{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,21]],"date-time":"2026-09-21T05:05:09Z","timestamp":1789967109916,"version":"4.0.1"},"reference-count":50,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,16]],"date-time":"2026-09-16T00:00:00Z","timestamp":1789516800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Center for Scientific Research and Development in Higher Education Institutes","award":["2022HS055"],"award-info":[{"award-number":["2022HS055"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The Industrial Internet of Things (IIoT) is being used a lot in important areas like advanced manufacturing, smart energy systems, and intelligent cities. Watching for intrusion detection is very important for the safety of the IIoT. Nevertheless, multivariate sensor sequences frequently demonstrate pronounced physical coupling, non-stationarity, and periodicity concurrently, rendering it prone for detection models grounded in statistical correlation to erroneously classify normal collaborative variations as anomalies. Moreover, prevailing methods predominantly concentrate on single-domain representations within either the time or frequency domain, posing challenges in addressing both burst and periodic attacks concurrently. To address these challenges, this article introduces the Time\u2013Frequency Dual-Branch Fusion and PCMCI-Based Association-Guided Network (TFPAG-Net) for IIoT Intrusion Detection. This model initially constructs a lightweight temporal convolutional network backbone employing depthwise separable convolutions. Subsequently, parallel branches in the time and frequency domains are established to respectively model local abrupt changes, long-range dependencies, and periodic spectral structures, with time\u2013frequency feature fusion facilitated through a sample-dependent gating mechanism. Building on this, multi-scale temporal pyramids are employed to amalgamate fine, intermediate, and coarse-scale information. Furthermore, as an auxiliary refinement, a lagged conditional-dependence prior estimated from the training data via PCMCI is projected into a bounded attention bias to provide supplementary guidance for channel feature reweighting. Evaluations on Edge-IIoTset, X-IIoTID, and SWaT yield mean Macro-F1 scores of 0.9886, 0.9466, and 0.9607, respectively, over five predefined random seeds. Under the unified training protocol, TFPAG-Net ranks second on Edge-IIoTset and achieves the highest mean Macro-F1 on X-IIoTID and SWaT. Ablation experiments show dataset-dependent effects of the proposed components. On Edge-IIoTset and X-IIoTID, the final attention-stage improvement reflects the joint effect of SE-based modulation and the PCMCI-derived association prior. Accordingly, PCMCI is treated as an auxiliary association refinement rather than a principal contribution of TFPAG-Net. Additionally, TFPAG-Net maintains a moderate computational footprint, with approximately 0.29 M parameters, providing a favorable balance between model complexity and intrusion detection performance.<\/jats:p>","DOI":"10.3390\/s26185865","type":"journal-article","created":{"date-parts":[[2026,9,16]],"date-time":"2026-09-16T13:50:27Z","timestamp":1789566627000},"page":"5865","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["TFPAG-Net: A Time-Frequency Dual-Branch Fusion and PCMCI-Based Association-Guided Network for IIoT Intrusion Detection"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-1827-1869","authenticated-orcid":false,"given":"Haoran","family":"Lei","sequence":"first","affiliation":[{"name":"College of Computer Science and Information Engineering, Harbin Normal University, Harbin 150025, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1719-6228","authenticated-orcid":false,"given":"Shiming","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Information Engineering, Harbin Normal University, Harbin 150025, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1900-012X","authenticated-orcid":false,"given":"Wentao","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Information Engineering, Harbin Normal University, Harbin 150025, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shenglin","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Computer Science and Information Engineering, Harbin Normal University, Harbin 150025, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuntao","family":"Ni","sequence":"additional","affiliation":[{"name":"College of Computer Science and Information Engineering, Harbin Normal University, Harbin 150025, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,16]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"102685","DOI":"10.1016\/j.aei.2024.102685","article-title":"Advancing network security in Industrial IoT: A deep dive into AI-enabled intrusion detection systems","volume":"62","author":"Shahin","year":"2024","journal-title":"Adv. Eng. Inform."},{"key":"ref_2","first-page":"1","article-title":"A systematic survey of machine learning and deep learning models used in Industrial Internet of Things security","volume":"12","author":"Akleylek","year":"2024","journal-title":"MANAS J. Eng."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"101037","DOI":"10.1016\/j.iot.2023.101037","article-title":"A survey on security and cryptographic perspective of Industrial-Internet-of-Things","volume":"25","author":"Mishra","year":"2024","journal-title":"Internet Things"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"334","DOI":"10.1049\/cps2.12095","article-title":"Joint safety and security risk analysis in industrial cyber-physical systems: A survey","volume":"9","author":"Sun","year":"2024","journal-title":"IET Cyber-Phys. IET Cyber-Phys. Syst. Theory Appl."