{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,4]],"date-time":"2026-11-04T05:49:23Z","timestamp":1793771363469,"version":"4.6.1"},"reference-count":38,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T00:00:00Z","timestamp":1776988800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The Industrial Internet of Things (IIoT) has become a cornerstone of modern industrial automation, enabling real-time monitoring, intelligent decision-making, and large-scale connectivity across cyber\u2013physical systems. However, the growing scale, heterogeneity, and dynamic behavior of IIoT environments significantly expand the attack surface and challenge the effectiveness of conventional security mechanisms. In this paper, we propose DeepSense, a hybrid and adaptive anomaly and intrusion detection framework specifically designed for resource-constrained and heterogeneous IIoT deployments. DeepSense integrates three complementary components: DataSense, a realistic data pipeline and experimental testbed supporting synchronized sensor and network data processing; RuleSense, a lightweight rule-based detection layer that provides fast, deterministic, and interpretable anomaly screening at the edge; and NeuroSense, a learning-driven detection module comprising an adaptive ensemble of 22 machine learning and deep learning models spanning classical, neural, hybrid, and Transformer-based architectures. NeuroSense operates as a second detection stage that validates suspicious events flagged by RuleSense and enables both coarse-grained and fine-grained attack classification. To support rigorous and practical assessment, this work further introduces a comprehensive performance evaluation framework that extends beyond accuracy-centric metrics by jointly considering detection quality, latency, resource efficiency, and detection coverage, alongside an optimization-based process for selecting Pareto-optimal model ensembles under realistic IIoT constraints. Extensive experiments across diverse detection scenarios demonstrate that DeepSense exhibits strong generalization, lower false positive rates, and robust performance under evolving attack behaviors. The proposed framework provides a scalable and efficient IIoT security solution that meets the operational requirements of Industry 4.0 and the resilience-oriented objectives of Industry 5.0.<\/jats:p>","DOI":"10.3390\/s26092662","type":"journal-article","created":{"date-parts":[[2026,5,5]],"date-time":"2026-05-05T11:40:12Z","timestamp":1777981212000},"page":"2662","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["DeepSense: An Adaptive Scalable Ensemble Framework for Industrial IoT Anomaly Detection"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-4234-9796","authenticated-orcid":false,"given":"Amir","family":"Firouzi","sequence":"first","affiliation":[{"name":"Faculty of Computer Science, University of New Brunswick (UNB), Fredericton, NB E3B 5A3, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9189-6268","authenticated-orcid":false,"given":"Ali A.","family":"Ghorbani","sequence":"additional","affiliation":[{"name":"Faculty of Computer Science, University of New Brunswick (UNB), Fredericton, NB E3B 5A3, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,4,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1007\/s43926-024-00084-3","article-title":"Internet of Things: A comprehensive overview, architectures, applications, simulation tools, challenges and future directions","volume":"4","author":"Choudhary","year":"2024","journal-title":"Discov. Internet Things"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Calder\u00f3n, D., Folgado, F., Gonz\u00e1lez, I., and Calder\u00f3n, A. (2024). Implementation and Experimental Application of Industrial IoT Architecture Using Automation and IoT Hardware\/Software. Sensors, 24.","DOI":"10.3390\/s24248074"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Alotaibi, B. (2023). A Survey on Industrial Internet of Things Security: Requirements, Attacks, AI-Based Solutions, and Edge Computing Opportunities. Sensors, 23.","DOI":"10.20944\/preprints202307.0771.v1"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"104317","DOI":"10.1016\/j.compind.2025.104317","article-title":"Industrial Internet of Things: Implementations, challenges, and potential solutions across various industries","volume":"170","author":"Afrin","year":"2025","journal-title":"Comput. Ind."