Correction: Optimized ensemble machine learning model for cyberattack classification in industrial IoT

The advent of the Fourth and Fifth Industrial Revolutions has resulted in greater connectivity between ICS and IoT systems, enabling features such as remote monitoring, automation, and cloud-based control. Despite these advancements, traditional cybersecurity toolslike antivirus programs, firewalls, and Intrusion Detection Systemsare often insufficient for detecting advanced and sophisticated cyber threats targeting these systems. In the oil and gas sector, IoT and ICS technologies are employed for tasks such as pipeline vandalism detection, digital twin development, reservoir evaluation, and methane gas monitoring. However, cybersecurity efforts in this industry have not received enough emphasis. Considering the sector's critical importance to the global economy, cyberattacks on oil and gas infrastructure can lead to serious repercussions, including operational disruptions, data manipulation, and significant financial damage (Ghosh et al., 2022;Lukman, 2018;Ochulor, 2024;Knebel et al., 2023;Ali, 2024).The economic impact of cyberattacks on critical infrastructure is substantial. Studies utilizing large language models (LLMs) for cyberattack cost estimation highlight the significant financial burdens resulting from security breaches (Razavi and Jamil, 2024), while research on big data analytics in banking cybersecurity shows how attacks can lead to long-term financial and reputational damage (Razavi et al., 2023). These insights underscore the urgent need for robust cybersecurity frameworks capable of proactively detecting and mitigating threats within industrial environments.Currently, most machine learning (ML) methods for ICS and IoT security are limited to binary classification, which differentiates between normal and malicious traffic. However, real-world cyber threats are often varied and complex, necessitating multi-class classification models that can accurately identify and categorize different types of attacks. Overcoming this challenge involves employing advanced techniques such as feature engineering, hyperparameter optimization, and ensemble learning to enhance detection accuracy and enable realtime threat response (Alsolami et al., 2024).Despite the crucial role of the oil and gas industry in the global economy, cybersecurity in this sector has not received sufficient attention. While some research investigates protective strategies for ICS and IoT systems, few studies explore comprehensive, machine learningbased threat detection specifically tailored for this domain. Given the potentially devastating financial and operational consequences of cyberattacks on critical infrastructure, developing advanced, multiclass classification models and strengthening cybersecurity frameworks are essential for safeguarding these vital industries.This research aims to enhance cybersecurity in the oil and gas industry by developing an optimized stacked ensemble-based machine learning model capable of detecting and classifying cyber threats into 15 attack categories, including:• DDoS attacks (UDP, ICMP, HTTP, TCP)• Web-based attacks (SQL Injection, XSS, Uploading) • Credential and access exploits (Password Attacks, Backdoor, MITM) • Network and system vulnerabilities (Port Scanning, Fingerprinting, Vulnerability Scanners) • Advanced threats (Ransomware) To improve detection accuracy, this study applies:• Feature engineering: Encoding and selecting relevant attributes from the Edge-IIoTset dataset, such as IP addresses, frame timestamps, and URLs.• Feature selection: Using variance thresholding to retain only the most impactful features. • Hyperparameter tuning: Optimizing model parameters (e.g., kernel, gamma, C, Var smoothing, and weights) through Grid Search.• Ensemble learning optimization: Developing a stacked ensemble model and comparing it with Bagging, Boosting, Extra Trees, and Random Forest Classifiers to achieve optimal performance.The main contribution of our approach lies in the strategic selection and integration of diverse base models, including LightGBM, Extra Trees, and Logistic Regression, which are chosen to address the unique characteristics of security datasets, such as class imbalance, noise, and complex attack patterns. This curated combination aims to leverage different decision boundaries and learning mechanisms, thereby enhancing the ensemble's ability to detect sophisticated threats effectively. Furthermore, our work demonstrates significant empirical improvements in attack detection accuracy, robustness, and interpretability-particularly important for practical cybersecurity deployment.The inclusion of Logistic Regression, for instance, adds an interpretable component that provides insights into decision-making processes, aiding cybersecurity analysts in understanding attack behaviors. In summary, rather than presenting a generic stacking approach, our main focus is on the domain-informed design and extensive evaluation of these ensemble architectures in real-world ICS and IoT security contexts, offering insights and methodologies that can be adopted for similar cybersecurity challenges.This study prioritizes detection over prevention, as cyber threats in ICS and IoT environments are constantly evolving. By enhancing detection capabilities, our approach minimizes the impact of cyberattacks, ensuring greater security for industrial operations and critical infrastructure. The model, optimized for high accuracy and efficient computation time, was tested on a new, unseen dataset. It the ability to to unseen of the is as and the and a relevant to this the including feature engineering, and feature selection the approach, the model and optimized hyperparameter for machine learning and comparing and with models such as Logistic Regression, and the of models on unseen the of model in of the stacked ensemble the model and with and research methods for and oil and gas in are and involves and infrastructure in environments to access In from the with in from to over to the 2024).The of Industrial of industrial with and to operational and However, this connectivity Industrial to cyber including data and of main and data systems, and The these a crucial role by and through enabling this high of for cyberattacks critical a in the oil and gas industry and et al., et al., some are as remote and through digital This on digital has security for these remote and