Machine learning methods for identifying attacks on the control system of the industrial Internet of things

Introduction. The article addresses the problem of detecting cyberattacks in the infrastructure of the Industrial Internet of Things (IIoT), the relevance of which is driven by the rapid growth of connected industrial devices and the increasing number of attacks on critical control systems. The aim of the study is to analyze and compare machine learning methods to improve the effectiveness of attack detection in IIoT networks.

Materials and methods. The study is based on a network traffic dataset containing 84 features and 67,267 records. Data preprocessing techniques, informative feature selection, and Principal Component Analysis (PCA) were applied. Several machine learning algorithms were investigated, including Decision Tree, K-Nearest Neighbors, Tree Ensemble, PNN Learner, and Gradient Boosted Trees. Model performance was evaluated using cross-validation and tree depth limitation to mitigate overfitting.

Results and discussion. A comparative analysis of classification models was conducted. The results show that the use of PCA and model parameter optimization significantly improves attack detection accuracy. The best performance was achieved by the Tree Ensemble model, which reached a classification accuracy of 97.5% when using 17 principal components.

Conclusion. The obtained results confirm the effectiveness of machine learning approaches for building intrusion detection and security monitoring systems in Industrial Internet of Things environments.

1. Machine Learning. Available from: https://www.sap.com/central-asia-caucasus/products/artificialintelligence/what-is-machine-learning.html [Accessed 11 May 2025]. (In Russ.).

2. Voronina VV, Mikheev AV, Yarushkina NG, Svyatov KV. Theory and Practice of Machine Learning. Ulyanovsk: Ulyanovsk State Technical University; 2017. 290 p. (In Russ.).

3. Lapina MA, Movzalevskaya VV, Tokmakova ME, Babenko MG, Sajid Mohammad. Application of Machine Learning Technologies for Web Attack Detection. Voprosy Kiberbezopasnosti. 2024;(4):92- 103. (In Russ.). https://doi.org/10.21681/2311-3456-2024-4-92-103

4. Lapina MA, Podruchny NV, Rusanov MA, Babenko MG. Research of Machine Learning Methods for Detecting Network Attacks. Proceedings of the Institute for System Programming of the Russian Academy of Sciences. 2025;37(4-2):147-174. (In Russ.).

5. IoT SDN IDS Dataset. Available from: https://www.kaggle.com/datasets/hebadhirar/iot-sdn-ids-dataset [Accessed 11 May 2025]. (In Russ.).

6. Jolliffe IT, Cadima J. Principal component analysis: a review and recent developments. Philosophical Transactions of the Royal Society A. 2016;374. https://doi.org/10.1098/rsta.2015.0202

7. Biau G, Scornet E. A random forest guided tour. Test. 2016;25:197-227. https://doi.org/10.1007/s11749-016-0481-7

8. Natekin A, Knoll A. Gradient boosting machines, a tutorial. Frontiers in Neurorobotics. 2013;7:21. https://doi.org/10.3389/fnbot.2013.00021

9. Song Y, Lu Y. Decision tree methods: applications for classification and prediction. Shanghai Archives of Psychiatry. 2015;27(2):130-135. https://doi.org/10.11919/j.issn.1002-0829.215044

10. Zhang S, Li X, Zong M, Zhu X, Wang R. Efficient kNN classification with different numbers of nearest neighbors. IEEE Transactions on Neural Networks and Learning Systems. 2018;29(5):1774-1785. https://doi.org/10.1109/TNNLS.2017.2673241

11. Karachanskaya EV, Sosedova NI. A Method for Detecting Network Traffic Anomalies Based on Its Self-Similar Structure. Information Technology Security. 2019;26(1):98-110. (In Russ.). https://doi.org/10.26583/bit.2019.1.10

12. Balyberdin AV, Krylov GO. Improving the Accuracy of Intrusion Detection Systems Using Ensemble Learning. Information Technology Security. 2025;32(1):153-171. (In Russ.). https://doi.org/10.26583/bit.2025.1.11

13. Lavrov BO, Ivanov MA. Intelligent Anomaly Detection in Containerized Applications: Methods, Architectures, and Tools. Information Technology Security. 2025;32(4):149-164. (In Russ.). https://doi.org/10.26583/bit.2025.4.11

14. KNIME Analytics Platform. Available from: https://www.knime.com/knime-analytics-platform [Accessed 11 May 2025]. (In Russ.).