A Novel Architecture and Methodology to Detect Intrusions Against Edge-Based IIoT Using Machine Learning

The increasing demand for the Industrial Internet of Things (IIoT), with billions of connected things and the decentralization of data exchange, is gaining momentum, making conventional threat detection and analysis challenging in such distributed environments. In this paper, a security framework for edge nodes, called the Intrusion Detection, Prevention, and Response System (IDPRS), is proposed. It aims to detect MQTT (Message Queuing Telemetry Transport)-based threats using Machine Learning (ML) algorithms. However, ML models cannot be trained on resource-constrained devices; therefore, the approach trains the model on a high-performance platform, which will later serve as the detection engine on an edge node. The edge node can be hosted on low-cost single-board computers (SBCs), such as the Raspberry Pi. The detection model is further monitored and updated using an upgrade algorithm to make it adaptive to emerging threats. The evaluation results demonstrate high detection accuracy and reasonable resource and network overhead.