EdgeIIoTset IIoT IDS Benchmark

• EdgeIIoTset is an Industrial IoT intrusion-detection benchmark featuring heterogeneous network traffic, multiclass attack recognition, and low-latency inference.
• It is collected from a 7-layer IIoT testbed with 10 smart devices, offering detailed class taxonomies and severe class imbalances across millions of records.
• Multiple modeling paradigms, including hybrid deep learning, autoencoder pipelines, and layered open-set frameworks, demonstrate its versatility for adaptive IDS research.

Searching arXiv for the cited EdgeIIoTset-related papers to ground the article in current literature. EdgeIIoTset is an Industrial Internet of Things intrusion-detection benchmark that recent arXiv studies use to evaluate IDS behavior under heterogeneous traffic, severe class imbalance, multiclass attack recognition, low-latency inference, and adaptation to previously unseen threats. In current work it functions variously as a cross-domain industrial counterpart to medical IoT benchmarks, as the main dataset for lightweight edge-deployable classifiers, and as the sole testbed for layered open-set and incremental-learning frameworks (Gueriani et al., 17 Aug 2025, Hasan et al., 25 Jan 2025, Lian et al., 27 Feb 2026).

1. Benchmark role in contemporary IIoT security research

In recent literature, EdgeIIoTset occupies a central position as an evaluation substrate for IIoT IDS design. One study uses it as the main industrial IoT benchmark to test whether a hybrid deep model generalizes beyond medical IoT traffic, pairing EdgeIIoTset with CICIoMT2024 to support a cross-domain robustness claim. The same work also notes broader testing on TON_IoT, while retaining EdgeIIoTset as the core industrial benchmark (Gueriani et al., 17 Aug 2025).

A second line of work uses Edge-IIoTset as the main dataset for a lightweight IDS pipeline based on autoencoder feature learning and Decision Tree classification. There the dataset is treated as a realistic, comprehensive, imbalanced IIoT security benchmark whose operational value lies not only in offline classification performance but also in edge deployability, including inference on a Jetson Nano (Hasan et al., 25 Jan 2025).

A third study makes Edge-IIoTset the sole benchmark for a multi-layer framework, MI$^2$DAS. In that formulation, the dataset is not merely a final evaluation corpus: it is the basis for four distinct tasks—coarse anomaly filtering, open-set separation of known versus unknown attacks, fine-grained multiclass classification, and incremental incorporation of novel attack categories. This usage foregrounds the dataset’s suitability for adaptive IDS workflows rather than only closed-set supervised learning (Lian et al., 27 Feb 2026).

2. Reported structure, scale, and attack taxonomy

Recent papers describe EdgeIIoTset in overlapping but not identical ways. One study characterizes it as collected from a 7-layer IIoT testbed, containing 10 smart devices, 14 attack types across 6 categories, and 61 selected features out of 1,176 (Gueriani et al., 17 Aug 2025). Another describes Edge-IIoTset as having 2.2 million records, a Seven-layer, ten-device setup, and 61 detection-enhancing features, while also reporting a class-distribution table over 1,927,304 total records (Hasan et al., 25 Jan 2025). A third states that the full dataset contains about 20 million records, and that experiments follow the official Edge-IIoTset train/test partition, exemplified by the normal class with 24,301 total samples split into 19,281 train and 4,820 test (Lian et al., 27 Feb 2026).

Source	Reported representation	Reported scale
(Gueriani et al., 17 Aug 2025)	7-layer IIoT testbed, 10 smart devices, 61 selected features out of 1,176	14 attack types across 6 categories
(Hasan et al., 25 Jan 2025)	Seven-layer, ten-device setup, 61 detection-enhancing features	2.2 million records; table over 1,927,304 total records
(Lian et al., 27 Feb 2026)	53 features after removing eight topology-dependent features	About 20 million records; official train/test partition

