Fuzzy-clustering–based multi-scale intrusion detection for the industrial internet of things
- 1College of Big Data and Information Engineering, Guizhou University, Guiyang, China
Abstract
The Industrial Internet of Things (IIoT) faces severe intrusion-detection challenges under multi-protocol, multi-device, and massive heterogeneous traffic, especially extreme class imbalance and poor minority-class detection. To address this, we propose a fuzzy-clustering-based multi-scale intrusion detection model (FPBW-IDS). At the data level, we introduce boundary-prioritized FCM-SMOTE: fuzzy memberships distinguish core vs. border samples, interpolation is prioritized in high-membership regions, and sampling weights are adjusted by membership, thereby significantly enhancing minority-class representation and suppressing noise diffusion while keeping the majority class fixed at a multiplier of 1.0. At the feature-learning level, we build three parallel branches across the spatial, temporal, and frequency domains: parallel Pyramid Depthwise Separable Convolutions (PDSC) to capture spatial (cross-feature) dependencies, BiGRU to model temporal dependencies, and wavelet transforms to extract multi-scale spectral statistics; their outputs are fused with learned weighting to form a complementary tri-domain representation. Experiments on the CICIDS2017 dataset show that the proposed method achieves state-of-the-art performance under both unsampled and sampled settings: Accuracy 99.39%, Precision 98.22%, Recall 93.69%, F1 95.56% in the comprehensive comparison; and Accuracy 98.97%, Recall 99.09%, F1 96.69% in a recall-oriented setting, markedly reducing missed detections while maintaining stable training/validation curves and a small generalization gap. These results show the effectiveness and reliability of clustering-guided oversampling combined with tri-domain multi-scale representation for IIoT intrusion detection.
Related
- Smart Agriculture Through Internet of Things and Machine Learning: A Survey of Monitoring Techniques, Methods and Applications
- Internet of Things-enabled smart irrigation systems for precision water management: A systematic review
- Green-aware intrusion detection systems: A sustainability-driven approach to network security
- A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection
- GT-PNID: A lightweight graph-temporal network integrating GCN and transformer for power network intrusion detection
BibTeX
@article{yang2026fuzzyclusteringbased,
title = {{Fuzzy-clustering–based multi-scale intrusion detection for the industrial internet of things}},
author = {Yuhan Yang and Damin Zhang and Qing He and Mu Lin and Ji Zhao},
journal = {PLOS One},
year = {2026},
month = nov,
doi = {10.1371/journal.pone.0362087},
url = {https://doi.org/10.1371/journal.pone.0362087},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Fuzzy-clustering–based multi-scale intrusion detection for the industrial internet of things
AU - Yuhan Yang
AU - Damin Zhang
AU - Qing He
AU - Mu Lin
AU - Ji Zhao
PY - 2026
DA - 2026/11/06
JO - PLOS One
DO - 10.1371/journal.pone.0362087
UR - https://doi.org/10.1371/journal.pone.0362087
AB - The Industrial Internet of Things (IIoT) faces severe intrusion-detection challenges under multi-protocol, multi-device, and massive heterogeneous traffic, especially extreme class imbalance and poor minority-class detection. To address this, we propose a fuzzy-clustering-based multi-scale intrusion detection model (FPBW-IDS). At the data level, we introduce boundary-prioritized FCM-SMOTE: fuzzy memberships distinguish core vs. border samples, interpolation is prioritized in high-membership regions, and sampling weights are adjusted by membership, thereby significantly enhancing minority-class representation and suppressing noise diffusion while keeping the majority class fixed at a multiplier of 1.0. At the feature-learning level, we build three parallel branches across the spatial, temporal, and frequency domains: parallel Pyramid Depthwise Separable Convolutions (PDSC) to capture spatial (cross-feature) dependencies, BiGRU to model temporal dependencies, and wavelet transforms to extract multi-scale spectral statistics; their outputs are fused with learned weighting to form a complementary tri-domain representation. Experiments on the CICIDS2017 dataset show that the proposed method achieves state-of-the-art performance under both unsampled and sampled settings: Accuracy 99.39%, Precision 98.22%, Recall 93.69%, F1 95.56% in the comprehensive comparison; and Accuracy 98.97%, Recall 99.09%, F1 96.69% in a recall-oriented setting, markedly reducing missed detections while maintaining stable training/validation curves and a small generalization gap. These results show the effectiveness and reliability of clustering-guided oversampling combined with tri-domain multi-scale representation for IIoT intrusion detection.
SN - 1932-6203
ER -