Communication-Aware Self-Supervised Intrusion Detection for Edge-Based Industrial IoT Networks Under Concept Drift
Abstract
Edge-based Industrial Internet of Things (IIoT) networks require security mechanisms that can operate continuously under tight latency constraints while adapting to evolving communication patterns. In practice, many existing intrusion detection systems (IDS) either rely on labeled attack data, assume relatively stable traffic distributions, or impose computational costs that are difficult to sustain at the edge. These limitations reduce their effectiveness in real-world industrial deployments, where communication behavior naturally evolves over time. In this work, the authors propose a communication-aware self-supervised intrusion detection framework tailored for edge-based IIoT environments subject to concept drift. The framework learns compact representations of normal industrial communication behavior using contrastive self-supervised learning, explicitly capturing structured message-exchange patterns rather than generic traffic statistics. Anomalies are identified using Mahalanobis distance in the learned embedding space, providing correlation-aware statistical scoring with low computational overhead. To accommodate gradual behavioral shifts, the authors introduce a conservative, label-free adaptation mechanism that updates the model without requiring attack annotations or centralized retraining. They evaluate the proposed approach on both a physical edge-based IIoT testbed and the TON-IoT public dataset. The results show consistent improvements over classical unsupervised methods and modern deep anomaly-detection baselines. On the physical testbed, the framework achieves an F1-score of 0.92 with a false positive rate of 3.1%, while maintaining an inference latency of 35–40 ms on resource-constrained hardware. Additional multi-run and threshold-independent analyses further demonstrate the stability and robustness of the method. Taken together, the findings suggest that explicitly modeling communication dynamics through self-supervised representation learning offers a promising and computationally efficient direction for drift-aware intrusion detection in long-lived industrial edge networks.