operations and to industrial is by the and which are in the oil and gas for pipeline can access to remote operations through which on a to of and in the it to cyberattacks et al., and IoT often have security vulnerabilities that malicious can This attack types that these industrial et al., and and The most attack and malicious to damage systems. attack that and critical systems, access a is 2023). These attacks and potentially to data of the of to operational (e.g., et al., of techniques to and malicious that the can in to ICS to potentially to system into which to IoT ICS systems. Studies that of cyberattacks from a of a significant attack and the ICS and IoT have significant in the of attacks and provides an of and attacks on ICS and and impact and and 2024).The was cybersecurity including research studies and The focus is not to cyberattacks to highlight significant cyber threats that have IoT and critical infrastructure over the While cyber not the of threat These breaches can in and as as reputational cybersecurity be a and developing a robust attack detection system for threat is a crucial in and critical such as oil and aims to explore and the research and the detection of cyberattacks on industrial and the of The is to identify the and of and highlight This is into that an of and highlight employed and and in et from attributes and including and machine learning (ML) Logistic and Random Forest for the and and However, the study on detection types of attacks. et a of with features from of including and to detect in the accuracy The study was limited in to and focus on a attack and the dataset, which with features models such as and and and over However, multi-class attack classification was not cyber et al., was to industrial data for attack The and traffic. Ensemble including learning models with The ensemble approach a accuracy of However, and not dataset, and was and to The model cyberattacks was not with models, and the was of this work the et al., to detect and attacks the dataset. models a of feature selection and hyperparameter has an of et al., with attack types ensemble model architectures with a over However, the study was limited to the and for IoT was not in et the and a model for DDoS The model models, However, and not in of the dataset, which attack models with the accuracy The study on attack detection to attack in et data from an and the for and DDoS attack and models However, the was limited to a attack and feature was provides a of the datasets, models, and advancements, in and techniques for ICS and IoT While these models detect and cyberattacks by learning and studies focus on binary classification, ability to detect diverse and on limited to the of real-world cyber in data feature and learning enhance classification accuracy, significant for in these is crucial for developing and cybersecurity for critical cyberattack detection in ICS and environments classification models capable of multi-class This study by a feature approach that critical attributes such as and IP addresses, which are essential for and to improve classification feature engineering, feature selection techniques are employed to identify the most relevant model for detecting malicious in ICS and This cyberattacks into with unique characteristics and the need for tailored detection robust multi-class classification model industrial security by accurately and mitigating diverse the of attack and detection study optimized stacked ensemble models and for classifying 15 types of malicious in ICS and to enhance accuracy while these models are optimized including and demonstrates the improvements by the to is a and cybersecurity for IoT and through a it a large and of and from over types of IoT The and attacks targeting IoT and connectivity into threat and attacks et al., of the in the Edge-IIoTset dataset, the of the data of this was an it was to a data This that the and which is essential for data and the and feature The IP and an data These need to be into for the model to effectively. To achieve a that an address as a and it to This tasks such as on IP the from to an which is to an the the is not a address (e.g., the is in the and the This approach a and for IP the IP and feature is the of the in our dataset. The of different from the To this a that an as and the from The a from the the and the the have the it is in a this of the and of in the these features to the data the features and the from the This the features to the of which can be for machine learning are some in this that can be such as and a that on a in This is a for models that The a binary for unique in the a of the of that and This the model to work with the data in a shows the and the that are to the from the to the in the The is a for into a which is often for and the provides a to into a that the model can the the in the of the The model can these as data and in the and shows the and the the of features to that the features the of the feature This it for the model to and in the the model to which can lead to and on new, unseen machine learning models on with features can be and address these and the data in the data can be for models to that the and are of the data These the of features to feature selection the to features from the dataset, which the of the The for the variance is that it is the and It feature on variance and with it a This variance not model and with the dataset, it in of to methods Feature the is and it for large datasets, which our by the into features and the The the the which is to The was to that feature with a variance than to this be and of as by the variance was from the dataset, as in the the of features the on some studies that the of features by the of to can impact This approach can the of the which is with as it can it for the model to and features are to than complex to Furthermore, features are to work with to resulting in and this the was into and an for for This that the model is on a large of the data while a to The is to to that the is which is important for model evaluation, hyperparameter and model the to address the of class in the data the dataset. This that the was to class imbalance, while the and in this data and that the model is on unseen a and of is a class is than the This can models to be the class and in the The is a for class It by of the the of of the class in the This to the class and the ability to from the class et al., of this research is to an optimized