Edinburgh Napier University

  The increasing prevalence of the Industrial Internet of Things (IIoT) in industrial environments amplifies the potential for security breaches and compromises. To monitor IIoT networks, intrusion detection systems (IDS) have been introduced to detect malicious activities within the network flow, in which machine learning (ML) and deep learning (DL) play an important role. However, existing IDSs face challenges during training when dealing with imbalanced training data and a higher number of classes. These issues can significantly reduce the IDS’s performance and may result in missed network attacks, especially those with fewer training samples. To address these challenges, this paper introduces a multi-head attention-based gated recurrent unit (MAGRU) that scrutinizes IIoT network traffic to detect malicious activities. In the proposed model, the multi-head attention (MA) has the ability to enhance the learning capability of the model to handle limited sample classes. The gated recurrent unit (GRU) is employed for the detection of IIoT network behavior. The proposed MAGRU is evaluated using two publicly available datasets, namely Edge-IIoTset and MQTTset. To validate the performance of the proposed MAGRU, various ML and DL models were implemented and compared against MAGRU using the same dataset. The proposed model outperformed the other models, achieving an average precision, recall, F1-score, and accuracy of 99.62%, 99.67%, 99.64%, and 99.97%, respectively, for the aforementioned datasets. These results demonstrate optimal performance in the detection of intrusions in IIoT networks.