Hierarchical Expert-Routed Boosting with Probability Fusion for Multiclass Intrusion Detection in Edge-IoT and IIoT Networks

Abstract

The increasing deployment of Internet of Things (IoT) and Industrial Internet of Things (IIoT) systems has created a need for intrusion detection methods that can identify fine-grained attack categories under class imbalance. This study proposes HERB-Fusion-IDS, a hierarchical expert-routed boosting framework for multiclass intrusion detection. The method combines a flat XGBoost classifier with an attack-family router and family-specific expert classifiers, and the final class probabilities are obtained through validation-selected probability fusion. Experiments were conducted on the Edge-IIoTset benchmark as a 15-class classification task using five independent stratified repetitions. The proposed method achieved mean accuracy, macro-F1, MCC, and rare-class F1 values of 0.961, 0.851, 0.913, and 0.746, respectively. Compared with flat XGBoost, HERB-Fusion-IDS produced small but consistent improvements in macro-F1, MCC, and rare-class F1 while maintaining a comparable false-alarm rate. The rare-class improvement was mainly associated with improved Fingerprinting detection. These findings indicate that attack-family information can provide useful complementary structure when fused with a strong flat boosting classifier. However, the evaluation is limited to Edge-IIoTset, and external validation on additional IoT/IIoT datasets is required in future work.

Keywords

• Intrusion detection
• IoT security
• IIoT security
• Edge-IIoTset
• Hierarchical classification
• Rare attack detection

Ethical Statement

Ethics committee approval was not required for this study because there was no study on animals or humans.

References

1. Baich, M., & Sael, N. (2025). A Federated Learning-Based Intrusion Detection System Using Dynamic Ensemble Aggregation for IoT Networks. IEEE Access, 13, 205826-205839. https://doi.org/10.1109/ACCESS.2025.3640521
2. Belachew, H. M., Beyene, M. Y., Desta, A. B., Alemu, B. T., Musa, S. S., & Muhammed, A. J. (2025). Design a Robust DDoS Attack Detection and Mitigation Scheme in SDN-Edge-IoT by Leveraging Machine Learning. IEEE Access, 13, 10194-10214. https://doi.org/10.1109/ACCESS.2025.3526692
3. Clinton, U. B., Hoque, N., Raza, S., & Bhuyan, M. (2026). Securing IoT: Unveiling Attacks With Multiview-Multitask Learning. IEEE Transactions on Artificial Intelligence, 7, 2332-2345. https://doi.org/10.1109/TAI.2025.3615565
4. Fan, J., Tan, S., Gu, H., Wang, Z., & Lü, J. (2026). Dynamic Hypernetwork Grouping With Diffusion-Based Sampler for Heterogeneous Federated Intrusion Detection. IEEE Internet of Things Journal, 13, 24665-24684. https://doi.org/10.1109/JIOT.2026.3674493
5. Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L., & Janicke, H. (2022). Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning. IEEE Access, 10, 40281–40306. https://doi.org/10.1109/access.2022.3165809
6. Ganesh, L. S., & Kumar, P. M. (2026). HydraGuard-ID: A Hybrid Ensemble Framework With Stratified Feature Selection for High-Accuracy DDoS Attack Detection. IEEE Access, 14, 58985-59000. https://doi.org/10.1109/ACCESS.2026.3678974
7. Gao, P., Wang, Z., Yu, S., Song, C., & Yu, H. (2026). Reliable and Trustworthy Local–Global Hierarchical Framework for Intrusion Detection in 6G-IoT Networks. IEEE Internet of Things Journal, 13, 8077-8091. https://doi.org/10.1109/JIOT.2025.3609811
8. Gutti, C., Thumula, K., & Balbudhe, P. (2025). Federated Learning for Distributed IoT Security: A Privacy-Preserving Approach to Intrusion Detection. IEEE Access, 13, 135863-135875. https://doi.org/10.1109/ACCESS.2025.3592481