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., and Thompson, M. (2023). Guide to Operational Technology (OT) Security, NIST Special Publication 800-82 Rev. 3.","DOI":"10.6028\/NIST.SP.800-82r3"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"101398","DOI":"10.1016\/j.iot.2024.101398","article-title":"Securing constrained IoT systems: A lightweight machine learning approach for anomaly detection and prevention","volume":"28","author":"Alwaisi","year":"2024","journal-title":"Internet Things"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"e2291","DOI":"10.1002\/nem.2291","article-title":"A generalized lightweight intrusion detection model with unified feature selection for Internet of Things networks","volume":"34","author":"Nath","year":"2024","journal-title":"Int. J. Netw. Manag."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"109725","DOI":"10.1016\/j.compeleceng.2024.109725","article-title":"Landscape of learning techniques for intrusion detection system in IoT: A systematic literature review","volume":"120","author":"Khacha","year":"2024","journal-title":"Comput. Electr. Eng."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"e70064","DOI":"10.1002\/ett.70064","article-title":"An extensive review of machine learning and deep learning techniques on network intrusion detection for IoT","volume":"36","author":"Walling","year":"2025","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Houache, M., Boubiche, D.E., Toral-Cruz, H., Mart\u00ednez-Pel\u00e1ez, R., and Sanchez-Lara, R. (2026). Generative AI-driven intrusion detection systems for the Industrial Internet of Things: A systematic review. AI, 7.","DOI":"10.3390\/ai7050179"},{"key":"ref_11","first-page":"15","article-title":"Deep learning for time series anomaly detection: A survey","volume":"57","author":"Webb","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"6457","DOI":"10.1109\/TII.2023.3347000","article-title":"Graph structure change-based anomaly detection in multivariate time series of industrial processes","volume":"20","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_13","first-page":"11:1","article-title":"Leveraging causal information for multivariate timeseries anomaly detection","volume":"Volume 125","author":"Heppel","year":"2024","journal-title":"Proceedings of the 35th International Conference on Principles of Diagnosis and Resilient Systems (DX 2024)"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"103961","DOI":"10.1016\/j.cose.2024.103961","article-title":"STFT-TCAN: A TCN-attention-based multivariate time series anomaly detection architecture with time-frequency analysis for cyber-industrial systems","volume":"144","author":"Tu","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"103228","DOI":"10.1016\/j.mex.2025.103228","article-title":"Time-frequency analysis and autoencoder approach for network traffic anomaly detection","volume":"14","author":"Purohit","year":"2025","journal-title":"MethodsX"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"138732","DOI":"10.1109\/ACCESS.2023.3340142","article-title":"CNN-BiLSTM: A hybrid deep learning approach for network intrusion detection system in software-defined networking with hybrid feature selection","volume":"11","author":"Sabir","year":"2023","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Xiang, B., Zheng, R., Zhang, K., Li, C., and Zheng, J. (2025). FFT-RDNet: A time\u2013frequency-domain-based intrusion detection model for IoT security. Sensors, 25.","DOI":"10.3390\/s25154584"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Chollet, F. (2017, January 21\u201326). Xception: Deep learning with depthwise separable convolutions. Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.195"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Zhang, C., Li, J., Wang, N., and Zhang, D. (2025). Research on intrusion detection method based on Transformer and CNN-BiLSTM in Internet of Things. Sensors, 25.","DOI":"10.3390\/s25092725"},{"key":"ref_21","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, \u0141., and Polosukhin, I. (2017). Attention is all you need. Advances in Neural Information Processing Systems 30, Curran Associates. Available online: https:\/\/proceedings.neurips.cc\/paper\/7181-attention-is-all-you-need."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Zhou, H., Zou, H., Li, W., Li, D., and Kuang, Y. (2025). HiViT-IDS: An efficient network intrusion detection method based on Vision Transformer. Sensors, 25.","DOI":"10.3390\/s25061752"},{"key":"ref_23","unstructured":"Bai, S., Kolter, J.Z., and Koltun, V. (2018). An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv."},{"key":"ref_24","unstructured":"Wu, H., Hu, T., Liu, Y., Zhou, H., Wang, J., and Long, M. (2023, January 1\u20135). TimesNet: Temporal 2D-variation modeling for general time series analysis. Proceedings of the International Conference on Learning Representations (ICLR 2023), Kigali, Rwanda. Available online: https:\/\/openreview.net\/forum?id=ju_Uqw384Oq."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"13625","DOI":"10.1109\/JIOT.2024.3522863","article-title":"Device identification and anomaly detection in IoT environments","volume":"12","author":"Rabbani","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3722231","article-title":"SIGFRID: Unsupervised, platform-agnostic interference detection in IoT automation rules","volume":"6","author":"Cimino","year":"2025","journal-title":"ACM Trans. Internet Things"},{"key":"ref_27","unstructured":"Cohen, L. (1995). Time-Frequency Analysis, Prentice Hall PTR. Available online: https:\/\/books.google.com\/books?id=CSKLQgAACAAJ."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"68384","DOI":"10.1109\/ACCESS.2025.3557571","article-title":"FreqWave-TranDuD: A multivariate time series anomaly detection method based on wavelet and Fourier transforms","volume":"13","author":"Huang","year":"2025","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"104833","DOI":"10.1016\/j.dsp.2024.104833","article-title":"Dynamic mode decomposition-based technique for cross-term suppression in the Wigner-Ville distribution","volume":"156","author":"Reddy","year":"2025","journal-title":"Digit. Signal Process."