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Ficili, I., Giacobbe, M., Tricomi, G., and Puliafito, A. (2025). From Sensors to Data Intelligence: Leveraging IoT, Cloud, and Edge Computing with AI. Sensors, 25.","DOI":"10.3390\/s25061763"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"100398","DOI":"10.1016\/j.dajour.2024.100398","article-title":"Digital Twins and Industrial Internet of Things: Uncovering operational intelligence in industry 4.0","volume":"10","author":"Attaran","year":"2024","journal-title":"Decis. Anal. J."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"127017","DOI":"10.1016\/j.neucom.2023.127017","article-title":"A review of IoT applications in healthcare","volume":"565","author":"Li","year":"2024","journal-title":"Neurocomputing"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"102647","DOI":"10.1016\/j.rineng.2024.102647","article-title":"Securing modern power systems: Implementing comprehensive strategies to enhance resilience and reliability against cyber-attacks","volume":"23","author":"Abdelkader","year":"2024","journal-title":"Results Eng."},{"key":"ref_9","first-page":"104291","article-title":"Intrusion detection systems in IoT: A detailed review of threat categories, detection strategies, and future technologies","volume":"95","author":"Aydin","year":"2025","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"100464","DOI":"10.1016\/j.ijcip.2021.100464","article-title":"Looking back to look forward: Lessons learnt from cyber-attacks on Industrial Control Systems","volume":"35","author":"Miller","year":"2021","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"114913","DOI":"10.1016\/j.enpol.2025.114913","article-title":"Cyber threats and energy security: Development and analysis of an incident dataset for the period 2022\u20132024","volume":"208","year":"2026","journal-title":"Energy Policy"},{"key":"ref_12","first-page":"100082","article-title":"A survey on intrusion detection system in IoT networks","volume":"3","author":"Rahman","year":"2025","journal-title":"Cyber Secur. Appl."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"73468","DOI":"10.1109\/ACCESS.2025.3554083","article-title":"Intrusion Detection in IoT and IIoT: Comparing Lightweight Machine Learning Techniques Using TON_IoT, WUSTL-IIOT-2021, and EdgeIIoTset Datasets","volume":"13","author":"Ismail","year":"2025","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"103991","DOI":"10.1016\/j.adhoc.2025.103991","article-title":"Advanced intrusion detection in the industrial Internet of Things using federated learning and LSTM models","volume":"178","author":"Anwer","year":"2025","journal-title":"Ad Hoc Netw."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"103347","DOI":"10.1016\/j.inffus.2025.103347","article-title":"Transformers and large language models for efficient intrusion detection systems: A comprehensive survey","volume":"124","author":"Kheddar","year":"2025","journal-title":"Inf. Fusion"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"25613","DOI":"10.1109\/JIOT.2024.3369034","article-title":"Multi-Level Intrusion Detection Based on Transformer and Wavelet Transform for IoT Data Security","volume":"11","author":"Liang","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Al Rawajbeh, M., Maria Soosai, A.J., Ramasamy, L.K., and Khan, F. (2025). Trustworthy Adaptive AI for Real-Time Intrusion Detection in Industrial IoT Security. IoT, 6.","DOI":"10.3390\/iot6030053"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Laiq, F., Al-Obeidat, F., Amin, A., and Moreira, F. (2023). DDoS Attack Detection in Edge-IIoT using Ensemble Learning. Proceedings of the 2023 7th Cyber Security in Networking Conference (CSNet), IEEE.","DOI":"10.1109\/CSNet59123.2023.10339784"},{"key":"ref_19","first-page":"469","article-title":"An effective intrusion detection approach based on ensemble learning for IIoT edge computing","volume":"19","author":"Guezzaz","year":"2023","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"273","DOI":"10.26599\/BDMA.2022.9020032","article-title":"An Ensemble Learning Based Intrusion Detection Model for Industrial IoT Security","volume":"6","author":"Guezzaz","year":"2023","journal-title":"Big Data Min. Anal."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Eid, A.M., Nassif, A.B., Soudan, B., and Injadat, M.N. (2023). IIoT Network Intrusion Detection Using Machine Learning. Proceedings of the 2023 6th International Conference on Intelligent Robotics and Control Engineering (IRCE), IEEE.","DOI":"10.1109\/IRCE59430.2023.10255088"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"123808","DOI":"10.1016\/j.eswa.2024.123808","article-title":"Deep learning enabled intrusion detection system for Industrial IOT environment","volume":"249","author":"Nandanwar","year":"2024","journal-title":"Expert Syst. Appl."