and efficient machine learning model to detect the malicious of ICS and To achieve a stacked ensemble approach has chosen for developing a machine learning model that developing stacked is that can enhance the accuracy of machine learning In the stacked ensemble approach in model and such in stacking can the of stacked ensemble models robust for different types of The for for is that it not on methods models to the of the base models and to enable the model to focus of this work is not on a rather on and an domain-informed ensemble tailored for cybersecurity approach machine learning LightGBM, Extra and Logistic a stacking ensemble to leverage instance, the inclusion of Logistic adds an interpretable component that provides insights into decision-making processes, aiding cybersecurity analysts in understanding attack behaviors. Furthermore, our work demonstrates significant empirical improvements in attack detection accuracy, robustness, and which are important for practical cybersecurity The is to how a combination of models can enhance robustness, and to complex, security on the for the stacked ensemble approach, stacked ensemble models The model is a approach that was the as the base which it a The from these is by a Random Forest which as a on a of data and features from the of the and This the model to the of the and the through the Random Forest it a and model (Alsolami et al., over is which has with base models and an as the to improve the of these models to as base model in different different and the in a of base models, with different learning Logistic The of this research is to a with different decision boundaries and to the of the model, which is to base models in the ensemble models, similar and the ensemble not be as Using a complex model Extra with a model the decision interpretable for the ensemble This approach enable to access a of decision-making is as a interpretable to a The from and complex models to improve and the of how this approach a model efficient and Extra provides variance through and Logistic adds by offering decision boundaries that are to This design the ensemble to high while ensuring and operational the contribution of this study lies in the optimization, and evaluation of these models for real-world ICS and IoT security the between model design and cybersecurity for selecting over is on to address the in ICS and IoT security While models and with an to leverage and variance a diverse of base models LightGBM, Extra Trees, and Logistic Regression, with as the including LightGBM, which is complex attack it for sophisticated The model provides and in security with few attack Logistic adds enabling a understanding of the decision-making inclusion of and Extra threat and tailored it in the of ICS and IoT security environments to stacking a was to from base These as features for the ensuring that the was on data unseen by the base models The was that class and class to the it to decision boundaries and improve stacking was a This and for and evaluation different data on a an this stacked ensemble models between and thereby data The resulting ability rather than by data between stacked ensemble models are optimized and different ensemble machine learning models, such as Bagging, Boosting, Extra Trees, and Logistic and decision to the model for detecting malicious in ICS and The study aims to identify the approach for accurately classifying malicious within the dataset. shows the of cyberattack classification in the optimized machine learning The and to this are to the Logistic a for this The and of this model it a for classification the from the model can be to the between features and the in our are with datasets, is efficient for a large of features. The of this model to it for multi-class classification strategies the In this model, binary are for a the model to than with the class the chosen as the To the parameters for our by a that the to be 2023). The to the and are in decision a for this are robust to and can for types of including and In decision have a which a practical models, can improve through hyperparameter to the high of and significant impact on et al., To the parameters for our by a that the to be The to the decision are in models to improve the of a system is a machine learning Ensemble The of this ensemble approach is to leverage the of base models, diverse in ICS and IoT and robust and of The ensemble model aims to base and a ICS and IoT attack detection the be by ICS and IoT security for and detecting the of cyber a study of models for ICS and IoT attack detection, in the such as feature engineering, model and to to attack the ensemble learning models in this study to improve the with This of the ensemble learning models for classifying ICS and IoT attacks. types of ensemble learning techniques are Random Forest Bagging, Boosting, Extra Trees, and Random Forest model is a learning model that can address a of by the and an from the decision This model methods and a high accuracy of is ability to large with high It can and identify the most significant it a In the model the importance of which is a feature with et al., To the parameters for our model, by a that the to be The to the Random Forest are in for the model the which was for the classification as it and This approach can be for with complex that for to a provides the model with to these However, need to be the with this approach, such as parameters such as and a crucial role in the is a that the variance of the and by data from the with the as the et al., 2023). In this is of Classifiers as the base is on a different with the of base to the of to and the of for base to The ensemble different and in the and the of in a and robust classification The the of the while the the of the for base These to achieve the for the ICS and IoT attacks. is an in which model to improve the of the The of these is to the and of the on the that are to are types of in this some of the most and is of the and most for and classification It through a of and the of the on the of This approach greater on the that to accurately in The of the is to of the data that have on the of the In this it is to the of the from the the is the of the and decision that are by the and the data on This the of accuracy is The decision is to the of the which is in To and the learning the is is for ability to model between and classification have the of machine learning in data and et al., shows the