The increasing deployment of Internet of Things devices has introduced significant cyber security challenges, creating a need for robust intrusion detection systems. This research focuses on improving anomaly detection in industrial Internet of Things networks through feature reduction and selection. Experiments were performed to compare the effectiveness of Minimum Redundancy Maximum Relevance for feature selection with Principal Component Analysis for feature reduction. Six machine learning algorithms—Decision Trees, k-nearest neighbors, Gaussian Support Vector Machine, Neural Network, Support Vector Machines kernel, and Logistic Regression Kernel—were evaluated for both binary and multi-class classification using feature sets of 4, 12, 23, 50, and 79 features. The results reveal that Minimum Redundancy Maximum Relevance is superior to Principal Component Analysis in identifying crucial features. Notably, Minimum Redundancy Maximum Relevance achieves high accuracy with just 12 features, where the Decision Tree classifier reached an outstanding 99.9% accuracy in binary classification, and k-nearest neighbors achieved 99% accuracy in multi-class classification. The article emphasizes the critical role of feature engineering, with a specific focus on feature selection and reduction, and elaborates on applying MRMR and PCA algorithms to various feature sets. By comparing these methods, it showcases their influence on both model performance and complexity, leading to the development of more efficient and precise intrusion detection systems for Industrial IoT networks. What sets this study apart from previous ones is its novel demonstration of how these techniques significantly reduce training time and model complexity while maintaining or even improving performance, confirming the effectiveness of strategic feature utilization in strengthening Industrial IoT security by balancing accuracy, speed, and model size.

This study addresses escalating cybersecurity challenges within Industrial Control Systems (ICS), focusing on Programmable Logic Controllers (PLCs), through the application of artificial intelligence for intrusion detection. A physical ICS testbed was constructed using PLCs and industrial-grade SCALANCE switches to simulate real-world environments more faithfully than previous virtual setups. Seven types of cyberattacks—including Denial-of-Service (DoS), Man-in-the-Middle (MITM), ARP Spoofing, Data Injection, and Reconnaissance—were executed alongside legitimate traffic flows. PLC communication was managed using Node-RED, attacks were performed via Kali Linux, and traffic was captured using Wireshark and Python scripts to ensure full-spectrum monitoring of both benign and malicious activity. The result is a new labeled dataset—ICSCASD-MPLC—consisting of 2.6 million entries across 57 features, available in CSV format for direct integration with machine learning systems. Machine learning algorithms, Decision Tree (DT) and eXtreme Gradient Boosting (XGBoost), were trained and evaluated. DT achieved 97% binary and 98.6% multi-class accuracy, while XGBoost achieved 99% and 97.3%, respectively. Additionally, the system’s ability to identify distinct traffic patterns associated with different types of attacks was validated, improving interpretability and detection granularity. This work contributes a high-fidelity, public dataset and a reproducible methodology for training and evaluating AI-based security solutions within ICS contexts. It aligns with urgent industry and academic needs by delivering a practical, data-driven solution for safeguarding critical infrastructure.

This study presents a novel intrusion detection approach that uses a Transformer-based architecture enhanced by a Dynamic Tanh (DyT) activation function. To ensure the model concentrates on the most informative inputs while minimizing redundancy, a feature selection stage is carried out using a Random Forest classifier guided by the Minimum Redundancy Maximum Relevance (MRMR) criterion. This step effectively filters out less useful features before training. The DyT activation mechanism allows the model to adjust its threshold values throughout the learning process, enabling faster convergence without sacrificing classification performance. The final model—named Transformer-DyT—was assessed using two widely recognized datasets: IoTID20 and UNSW-NB15, under both binary and multiclass classification settings. The preprocessing phase included normalization, MRMR-RF-based feature selection, addressing class imbalance, and handling invalid values. On IoTID20, the model achieved 97.41% accuracy in nine-class classification, 99.97% in five-class classification, and 99.98% in binary classification, outperforming previous benchmarks. Similarly, it attained 98.26% and 99.99% accuracy in multiclass and binary classification, respectively, on the UNSW-NB15 dataset. These outcomes show that combining a Transformer with DyT activation and MRMR-guided feature selection results in a highly effective detection system. This work directly addresses the challenge of detecting complex cyber threats and modeling temporal patterns in network traffic—an area where many traditional models fall short. By introducing a dynamically adaptive model focused on relevant input features, our approach fills this gap and strengthens intrusion detection in critical IoT and industrial systems.