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"45762","DOI":"10.1109\/ACCESS.2024.3380816","article-title":"A Self-Attention-Based Deep Convolutional Neural Networks for IIoT Networks Intrusion Detection","volume":"12","author":"Alshehri","year":"2024","journal-title":"IEEE Access"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"100297","DOI":"10.1016\/j.sintl.2024.100297","article-title":"GA-mADAM-IIoT: A new lightweight threats detection in the industrial IoT via genetic algorithm with attention mechanism and LSTM on multivariate time series sensor data","volume":"6","author":"Saheed","year":"2025","journal-title":"Sens. Int."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Gueriani, A., Kheddar, H., Mazari, A.C., and Ghanem, M.C. (2025). A robust cross-domain IDS using BiGRU-LSTM-attention for medical and industrial IoT security. ICT Express, in press.","DOI":"10.1016\/j.icte.2025.08.011"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"56198","DOI":"10.1109\/ACCESS.2019.2912631","article-title":"Concept Drift Detection and Adaption in Big Imbalance Industrial IoT Data Using an Ensemble Learning Method of Offline Classifiers","volume":"7","author":"Lin","year":"2019","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"6839","DOI":"10.1109\/TNSM.2024.3447532","article-title":"Real-Time Adaptive Anomaly Detection in Industrial IoT Environments","volume":"21","author":"Raeiszadeh","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"3007","DOI":"10.1109\/TNSE.2022.3157730","article-title":"ASTREAM: Data-Stream-Driven Scalable Anomaly Detection with Accuracy Guarantee in IIoT Environment","volume":"10","author":"Yang","year":"2023","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"2009","DOI":"10.1080\/00207543.2025.2571209","article-title":"An adaptive online learning scheme for anomaly detection in IIoT data streams under varying operating conditions","volume":"64","author":"Li","year":"2025","journal-title":"Int. J. Prod. Res."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"2107","DOI":"10.1109\/TII.2022.3212003","article-title":"A Multi-Stage Automated Online Network Data Stream Analytics Framework for IIoT Systems","volume":"19","author":"Yang","year":"2023","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Latif, S., Driss, M., Boulila, W., Huma, Z.e., Jamal, S.S., Idrees, Z., and Ahmad, J. (2021). Deep Learning for the Industrial Internet of Things (IIoT): A Comprehensive Survey of Techniques, Implementation Frameworks, Potential Applications, and Future Directions. Sensors, 21.","DOI":"10.3390\/s21227518"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/MNET.001.1800505","article-title":"Improving Cognitive Ability of Edge Intelligent IIoT through Machine Learning","volume":"33","author":"Chen","year":"2019","journal-title":"IEEE Netw."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"6182","DOI":"10.1109\/TII.2020.2975227","article-title":"Trustworthy Network Anomaly Detection Based on an Adaptive Learning Rate and Momentum in IIoT","volume":"16","author":"Yan","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Firouzi, A., Dadkhah, S., Maret, S.A., and Ghorbani, A.A. (2025). DataSense: A Real-Time Sensor-Based Benchmark Dataset for Attack Analysis in IIoT with Multi-Objective Feature Selection. Electronics, 14.","DOI":"10.3390\/electronics14204095"},{"key":"ref_35","unstructured":"Apache Software Foundation (2026, January 19). Apache Kafka. Available online: https:\/\/kafka.apache.org\/."},{"key":"ref_36","unstructured":"Apache Software Foundation (2026, January 19). Apache ZooKeeper. Available online: https:\/\/zookeeper.apache.org\/."},{"key":"ref_37","unstructured":"Ram\u00edrez, S. (2026, January 19). FastAPI. Available online: https:\/\/fastapi.tiangolo.com\/."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1007\/s12083-025-02177-4","article-title":"IA-IDS: An Intelligent Adaptive Intrusion Detection System for IoT Security Using CNN, BiLSTM, and Attention Mechanism","volume":"19","author":"Logeswari","year":"2026","journal-title":"Peer-to-Peer Netw. Appl."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/9\/2662\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T04:13:00Z","timestamp":1778299980000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/9\/2662"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,24]]},"references-count":38,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2026,5]]}},"alternative-id":["s26092662"],"URL":"https:\/\/doi.org\/10.3390\/s26092662","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,24]]}}}