrate that the proposed detector achieves 99.52% accuracy and near-perfect recall (99.65%) on CICIoT23, with a practical FPR of 5.61%. Beyond classification efficacy, the system exhibits superior real-time performance on CPU-only hardware. In addition, it achieves average inference latency of 0.013 ms, inference-only throughput exceeding 93,000 packets/s, and end-to-end batch throughput of approximately 38,000 packets/s. Schedulability analysis confirms that the detector remains well within the Liu–Layland bound, ensuring it can coexist with primary gateway processes without violating hard real-time constraints. Extensive ablation and variance analysis under identical conditions substantiate the advantages of the proposed design. Formal paired significance testing with Holm–Bonferroni correction confirms that the architectural gains over the MLP-only and CNN-without-CBAM baselines are statistically significant, with very large effect sizes (Holm-adjusted $p=0.0210$ and $p=0.0056$, respectively), and that retaining the skip connection incurs no statistically significant F1 penalty while reducing the mean FPR by six-fold. These findings suggest that optimised DL models can be deployed effectively at the network edge without the need for specialised hardware accelerators [22]. Future work will focus on extending the architecture to support multi-class attack classification [30,37], implementing adaptive thresholding for dynamic precision–recall balancing, and performing hardware-in-the-loop validation on ARM-based industrial controllers.