AIRO uses streaming ML to detect and mitigate IIoT threats
Original title: AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things
Authors report Gradient Boosting and LightGBM F1-scores up to 0.9229 on four noisy attack datasets with low mitigation latency.
A paper introduces AIRO, a streaming framework for Industrial Internet of Things monitoring and response. It combines Apache Kafka, attack-specific features, machine-learning inference, confidence-based decisions, and measures such as IP blocking, account suspension, and traffic limiting. The authors built datasets for command-and-control beaconing, reconnaissance, SQL injection, and phishing, and say the best models reach an F1-score of 0.9229.
Unconfirmed: Detection scores are reported only by the paper's authors and are not independently confirmed.
- Datasets add noise and overlapping features to reduce label leakage.
- Named threats include scanning, web attacks, SQLi, phishing-driven credential theft, and C2.
- Listed responses are IP blocking, account suspension, and traffic limiting.
- The highest reported F1-score is 0.9229.
From the original article
1 min read at arxiv.orgModern Industrial Internet of Things (IIoT) im- plementations now connect edge gateways, cloud dashboards and business applications. This improves visibility and remote monitoring. However it simultaneously exposes industrial traffic to various cyber threats including scanning, web attacks and Structured Query Language (SQL) injection (SQLi), phishing- driven credential theft, and command-and-control (C2) activity.
By Raima Deb · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.