AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things

Raima Deb; Pranav M Pawar; Mithun Mukherjee; Raja Muthalagu; Mian Guo

cs.CROct 22, 2026

AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things

Authors: Raima Deb, Pranav M Pawar, Mithun Mukherjee, Raja Muthalagu, Mian Guo

Organizations: ∗Department of Computer Science, Birla Institute of Technology and Science, Pilani, Dubai Campus, Dubai International Academic City, Dubai, United Arab Emirates · † Guangdong Polytechnic Normal University, Guangzhou, China

Abstract

Modern Industrial Internet of Things (IIoT) im- plementations now connect edge gateways, cloud dashboards and business applications. This improves visibility and remote monitoring. However it simultaneously exposes industrial traffic to various cyber threats including scanning, web attacks and Structured Query Language (SQL) injection (SQLi), phishing- driven credential theft, and command-and-control (C2) activity. Although rule-based tools remain useful for detecting known signatures, their efficacy decreases with minimally altered attacks or when alerts require manual investigation. This paper presents AIRO (Autonomous Intelligence-Driven Cybersecurity Risk Re- duction System), an efficient framework for IIoT monitoring and response. AIRO combines Apache Kafka streaming, attack- specific feature extraction, machine learning (ML) inference, confidence-based decision logic and risk reduction measures such as Internet Protocol (IP) blocking, account suspension and traffic limiting. We developed four specialized datasets for C2 beaconing, reconnaissance, SQLi, and phishing to evaluate AIRO. These datasets include noisy and overlapping characteristic distribu- tions to minimize label leakage. The best-performing models, primarily Gradient Boosting and LightGBM, achieve F1-scores up to 0.9229 while ensuring low-latency from event input to mitigation

Figures & tables

Panel of Figure 1 — Fig. 1: Detailed AIRO system architecture organized as a block diagram from datasets and Kafka streaming to model inference and mitigation.

Panel of Figure 2 — Fig. 2: Kafka pipeline connecting event ingestion, model inference, and response.

Field	Description
event_id	Unique identifier for traceability and duplicate handling.
timestamp	Time at which the gateway or connector observed the event.
asset_type	programmable logic controller (PLC), sensor gateway, web server, user endpoint, or cloud service.
src , dst	Source and destination address, domain, or service identifier.
host	Device, endpoint, or service that generated the event.
features	Extracted numerical or encoded features used by the model.

TABLE I: Kafka event schema used by the prototype.

Score range	Risk level	Action in IIoT deployment
$p<0.45$	Low	Store event, update dashboard, no automated disruption.
$0.45\leq p\leq 0.55$	Borderline	Notify analyst and request confirmation before enforcement.
$0.55<p<0.80$	Medium	Raise alert, increase logging, throttle repeated sources.
$p\geq 0.80$	High	Apply attack-specific block, isolation, sinkhole, or quarantine.

TABLE II: Decision policy used by the AIRO response engine.

Panel of Figure 5 — Fig. 3: Threat-specific mapping from detection score to mitigation control.

Dataset	Total	Mal.	Norm.	Features
C2 beaconing	5,000	1,264	3,736	10 numerical
Recon.	6,000	1,898	4,102	12 numerical
SQLi	5,000	1,497	3,503	5 num. + TF-IDF
Phishing	10,000	5,092	4,908	9 num. + 9 cat.

TABLE III: Dataset overview used in the prototype.

Feature	Description
num_nodes	Nodes in the network window.
num_malicious_nodes	Malicious nodes in the scenario.
heterogeneity	Diversity of node or device types.
interval_mean/std	Mean and variation of beacon intervals.
packet_size	Average packet size.
dns_requests	DNS query count and burstiness.

TABLE IV: C2 beaconing feature descriptions.

Feature	Description
connection_attempts	Total connection attempts.
unique_ports	Distinct ports contacted.
failed/success_connections	Failed and successful connections.
scan_rate	Attempts per second.
avg_connection_duration	Average connection duration.
packet_rate , bytes_sent	Packet and byte volume.

TABLE V: Reconnaissance feature descriptions.

Feature	Description
request_rate	Number of queries per second.
failed_queries	Number of failed query attempts.
response_time	Average query response time.
payload_length	Query-string length.
encoding_flag	URL or hex encoding indicator.
query	Raw SQL text transformed using TF-IDF, with special characters preserved.

TABLE VI: SQLi feature descriptions.

Feature group	Description
URL/domain	URL entropy, domain age, redirects, shortened links, and suspicious tokens are analyzed.
Sender	Sender reputation, mismatch flags, and email metadata are evaluated.
Login	Login location, frequency, and abnormal access behavior are monitored.
Categorical	Encoded sender, domain, and action categories are identified.
Network fields	Connection and request indicators near the email event are examined.

TABLE VII: Phishing feature descriptions.

Principle	Purpose
Class overlap	Protects against the learning of impractical threshold policies.
Noise injection	Symbolizes packet losses, logging discontinuities, encoded strings, and measurement errors.
Attack variants	Comprises of low frequency scans, jittered C2, SQLi code, and short URLs.
Benign look-alikes	Includes software updates, maintenance scans, admin queries, and valid login URLs.
Before tuning split	Avoids accidental data leakage from training to evaluation sets.