hyperparameter for the is efficient in and It that by the of computation These and to large To the parameters for our by a that the to be and this model, the and are in Extra an ensemble of decision the main between this and ensemble techniques are that it and the learning to the rather than a et al., et al., 2023). The main and the Extra is a of the Random Forest which aims to improve the and of the ensemble by into the Random which the a of Extra the from features. The Extra is on of decision in the to of features to be to of to for the to stacking ensemble with the dataset, by an to the of the The stacking approach by a as the on the by the base This to the of the base models ensemble of and to a approach can the of a to from a to learning of the feature the can from the of the base and this to the of the This the stacking ensemble to leverage the of the different and to classification The of stacking is by to to a stacking has employed to enhance the of learning tasks for classification and this have Ensemble The is by the and with the the These base models are to have different and which are for The Random Forest as the it to how to leverage the of the base The and models different types of while the Random Forest as the learning to the of the base models model, is by a of base Logistic Regression, Boosting, and Extra The and are to models with different decision boundaries and to and improve performance.The of is that it a complex model Extra while a model the decision interpretable for the ensemble In this Logistic is as a interpretable as the is as a to the of and such as can models, while models with decision complex models, and the of The stacking ensemble approach often base models, as it the of the different to achieve and this employed different models and for IoT cyberattack detection and classification to and are machine learning and ensemble learning focus on classification with the to into different and the the of that the ensemble learning models a combination of machine learning models to complex and within and ICS and IoT In this the of ensemble learning models in the of and ICS and IoT cyberattack detection and classification by and This to insights into the and of approach and identify the models that the most The models Bagging, Boosting, Extra Random and The for this work is into for and The of it to of data to It can that are not similar to of features to for The for and the different machine learning models on the this the of models Grid Grid is to an over a to the combination of for the It by combination of the in the to the of the This to the by the combination of for our The of the was to The approach employed by the data into the model on and a This the to identify the of that the the which are the for the model and the is the the and the from the The main of are and approach to hyperparameter the by and the of the of different hyperparameter the and to 2023). on the model and tested with Grid the of models in model has and are as base models, with Random Forest as the The approach often base models, with and accuracy have by high and The model a high of and a of with few The is between has with and The shows with an accuracy of limited in of and as in the classification and with model The is the model of The is which is to some The is accuracy model demonstrates with the a accuracy of and a accuracy of The model with and as by high and The is of The is few The is robust and high accuracy with Random Forest demonstrates by optimal hyperparameter through Grid The model an accuracy of high It as in and The model a of in In the is few an of demonstrates These that the optimized model to a robust and with The of the models have Grid to the parameters for model and an ensemble The have as in The of over for while with an of accuracy In high and accuracy with a of The Random Forest as the in of accuracy, the of with of significant to the a high accuracy of a it an of than the models with these the was and to and a over in However, a critical was that the Random Forest the that and high the ensemble not achieve the accuracy of the model of Logistic and Extra ensemble of decision as base models, with the Random Forest as the The stacking ensemble approach often base models, as it can the of the different to achieve The and accuracy and This a of in and classifying the different have as by high and The model with a high of and a of high The is has with Logistic Extra and The Logistic model an classification accuracy of classifying of The model to the are in high and of the model is the is ability between The is the high with a high accuracy of most The accuracy was while the accuracy was with The model shows a of and a of which is high The is between Extra hyperparameter Grid with on and The accuracy was high an to the while the accuracy was to unseen The model a of high in detecting and a of the is model The of stacked with are which Logistic Extra of decision and Random Forest data that while Logistic accuracy a of Extra and high and from to within efficient with the most the the accuracy of with this a significant an that the and model in accuracy, including the and thereby decision with a of and on of in attack The high accuracy and accuracy robust The high and that the model and The model a of and a of The is between this demonstrates a ensemble model capable of detection in the classification with for in real-world high accuracy and are The model has with the decision of the decision is employed for hyperparameter the not of how and are However, the is that the decision the that minimizes the of the This is in a with the chosen the long-term impact on the 2023). The decision model demonstrates in classifying an accuracy of and a accuracy of The high accuracy, with such as and a of the is and the is The of the model has ability between attack and it a for attack classification The of the ensemble model and the decision are in the classification attack categories, the and the for class and to a of and to was for class as the of to the the was and the of as and and The and by the 15 The was as the the and the was to the the for The was the from with class which the class into a This combination of provides a of the attack categories, for and in the multi-class the of the machine learning models, which Logistic and decision as as ensemble machine learning models such as Bagging, Boosting, Random Extra Trees, and Ensemble models, the of the ensemble