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"114584","DOI":"10.1016\/j.engappai.2026.114584","article-title":"Antinoise adaptive time\u2013frequency fusion for multivariate time series anomaly detection","volume":"174","author":"Huang","year":"2026","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"556","DOI":"10.1007\/s10489-025-06441-1","article-title":"Frequency-enhanced and decomposed Transformer for multivariate time series anomaly detection","volume":"55","author":"Li","year":"2025","journal-title":"Appl. Intell."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"3289","DOI":"10.1038\/s41598-025-33186-1","article-title":"FreFilterTST: A dynamic channel graph sparsification approach to multivariate time series anomaly detection with frequency-domain restoration","volume":"16","author":"Wang","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Spirtes, P., Glymour, C., and Scheines, R. (2000). Causation, Prediction, and Search, MIT Press. [2nd ed.]. Available online: https:\/\/mitpress.mit.edu\/9780262527927\/causation-prediction-and-search\/.","DOI":"10.7551\/mitpress\/1754.001.0001"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"eaau4996","DOI":"10.1126\/sciadv.aau4996","article-title":"Detecting and quantifying causal associations in large nonlinear time series datasets","volume":"5","author":"Runge","year":"2019","journal-title":"Sci. Adv."},{"key":"ref_35","first-page":"938","article-title":"Conditional independence testing based on a nearest-neighbor estimator of conditional mutual information","volume":"Volume 84","author":"Runge","year":"2018","journal-title":"Proceedings of the 21st International Conference on Artificial Intelligence and Statistics"},{"key":"ref_36","first-page":"979","article-title":"Bootstrap aggregation and confidence measures to improve time series causal discovery","volume":"Volume 236","author":"Debeire","year":"2024","journal-title":"Proceedings of the Third Conference on Causal Learning and Reasoning"},{"key":"ref_37","unstructured":"Zhu, S., Ng, I., and Chen, Z. (May, January 26). Causal discovery with reinforcement learning. Proceedings of the International Conference on Learning Representations (ICLR 2020), Virtual. Available online: https:\/\/openreview.net\/forum?id=S1g2skStPB."},{"key":"ref_38","first-page":"1782","article-title":"Reframed GES with a neural conditional dependence measure","volume":"Volume 180","author":"Shen","year":"2022","journal-title":"Proceedings of the 38th Conference on Uncertainty in Artificial Intelligence"},{"key":"ref_39","first-page":"19041","article-title":"GCAD: Anomaly detection in multivariate time series from the perspective of Granger causality","volume":"39","author":"Liu","year":"2025","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"115","DOI":"10.5194\/npg-31-115-2024","article-title":"A comparison of two causal methods in the context of climate analyses","volume":"31","author":"Docquier","year":"2024","journal-title":"Nonlin. Process. Geophys."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"3455","DOI":"10.5194\/hess-30-3455-2026","article-title":"Cause-effect discovery in hydrometeorological systems: Evaluation of causal discovery methods","volume":"30","author":"Yadav","year":"2026","journal-title":"Hydrol. Earth Syst. Sci."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"2011","DOI":"10.1109\/TPAMI.2019.2913372","article-title":"Squeeze-and-excitation networks","volume":"42","author":"Hu","year":"2020","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Lin, T.-Y., Goyal, P., Girshick, R., He, K., and Doll\u00e1r, P. (2017, January 22\u201329). Focal loss for dense object detection. Proceedings of the 2017 IEEE International Conference on Computer Vision (ICCV), Venice, Italy.","DOI":"10.1109\/ICCV.2017.324"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"100699","DOI":"10.1016\/j.iot.2023.100699","article-title":"A deep learning approach for intrusion detection in Internet of Things using focal loss function","volume":"22","author":"Dina","year":"2023","journal-title":"Internet Things"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Cui, Y., Jia, M., Lin, T.-Y., Song, Y., and Belongie, S. (2019, January 15\u201320). Class-balanced loss based on effective number of samples. Proceedings of the 2019 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00949"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE Access"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"3962","DOI":"10.1109\/JIOT.2021.3102056","article-title":"X-IIoTID: A connectivity-agnostic and device-agnostic intrusion data set for Industrial Internet of Things","volume":"9","author":"Sitnikova","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_49","first-page":"88","article-title":"A dataset to support research in the design of secure water treatment systems","volume":"Volume 10242","author":"Goh","year":"2017","journal-title":"Critical Information Infrastructures Security"},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"9831","DOI":"10.1038\/s41598-025-94624-8","article-title":"Advanced intrusion detection in Internet of Things using graph attention networks","volume":"15","author":"Ahanger","year":"2025","journal-title":"Sci. Rep."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5865\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,21]],"date-time":"2026-09-21T04:28:33Z","timestamp":1789964913000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5865"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,16]]},"references-count":50,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185865"],"URL":"https:\/\/doi.org\/10.3390\/s26185865","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,16]]}}}