Hierarchical Expert-Routed Boosting with Probability Fusion for Multiclass Intrusion Detection in Edge-IoT and IIoT Networks
TL;DR
Findings indicate that attack-family information can provide useful complementary structure when fused with a strong flat boosting classifier, however, the evaluation is limited to Edge-IIoTset, and external validation on additional IoT/IIoT datasets is required in future work.
Abstract
The increasing deployment of Internet of Things (IoT) and Industrial Internet of Things (IIoT) systems has created a need for intrusion detection methods that can identify fine-grained attack categories under class imbalance. This study proposes HERB-Fusion-IDS, a hierarchical expert-routed boosting framework for multiclass intrusion detection. The method combines a flat XGBoost classifier with an attack-family router and family-specific expert classifiers, and the final class probabilities are obtained through validation-selected probability fusion. Experiments were conducted on the Edge-IIoTset benchmark as a 15-class classification task using five independent stratified repetitions. The proposed method achieved mean accuracy, macro-F1, MCC, and rare-class F1 values of 0.961, 0.851, 0.913, and 0.746, respectively. Compared with flat XGBoost, HERB-Fusion-IDS produced small but consistent improvements in macro-F1, MCC, and rare-class F1 while maintaining a comparable false-alarm rate. The rare-class improvement was mainly associated with improved Fingerprinting detection. These findings indicate that attack-family information can provide useful complementary structure when fused with a strong flat boosting classifier. However, the evaluation is limited to Edge-IIoTset, and external validation on additional IoT/IIoT datasets is required in future work.