The detailed class taxonomy reported in MI$^2$DAS comprises Backdoor, DDoS_HTTP, DDoS_ICMP, DDoS_TCP, DDoS_UDP, Fingerprinting, MITM, Password, Port Scanning, Ransomware, SQL Injection, Uploading, Vulnerability Scan, and XSS attack, in addition to normal traffic (Lian et al., 27 Feb 2026). The class-distribution table reproduced in the lightweight IDS study lists Normal: 1,380,858 (71.65%), followed by attack classes including DDoS_UDP: 121,567, DDoS_ICMP: 67,939, SQL_injection: 50,826, DDoS_TCP: 50,062, Vulnerability: 50,026, Password: 49,933, DDoS_HTTP: 49,203, Uploading: 36,915, Backdoor: 24,026, Port_Scanning: 19,983, XSS: 15,066, Ransomware: 9,689, Fingerprinting: 853, and MITM: 358 (Hasan et al., 25 Jan 2025).

The imbalance profile is repeatedly emphasized. One paper identifies Fingerprinting: 0.04% and MITM: 0.02% as especially rare classes, using these statistics to motivate imbalance-aware training (Hasan et al., 25 Jan 2025). Another uses smaller official-partition counts to motivate a layered design in which open-set routing and incremental updates are necessary because some classes are sparsely represented (Lian et al., 27 Feb 2026). This suggests that published EdgeIIoTset results often depend on the specific dataset version, partition, or filtered representation under study.

3. Preprocessing and feature-space construction

EdgeIIoTset is not processed uniformly across studies. In the BiGAT-ID work, the reported pipeline includes Data cleaning, Label encoding using LabelEncoder, Reshaping features into 3D matrices, Class imbalance handling using SMOTE, 80/20 train-test split using train_test_split with stratified sampling, One-hot encoding of labels using to_categorical, and training with focal loss also discussed as a way to emphasize hard/minority samples. For the strongest EdgeIIoTset result, the paper identifies BiGRU + MHA + LSTM with SMOTE + RoS balancing; the IIoT input shape is reported as (60, 1), and the standard training setup uses the Adam optimizer with categorical cross-entropy loss (Gueriani et al., 17 Aug 2025).

The lightweight IDS study adopts a different preprocessing regime. It removes irrelevant columns, constant columns, and highly correlated features when correlation > 0.6, then performs numerical encoding and Min-Max scaling to $[0,1]$. Instead of oversampling, it uses a cost-sensitive autoencoder with class weights inversely proportional to class frequency, explicitly stating that it does not rely on oversampling or synthetic augmentation. The encoder and decoder are given as

$h = f(x) = \sigma(Wx + b)$

and

$\hat{x} = g(h) = \sigma(W'h + b'),$

with weighted reconstruction loss

$$L = \frac{1}{N} \sum_{i=1}^{N} w_{y_i} (x_i - \hat{x}_i)^2.$$

The feature space is compressed from 24 dimensions to a 6-dimensional bottleneck layer (Hasan et al., 25 Jan 2025).

MI$^2$DAS performs a third type of preprocessing. It removes eight topology-dependent features such as IP-related fields to reduce overfitting and improve generalization, leaving 53 features derived from both network flow statistics and IoT protocol-level interactions. For anomaly-detection experiments in Layer 1, it constructs balanced test subsets containing 1,000 normal + 1,000 attack samples and 5,000 normal + 5,000 attack samples. For later stages it builds multiple known/unknown attack partitions to simulate varying degrees of prior knowledge (Lian et al., 27 Feb 2026).

Taken together, these pipelines show that EdgeIIoTset supports sequence models, tabular classifiers, anomaly detectors, and semi-supervised updates, but they also indicate that feature counts, balancing strategies, and even task definitions differ materially across papers.

4. Modeling paradigms built on EdgeIIoTset

One prominent EdgeIIoTset-based architecture is BiGAT-ID, described as a hybrid IDS combining a bidirectional GRU, an LSTM branch, and multi-head attention. The reported EdgeIIoTset configuration uses a BiGRU layer with 64 units, an LSTM layer with 32 units, and 8 attention heads with key dimension 64. After fusion, the branches feed Dense 64 ReLU, Dense 32 ReLU, and Final Dense 6 softmax layers. In this formulation, EdgeIIoTset is treated as a sequential modeling problem in which bidirectional temporal dependencies, longer-range signatures, and contextual salience are all explicit architectural targets (Gueriani et al., 17 Aug 2025).

