An Intrusion Detection System in IIoT Networks Based on Decision Trees and Neighborhood Component Analysis (NCA)

Abstract

The rapid expansion of Industrial Internet of Things (IIoT) networks has significantly increased the vulnerability of industrial systems to diverse cyber-attacks. Therefore, designing an intelligent and adaptive intrusion detection model capable of handling high-dimensional, streaming, and dynamically evolving network data is essential. In this paper, we propose a novel intrusion detection framework based on the Adaptive Streaming Decision Tree (ASDT) algorithm integrated with Neighborhood Component Analysis (NCA) for optimal feature selection. First, a preprocessing stage is applied to the NSL-KDD and UNSW-NB15 benchmark datasets, including data normalization and outlier removal, to enhance data consistency and reduce noise. Then, NCA-based feature selection is employed to identify the most discriminative attributes, effectively reducing computational complexity and improving classification performance. Finally, the selected features are fed into the proposed ASDT classifier, which incrementally learns from network traffic streams and dynamically adapts to concept drift through a forgetting-factor mechanism and online entropy-based splitting criteria. Experimental results demonstrate that the proposed method achieves outstanding detection performance, with an average accuracy of 99.34% on the NSL-KDD dataset and 99.02% on the UNSW-NB15 dataset, outperforming conventional decision tree and ensemble-based intrusion detection models. The results confirm that the proposed ASDT-NCA framework provides a robust, interpretable, and adaptive solution for real-time IIoT network intrusion detection.