Lightweight and Flexible Intrusion Detection System to Protect Industrial IoT Settings

The increasing exposure of the Industrial Control Systems (ICS) and Industrial Internet of Things
(IIoT) environments to cyber threats is connected with the proliferation of obsolete industrial
protocols, the lack of computational capabilities, and the extended integration of the Information
Technology (IT) and Operational Technology (OT) environments. The conventional intrusion
detection systems do not work well in such an environment because they are not protocol-aware, are
not cheap in terms of computation, and are not capable of operating under the strict real-time
requirements. In order to overcome these issues, this paper offers a flexible and lightweight hybrid
intrusion detection system that is specially created to be used in industrial networks. The suggested
system will integrate protocol-based rule-based detection with machine-based anomaly detection to
detect known and unknown cyberattacks. It uses deep packet inspection and time-based statistic
feature extraction to record the behavior of industrial traffic, and model optimization technology can
be used to effectively deploy to edge devices that have limited resources. NSL-KDD, UNSW-NB15,
and custom Modbus-TCP are used to evaluate the system with real and realistic industrial conditions
created as a result of a simulated SCADA environment. Experimental results demonstrate that the
proposed hybrid intrusion detection system achieves a detection accuracy of 98.6%, with a low false
positive rate of 1.4%, significantly outperforming standalone rule-based and machine-learning
approaches. Precision, recall, and F1-score consistently exceed 97%, confirming reliable intrusion
identification. Moreover, the system has a mean detection latency of less than 8 ms, which meets
the real-time performance of industrial monitoring. Finally, the suggested hybrid IDS provides a
moderate balance between high detection rates and protocol sensitivity, along with low
computational cost, which makes the proposed model a feasible, scalable security tool to be used in
real-life ICS and IIoT implementations.