A contrasting paradigm is the lightweight pipeline centered on autoencoder-based feature learning and a Decision Tree classifier. The paper evaluates both a binary classification setup—Normal versus Attack—and a multiclass task consisting of Normal plus the 14 attack categories. The autoencoder is framed as a deterministic and computationally inexpensive dimensionality-reduction stage, while the Decision Tree is selected for strong predictive performance and edge suitability. The same study extends the methodology to deployment on a Jetson Nano with 128-core Maxwell GPU and 1.43 GHz Quad-core ARM A57 CPU (Hasan et al., 25 Jan 2025).

MI$^2$DAS uses Edge-IIoTset in a layered pipeline rather than a single model. Its first Data Pooling Module (DPM) separates Normal traffic from Attack traffic under both Novelty detection and Outlier detection settings, using OC-SVM, GMM, and LOF. The second DPM layer performs open-set recognition to route traffic into a Known Attack Traffic pool or an Unknown Attack Pool, comparing GMM, LOF, OC-SVM, and IF (Isolation Forest) over five knowledge configurations: 1 known / 13 unknown, 4 known / 10 unknown, 7 known / 7 unknown, 10 known / 4 unknown, and 13 known / 1 unknown. The Attack Classification Module (ACM) then classifies known attacks using k-NN, SVM, Logistic Regression (LR), Random Forest (RF), XGBoost, and LightGBM. Finally, the Incremental Attack Update Module uses self-training, label propagation, label spreading, and active learning with uncertainty sampling to integrate novel attack classes without retraining from scratch (Lian et al., 27 Feb 2026).

This variety of modeling paradigms makes EdgeIIoTset useful for evaluating not only closed-set multiclass classification but also anomaly detection, open-set routing, and continual adaptation.

5. Reported empirical performance on EdgeIIoTset

The reported results on EdgeIIoTset span near-ceiling closed-set classification, lightweight edge inference, and layered adaptive detection.

Study	Setting	Key reported result
(Gueriani et al., 17 Aug 2025)	BiGAT-ID on EdgeIIoTset	Accuracy 99.34%, Loss 0.0158, FPR 0.0013, Precision/Recall/F1 99.34%, 0.0001 sec/instance
(Hasan et al., 25 Jan 2025)	Autoencoder + Decision Tree multiclass	Accuracy 0.9994, Macro/Weighted F1 0.9994, Geo Mean 0.9997, Test Time 0.0124 s, Jetson Nano 0.187 ms
(Lian et al., 27 Feb 2026)	MI$^2$DAS layered framework	Layer 1 GMM Accuracy 0.953, TPR 1.000; Layer 3 RF Macro-F1 0.941 ± 0.054; Layer 4 Macro-F1 0.9133

For BiGAT-ID, the abstract reports Accuracy = 99.34% and Inference time = 0.0001 s per instance on IIoT traffic, and Table 6 gives Loss = 0.0158, Precision = 99.34%, Recall = 99.34%, F1-score = 99.34%, and FPR = 0.0013. Its best balanced configuration is identified as #4: (BiGRU64 + MHA8) - LSTM32, with accuracy improving from 99.04% before balancing to 99.34% after balancing, while FPR = 0.0013 remains unchanged. The paper also reports a classification summary on 59,276 validated samples, with 100% F1 for MITM and Malware, 97–99% F1 on the other attack classes, and AUC = 1.00 for all six classes. Confusion-matrix discussion highlights Normal traffic: TPR = 100%, MITM: 100% accuracy, Information gathering: 100% accuracy, Malware: 100% accuracy, DDoS: 99% accuracy with 1% misclassified as injection, and Injection: 97% accuracy with 3% misclassified as DDoS (Gueriani et al., 17 Aug 2025).

The same study compares BiGAT-ID against several EdgeIIoTset baselines: CNN-LSTM: 98.68% accuracy, Attention-based LSTM/CNN: F1 = 99.04%, FPR = 0.002, BiGRU-LSTM: 98.32% accuracy, FPR = 0.046, CNN-GRU: 98.70% accuracy, FPR = 0.7, CNN-LSTM-GRU: 97.44% accuracy, and BiGRU-CNN: 94.7% accuracy. Within that comparison, BiGAT-ID is reported as higher in accuracy and lower in false positives while also supplying per-instance inference-time measurements (Gueriani et al., 17 Aug 2025).

