A Task-Specific Autoencoder–CatBoost Framework for Intrusion Detection in Imbalanced IIoT

Abstract

Industrial Internet of Things (IIoT) intrusion detection remains challenging because of class imbalance, rare attacks, and heterogeneous evaluation protocols. This study proposes a modular intrusion-detection framework based on task-specific autoencoder representation learning and downstream CatBoost classification. The binary branch learns a 16-dimensional representation from benign traffic and combines it with reconstruction error, whereas the multiclass branch uses a separate 24-dimensional representation learned from malicious traffic. On ML-EdgeIIoT, the extended five-fold group-aware binary evaluation achieved ROC-AUC = 0.9925, AP = 0.9981, and F1 = 0.9829, with a benign FPR of 0.1113. A reconstruction-error ablation increased F1 from 0.9800 to 0.9829 and reduced FPR from 0.1311 to 0.1113. The complete 14-class evaluation achieved macro-F1 = 0.6175 and macro-AUC = 0.9549, while the 15-label cascade reached strict end-to-end attack-type success = 0.6584. External validation on WUSTL-IIoT-2021 yielded a five-label macro-F1 of 0.9408 and strict success of 0.9993. These results support the task-specific modular design while highlighting the remaining difficulty of fine-grained attack attribution and false-alarm reduction.