Abstract: The large-scale deployment of the Industrial Internet of Things (IIoT) exposes industrial networks to increasingly complex security threats, making network intrusion detection a key measure for ensuring the safe operation of IIoT systems. However, significant disparities exist in sample sizes among attack categories in IIoT traffic, resulting in insufficient recognition capability of existing detection models for high-risk minority-class attacks. Meanwhile, methods based on complex architectures such as Transformers incur large parameter counts and high computational overhead, making them difficult to deploy under the resource constraints of edge devices. To this end, a Hierarchical Layer-Adaptive Feature Network (HLAF-Net) for intrusion detection is proposed to achieve high-precision and low-latency detection for class-imbalanced traffic. At the data-processing level, certain continuous features in IIoT traffic follow long-tailed or sparse distributions, whose discriminative information is prone to being dominated by extreme values or diluted by a large number of zero entries during direct normalization. A logarithmic transformation is applied to such features to compress the order-of-magnitude gap between extreme and ordinary values, so that the discriminative distances among samples are preserved after normalization. At the structural-design level, the classification task is decomposed into several levels according to the sample counts of attack categories. Since each level only needs to process the sample subset associated with that level, some features used to distinguish shallow-level categories become constant within this subset and no longer provide discriminative information; a zero-variance criterion is therefore introduced to remove such redundant features level by level, and a level-specific feature subspace is constructed for each level. At the network-architecture level, each level first adopts a gated attention mechanism to adaptively recalibrate the input features, and then employs a lightweight Multi-Layer Perceptron (MLP) in parallel with an Explicit Feature Interaction Branch (EFIB) to extract semantic representations and high-order interaction features, respectively, which are fused and passed through a classification output layer to obtain level-wise predictions. During inference, all levels output their prediction probabilities in parallel, and a cascaded level-wise decision logic determines the final category. HLAF-Net is experimentally validated on two public datasets, Edge-IIoTset and X-IIoTID. Ablation studies show that the logarithmic transformation yields the most significant gain, raising the Macro-F1 score from 77.16% to 91.04%; the hierarchical architecture, supported by high-quality input features, further improves the Macro-F1 score to 95.06%; and the gated attention mechanism enhances the convergence stability of the deeper levels during training. On the Edge-IIoTset dataset, HLAF-Net achieves a detection accuracy of 98.89%, a Weighted-F1 score of 98.91%, and a single-sample inference time of only 0.0979 ms, meeting the real-time requirements of edge deployment while maintaining detection accuracy. Across five independent runs, the standard deviations of accuracy and Weighted-F1 score remain below 0.0002, indicating stable performance that does not depend on a specific random initialization. Compared with models based on the same hierarchical divide-and-conquer paradigm, HLAF-Net improves accuracy and Weighted-F1 score by 2.18% and 2.70%, respectively, verifying the effectiveness of the level-specific feature subspaces and the network branch design. On the X-IIoTID dataset, both accuracy and Weighted-F1 score reach 98.98%, further demonstrating the effectiveness and robustness of the model across different IIoT environments.

摘要： 工业物联网（IIoT）的大规模部署使工业网络面临日益复杂的安全威胁，网络入侵检测成为保障IIoT系统安全运行的关键手段。然而，IIoT流量中各攻击类别的样本规模差异巨大，现有检测模型对少数类高危攻击的识别能力不足；同时，基于Transformer等复杂架构的方法参数规模与计算开销较大，难以适应边缘设备的资源约束。为此提出一种层次化特征自适应型网络（HLAF-Net），实现对类别不平衡流量的高精度、低时延检测。在数据处理层面，IIoT流量中部分连续特征呈长尾或稀疏分布，直接归一化时其判别信息易被极端值主导或被海量零值稀释。通过对该类特征进行对数数值变换，压缩极端值与常规值之间的数量级差异，使样本间的判别距离在归一化后得以保留。在结构设计层面，按各攻击类别的样本数量将分类任务分解为若干层级。由于每一层级仅需处理本层的样本子集，用于区分浅层类别的部分特征在该子集上取值恒定，不再提供判别信息，故引入零方差准则逐层剔除此类冗余特征，为各层级单独构建特征子空间。在网络架构层面，每一层级先以门控注意力机制对输入特征进行自适应重标定，再由轻量的多层感知机（MLP）与显式特征交互分支（EFIB）分别提取语义表征与高阶交互特征，二者融合后经分类输出层得到各层级预测。推理阶段各层级并行输出预测概率，通过逐层级联的决策逻辑确定最终类别。在Edge-IIoTset与X-IIoTID两个公开数据集上对HLAF-Net进行了实验验证。消融实验表明，对数变换带来最为显著的增益，使Macro-F1值由77.16%提升至91.04%；层次化架构在高质量输入特征的支撑下进一步将Macro-F1值提升至95.06%；门控注意力机制则提高了深层的训练收敛稳定性。在Edge-IIoTset数据集上，HLAF-Net的检测准确率达到98.89%，Weighted-F1值达到98.91%，单样本推理时间仅为0.0979ms，在保证检测精度的同时满足边缘部署的实时性需求。五轮独立运行下，准确率与Weighted-F1值的标准差均低于0.0002，表明模型性能稳定，不依赖于特定的随机初始化条件。与同样基于层次化分治思想的模型相比，HLAF-Net的准确率与Weighted-F1值分别提升2.18%与2.70%，验证了独立特征子空间与网络分支设计的有效性。在X-IIoTID数据集上，模型的准确率与Weighted-F1值均达到98.98%，进一步证明其在不同IIoT环境下的有效性与鲁棒性。