In Named Data Networking (NDN), Collusive Interest Flooding Attacks (CIFA) is a new type of Distributed Denial of Service (DDoS) attacks, which can effectively affect the performance of NDN by sending malicious Interests intermittently. Since the concealment of CIFA is strong, the existing detection methods for Interest Flooding Attacks (IFA) are difficult to find the malicious Interests in the NDN network. However, the subsequent attack strength of CIFA is weaker than that of IFA, resulting in the attack range of CIFA is much smaller than that of IFA in large network topologies. In order to launch the most serious attack with the least cost, the attack model of CIFA has been improved by our previous work, namely Improved Collusive Interest Flooding Attacks (I-CIFA). To better take the countermeasures against I-CIFA, this paper studies the adverse effects of I-CIFA in NDN and proposes a detection mechanism for I-CIFA. Foremost, we extract the corresponding network traffic and analyze the impact of I-CIFA on malicious routing nodes in different locations of the network. Furthermore, the detection mechanism based on BO-GBM fusion algorithm is proposed to detect I-CIFA through classifying the network traffic. Finally, several specific performance metrics are adopted to evaluate the practicability of BO-GBM fusion algorithm in detecting I-CIFA. The results show that BO-GBM fusion algorithm has better detection performance than other existing detection schemes, with the detection rate of 98.69%, false alarm rate of 1.36% and missing alarm rate of 1.43%.

The rapid advancement of the Industrial Internet of Things (IIoT) has transformed industrial automation, enabling real-time monitoring and intelligent decision making. However, increased connectivity exposes IIoT systems to sophisticated cyber threats, which may pose significant security risks, especially in resource-constrained IIoT environments where computational efficiency is critical. Existing intrusion detection solutions often suffer from high computational overhead and inadequate adaptability, rendering them impractical for real-time deployment in IIoT environments. To address these challenges, this study introduces a lightweight and efficient intrusion detection framework tailored for resource-constrained IIoT environments. Firstly, an XGBoost-assisted Random Forest (XGB-RF) method is proposed to select the most important features to obtain an optimal feature subset. Moreover, SMOTE (Synthetic Minority Oversampling Technique) is utilized to balance the optimal feature subset to improve detection precision. Furthermore, to reduce computing resource requirements and latency while improving detection performance, Bayesian optimization is applied to fine-tune the parameters of XGBoost (BO-XGBoost) to obtain the best detection results. Finally, extensive experiments on benchmark datasets, including CIC-IDS2017, CSE-CIC-IDS2018, and CIC-DDoS2019, demonstrate that the proposed method, which we call ROSE-BOX (Random Forest, Synthetic Minority Oversampling Technique, and BO-Xgboost), achieves a detection accuracy exceeding 99.85% while maintaining low latency and CPU occupancy rates. Our findings highlight the robustness, lightweight nature, and efficiency of ROSE-BOX, making it well-suited for real-time intrusion detection in resource-constrained IIoT environments.

A new type of Collusive Interest Flooding Attack (CIFA), Improved Collusive Interest Flooding Attack (I‐CIFA), which originates from CIFA with a stronger concealment, higher attack effect, lower attack cost, and wider attack range in Named Data Networking (NDN). In order to detect this attack, the present study explores new detection features and establishes a sample set of attack features with different granularities, and accordingly, the Pearson coefficient is used to validate the correlation between the proposed features and the network states. Finally, the Random Forest model is designed to detect the I‐CIFA attack. To evaluate the performance of the approach, extensive experiments are conducted in ndnSIM platform. Test results show that the proposed detection approach outperforms other existing approaches with a detection rate of 98.1%, error rate of 1.9%, and false positive rate of 1.5%.

Industrial Cyber-Physical Systems (ICPS) are increasingly vulnerable to sophisticated attacks and operational disturbances that induce subtle and hard-to-detect anomalies, particularly in industrial edge environments. Existing anomaly detection methods often rely on sufficient labeled data and involve excessive computational overhead, hindering real-time detection and lightweight deployment. To address these challenges, we propose a Multimodal Feature fusion-enhanced time series Anomaly Detection framework (MFAD) in ICPS. MFAD enhances the representation of subtle anomalies by jointly modeling temporal dynamics and industrial characteristics through a unified multimodal feature fusion mechanism. Moreover, MFAD adopts a three-stage detection strategy with adaptive thresholding, which further improves robustness under varying operating conditions, while its lightweight overall architecture supports edge deployment. In addition, we provide the Industrial Gas Cyber-Physical System (IGCPS) dataset collected from real-world industrial operations. Experiments on ICPS benchmark datasets of varying scales, including IGCPS, PUMP, WADI, and SWaT, demonstrate that MFAD achieves an F1 score exceeding 96.7% with efficient resource utilization, validating its effectiveness for real-time detection and lightweight deployment in resource-constrained industrial edge environments. Note to Practitioners—This paper is motivated by the increasing need for reliable and efficient anomaly detection in Industrial Cyber-Physical Systems (ICPS), particularly deployed in resource-constrained industrial edge environments. Existing approaches often treat temporal and industrial features separately, rely on sufficient labeled data, and require substantial computational resources, which limits their applicability in real-world industrial settings. In contrast, the proposed MFAD provides a lightweight and practical solution that integrates multimodal feature fusion with robust semi-supervised detection mechanisms to effectively capture subtle anomalies in time series industrial data. The framework is designed with deployment feasibility that it offers strong detection accuracy, low latency, and efficient resource consumption suitable for industrial edge devices. The methods presented here can inform practitioners seeking to enhance the reliability and real-time performance of ICPS anomaly detection systems. Future extensions may focus on expanding MFAD for broader online industrial applications, integrating it with more edge platforms, and enabling large-scale distributed deployment.