ABSTRACT

Industrial Internet of Things (IIoT) networks are attractive targets for reconnaissance, botnet enlistment, and protocol abuse. In practice, intrusion detection systems (IDS) must operate under severe class imbalance—malicious events are rare relative to normal traffic—making conventional accuracy/ROC metrics misleading and degrading rare-attack recall. This paper presents a comparative evaluation of three strong, widely deployable learners—Support Vector Machines (SVM), Random Forests (RF), and XGBoost—for IIoT intrusion detection on imbalanced data. We build a reproducible pipeline (scikit-learn/xgboost/imbalanced-learn) on two public IIoT-style corpora (CICIDS2017, TON_IoT), evaluate cost-sensitive learning, resampling (SMOTE, Borderline-SMOTE, SMOTE+Tomek), and threshold calibration, and report precision–recall area (PR-AUC), minority-class F1, G-mean, and MCC. Across both datasets, XGBoost with class weighting (scale_pos_weight) or SMOTE+Tomek delivers the best rare-attack detection (CICIDS2017 PR-AUC up to 0.85, minority F1 0.80), followed by Random Forests (PR-AUC 0.81), while SVMs are competitive only with careful kernel/? tuning and often suffer under extreme skew. Ablations show PR-AUC is more faithful than ROC-AUC under imbalance; calibrated decision thresholds outperform default 0.5; and feature sparsification (mutual information + RFE) reduces inference latency with minimal loss. We discuss deployment guardrails—concept-drift monitoring, cost-sensitive rebalancing per site, and protocol-aware features for Modbus/IEC-104. Our findings suggest organizations can achieve robust, interpretable, and efficient IIoT IDS by pairing tree ensembles with imbalance-aware training and PR-centric evaluation, while retaining SVMs for compact, line-speed scenarios with moderate skew.