In the lightweight IDS paper, the headline multiclass result is the Decision Tree with 99.94% accuracy, 99.94% precision, 99.94% recall, 99.94% F1 score, and 0.9997 geometric mean, with very fast test time: 0.0124 s. The binary Decision Tree confusion matrix is reported as TP = 4817, FP = 3, FN = 2, and TN = 25618. The paper also notes that LGBM achieves perfect binary classification metrics, but does not present it as the main deployment model. On Jetson Nano, the best-performing models achieve total inference time: 5.62 s and average per instance: 0.184 ms for binary classification, and total inference time: 5.70 s with average per instance: 0.187 ms for multiclass classification (Hasan et al., 25 Jan 2025).

MI$^2$DAS reports lower closed-set scores than the two highly optimized supervised pipelines, but it addresses harder settings. In Layer 1, the best GMM novelty-detection configuration yields Accuracy = 0.953, TPR = 1.000, FPR = 0.095, and Precision = 0.914; in the outlier-detection setting, the best GMM obtains Accuracy = 0.944, TPR = 1.000, FPR = 0.112, and Precision = 0.899. For open-set recognition, GMM achieves mean recall 0.813 ± 0.086 for known attacks, while LOF achieves 0.882 ± 0.080 recall for unknown attacks. In fine-grained known-attack classification, Random Forest reaches Macro-F1 = 0.941 ± 0.054, Weighted-F1 = 0.944 ± 0.056, Macro-Accuracy = 0.950 ± 0.048, and Micro-Accuracy = 0.949 ± 0.050. In incremental learning, the best one-step result is self-training with Macro-F1 = 0.8970 ± 0.0089 for 13 known attacks, while the best multi-step result occurs at the first step 4K+10U with Macro-F1 = 0.9133, Balanced Accuracy = 0.9230, and Accuracy = 0.9215 (Lian et al., 27 Feb 2026).

6. Methodological significance and recurring interpretive issues

EdgeIIoTset is repeatedly used to study three IIoT IDS difficulties that simpler benchmarks often understate: severe imbalance, heterogeneous feature spaces, and evolving attack sets. The lightweight IDS paper explicitly argues that practical models must be accurate on both majority and minority classes, efficient enough for edge deployment, and robust to imbalance and multiclass complexity; its use of a class-weighted autoencoder and Jetson Nano timing directly reflects that agenda (Hasan et al., 25 Jan 2025). MI$^2$0DAS treats the dataset as evidence that traditional IDS pipelines struggle when labeled data are limited and previously unseen attacks appear, motivating anomaly detection, open-set recognition, and incremental learning as linked stages rather than isolated modules (Lian et al., 27 Feb 2026).

A recurrent interpretive issue is that EdgeIIoTset results are not automatically comparable across papers. One study uses a Final Dense 6 softmax and reports AUC = 1.00 for all six classes on 59,276 validated samples; another evaluates Normal plus the 14 attack categories; a third follows the official Edge-IIoTset train/test partition, removes eight topology-dependent features, and constructs multiple known/unknown partitions for open-set and incremental experiments (Gueriani et al., 17 Aug 2025, Hasan et al., 25 Jan 2025, Lian et al., 27 Feb 2026). This suggests that differences in class granularity, sample partitioning, feature filtering, and balancing strategy can materially affect reported performance.

Another recurring issue is metric selection under imbalance. The papers do not rely solely on accuracy: they report FPR, precision, recall, F1-score, macro-F1, weighted-F1, balanced accuracy, micro-accuracy, macro-accuracy, AUC, geometric mean, and inference time. That choice is methodologically consequential because rare classes such as Fingerprinting and MITM can be obscured by dominant normal traffic if only aggregate accuracy is considered (Hasan et al., 25 Jan 2025). A plausible implication is that EdgeIIoTset has become valuable not merely because it is large or heterogeneous, but because it forces explicit treatment of the trade-offs among minority-class sensitivity, false alarms, real-time latency, and adaptation to novel attacks.