SAE-XG BOOST HYBRID IDS FOR INDUSTRIAL IOT

Abstract

Industrial Internet of Things (IIoT) environments face severe security challenges due to extreme traffic class imbalance, constrained computational resources, and heterogeneous communication protocols. This paper proposes a two-layer hybrid intrusion detection system combining a Sparse Autoencoder (SAE) for feature learning with XGBoost for imbalance-aware multi-class classification. The SAE compresses 41-dimensional IIoT traffic features into a 32-dimensional latent representation using sparsity constraints, which are subsequently classified by an optimized XGBoost model. Experiments conducted on the TON-IoT dataset demonstrate a macro F1-score of 89.1%, with minority attack classes achieving F1-scores above 0.74 despite imbalance ratios exceeding 850:1. Systematic ablation studies quantify the contributions of sparsity constraints (+1.4pp), class weighting (+5.0pp), and hyperparameter optimization (+2.3pp). The proposed system achieves an inference latency of 0.13 ms and a memory footprint of 69.2 MB, confirming its feasibility for deployment on industrial edge gateways. These results show that principled hybrid architectures can simultaneously achieve accuracy, balance, and efficiency for practical IIoT security.