9. Ismail, S., Dandan, S., & Qushou, A. (2025). Intrusion Detection in IoT and IIoT: Comparing Lightweight Machine Learning Techniques Using TON_IoT, WUSTL-IIOT-2021, and EdgeIIoTset Datasets. IEEE Access, 13, 73468-73485. https://doi.org/10.1109/ACCESS.2025.3554083
10. Keskin, F. (2024). Advanced Driving Cycle Generation Using XGBoost: A Case Study in Iğdır, Türkiye. 2024 8th International Artificial Intelligence and Data Processing Symposium (IDAP) (pp. 1–6). IEEE. https://doi.org/10.1109/idap64064.2024.10710756
11. Keskin, F., & Oz, G. (2026). Lightweight and Reliable IoT Intrusion Detection at the Edge: Compression, Calibration, and Shift-Aware Evaluation on CICIoT2023. Black Sea Journal of Engineering and Science, 9, 1218–1229. https://doi.org/10.34248/bsengineering.1905346
12. Kostas, K., Just, M., & Lones, M. A. (2025). Individual Packet Features are a Risk to Model Generalization in ML-Based Intrusion Detection. IEEE Networking Letters, 7, 66-70. https://doi.org/10.1109/LNET.2025.3525901
13. Li, H., Kang, H., Liu, C., Wang, R., Li, J., Sun, G., . . . Mao, S. (2026). Encrypted Traffic Detection in Resource Constrained IoT Networks: A Diffusion Model and LLM Integrated Framework. IEEE Transactions on Network Science and Engineering, 13, 5324-5344. https://doi.org/10.1109/TNSE.2025.3649259
14. Örsdemir, A., Tefek, U., Esiner, E., & Küpçü, A. (2026). SoK: Software-Defined Networks Security With Machine Learning. IEEE Access, 14, 40769-40787. https://doi.org/10.1109/ACCESS.2026.3673172
15. Pal, B., Islam, M. S., & Liew, A. W.-C. (2025). Calibrated Uncertainty Estimation for Trustworthy Deep IoT Attack Detection. IEEE Transactions on Dependable and Secure Computing, 22, 7571–7584. https://doi.org/10.1109/tdsc.2025.3598350
16. Sahoo, J. P., Kar, B., Wu, Y.-L., Abdelmoniem, A. M., & Chatzopoulos, D. (2026). SMoQKE-IDS: Sparse Mixture of Quantum Kolmogorov–Arnold Network Experts for FL-IDS in Edge-IIoT. IEEE Open Journal of the Communications Society, 7, 2148-2177. https://doi.org/10.1109/OJCOMS.2026.3668242
17. Saiyed, M. F., & Al-Anbagi, I. (2026). A Hybrid Explainable AI for DDoS Attacks Detection in Industrial IoT Networks. IEEE Internet of Things Journal, 13, 12958-12973. https://doi.org/10.1109/JIOT.2026.3653260
18. Shah, S. H., Walker, I., & Borowczak, M. (2026). TriSAFE: Transcript-Bound Verifiable Secure Aggregation With Differential Privacy and Timing Defenses for Gateway-Assisted IoT Federated Learning. IEEE Access, 14, 89354-89379. https://doi.org/10.1109/ACCESS.2026.3700048
19. Umar, A., & Jordanov, I. (2026). Anomaly Detection in IoT Environment Using Machine Learning: A Survey. IEEE Internet of Things Journal, 13, 20477-20497. https://doi.org/10.1109/JIOT.2026.3671102
20. Wu, M., Zheng, Y., Wong, D. S.-H., Wang, Y., & Hu, X. (2025). TRACER: Attack-Aware Divide-and-Conquer Transformer for Intrusion Detection in Industrial Internet of Things. IEEE Transactions on Industrial Informatics, 21, 4924-4934. https://doi.org/10.1109/TII.2025.3547050
21. Zhang, S., Xu, Y., & Xie, X. (2025). Universal Adversarial Perturbations Against Machine-Learning-Based Intrusion Detection Systems in Industrial Internet of Things. IEEE Internet of Things Journal, 12, 1867-1889. https://doi.org/10.1109/JIOT.2024.3465549