Optimizing multi-class intrusion detection in IIoT: advanced feature selection using grey wolf optimizer and machine learning classifiers

Abstract

The rapid expansion of the Industrial Internet of Things (IIoT) has increased the cyberattack surface of industrial infrastructures, creating demand for intrusion detection systems (IDS) that combine predictive performance with deployment efficiency. This study proposes a Grey Wolf Optimizer (GWO)-guided fixed top-k feature-ranking framework for multi-class IIoT intrusion detection using candidate-dependent redundancy regularization, class-weighted learning, stratified cross-validation, repeated runs, and independent holdout evaluation. The framework was evaluated on the CIC IIoT Dataset 2025 and independently assessed on Edge-IIoTset as a secondary benchmark across six machine learning classifiers and several feature-selection baselines. On CIC IIoT Dataset 2025, Random Forest and Decision Tree achieved holdout Macro-F1 scores of 0.9389 and 0.9330, respectively, using only 10 selected features, representing an 85.92% reduction from the 71-feature model-input space. Repeated training-only comparisons showed significant overall differences among GWO, BA, LightGBM, and Boruta (Friedman χ ² = 16.920, p = 0.000734; Kendall’s W = 0.564); GWO outperformed BA and LightGBM after Holm correction but did not differ significantly from Boruta. Ablation analysis further showed lower feature redundancy under adaptive regularization, although its predictive advantage was not statistically significant. Results on Edge-IIoTset showed that feature-selection effectiveness is dataset dependent. Overall, the proposed framework provides a practical balance between predictive performance, feature compactness, and computational efficiency for resource-constrained IIoT intrusion detection.