TABLE VIII: Dataset construction principles.

Threat	Train/Val/ Test split	Pre- processing	Model	Hyper- parameters
C2	64/16/20	StandardScaler numerical features	Gradient Boosting	100 estimates, lr 0.1
Recon.	80/0/20	Tree features, class weight 1:2	LightGBM	100 estimates, lr 0.1, 31 leaves
SQLi	60/20/20	StandardScaler, TF-IDF	Gradient Boosting	100 estimates, lr 0.1
Phishing	70/15/15	StandardScaler, one-hot encoding	Gradient Boosting	100 estimates, lr 0.1

TABLE IX: Experimental setup and hyperparameters.

Threat	Selected model	Acc.	Prec.	Rec.	F1
C2 beaconing	Gradient Boosting	0.923	0.914	0.932	0.923
Reconnaissance	LightGBM	0.914	0.909	0.918	0.913
SQLi	Gradient Boosting	0.908	0.897	0.916	0.906
Phishing	Gradient Boosting	0.671	0.660	0.641	0.650

TABLE X: Best-performing models for AIRO datasets.

Panel of Figure 14 — Fig. 4: F1-score of chosen models for each threat category.

Panel of Figure 15 — Fig. 5: Precision of selected models from each threat category.

Panel of Figure 16 — Fig. 6: ROC curves for the selected AIRO classifiers.

Work	Method/domain	Accuracy	F1-score	Stream	Response
Choukhairi et al. [ 11 ]	Butterfly opt. ensemble; IoT/IDS	99.795%	0.9979	No	No
Abid et al. [ 10 ]	GWO + CNN-LightGBM; IoT/IoMT	95.24%	0.9951	No	No
Ness et al. [ 13 ]	ML anomaly detection; network	85%	0.85	No	No
AIRO	Kafka + attack-specific ML; IIoT	95.3%	0.9229	Yes	Yes

TABLE XI: Comparative analysis with related works.

IoT Intrusion Detection

IoT intrusion detection identifies malicious network activity targeting connected devices and industrial systems using traffic and device data.

See all 51 papers

MI $^2$ DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks
Feb 27, 2026Wei Lian, Alejandro Guerra-ManzanaresIoT Intrusion Detection Network Intrusion Detection
School of Computer Science, University of Nottingham, Ningbo, China
SE-Enhanced ViT and BiLSTM-Based Intrusion Detection for Secure IIoT and IoMT Environments
Apr 6, 2026Afrah Gueriani, Hamza Kheddar, Ahmed Cherif Mazari +2Hybrid Transformer Architectures IoT Intrusion Detection
LSEA Lab., Faculty of Technology, University of MEDEA, Medea 26000, Algeria · LSEA Lab, Faculty of Science, University of MEDEA, Medea 26000, Algeria · Department of Computer Engineering, Gazi University, Ankara, Turkey +1
ASTRO: Adaptive Spatio-Temporal Reinforcement Optimization for GNN Powered Anomly Detection in Cyber Physical Systems
May 24, 2026Rai Ali Yar, Umaisa Lail, Anwar ShahIndustrial Anomaly Detection Online Anomaly Detection
Department of Computer Science, FAST NUCES, Development Sector, Faisalabad, Pakistan · Department of Information Technology, Riphah International University, Faisalabad, Pakistan

Feb 27, 2026J/K move · Enter open · S save

MI $^2$ DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks

Wei Lian, Alejandro Guerra-Manzanares

School of Computer Science, University of Nottingham, Ningbo, China

IoT Intrusion Detection Network Intrusion Detection

Open paper AskPDF arXiv

The rapid expansion of Industrial IoT (IIoT) systems has amplified security challenges, as heterogeneous devices and dynamic traffic patterns increase exposure to sophisticated and previously unseen cyberattacks. Traditional intrusion detection systems often struggle in such environments due to their reliance on extensive labeled data and limited ability to detect new threats. To address these challenges, we propose MI

^2

DAS, a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling, open-set recognition to distinguish between known and unknown attacks and incremental learning for adapting to novel attack types with minimal labeling. Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers. In the first layer, GMM achieves superior normal-attack discrimination (accuracy = 0.953, TPR = 1.000). In open-set recognition, GMM attains a recall of 0.813 for known attacks, while LOF achieves 0.882 recall for unknown attacks. For fine-grained classification of known attacks, Random Forest achieves a macro-F1 of 0.941. Finally, the incremental learning module maintains robust performance when incorporation novel attack classes, achieving a macro-F1 of 0.8995. These results showcase MI

^2

DAS as an effective, scalable and adaptive framework for enhancing IIoT security against evolving threats.

Abstract

IoT Intrusion Detection

Explore similar work

MI2^22DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks

SE-Enhanced ViT and BiLSTM-Based Intrusion Detection for Secure IIoT and IoMT Environments

ASTRO: Adaptive Spatio-Temporal Reinforcement Optimization for GNN Powered Anomly Detection in Cyber Physical Systems

MI $^2$ DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks