IIoT traffic features typically exhibit significant cross-scale differences, with large variations across different fields. Such scale differences can make statistical estimation vulnerable to extreme values. Meanwhile, some application-layer fields in heterogeneous protocols have strong protocol specificity. If directly used as input, these fields may cause the model to over-rely on protocol-specific semantics, thereby weakening generalization in cross-domain scenarios. To address these issues, this paper adopts a lightweight feature construction strategy based on LoFT-IIoT [19] to filter and reduce the dimension of the original traffic features. The overall process is shown in Fig. 2.

First, the numerical fields are retained from the original traffic features, while the label column, time column, host identification fields, and sequence-number-like fields that may introduce identity shortcuts are removed. Meanwhile, the protocol-specific fields of MQTT, Hypertext Transfer Protocol (HTTP), Modbus, Domain Name System (DNS), Address Resolution Protocol (ARP), and Internet Control Message Protocol (ICMP) are masked, and only transferable low-level statistical and behavioral features are retained. Subsequently, logarithmic smoothing is performed on the candidate numerical features:(11)fjlog=log⁡(1+|fj|),which compresses scale differences and reduces the influence of extreme values.

Second, the candidate features are classified into three semantic buckets, namely statistics, behavior, and protocol, based on the field semantics. A joint scoring strategy of mutual information and variance is adopted to describe their category discrimination ability and information activity. For the j-th candidate feature fj, the overall score is defined as (12)sj=I(fj;y)⋅Var(fjlog),where I(fj;y) denotes the mutual information between the feature and the class label, and Var(fjlog) denotes the sample variance of the feature in the log domain.

Finally, features are pre-selected within each semantic bucket according to the joint score, and global ranking is then used for supplementation and trimming to obtain the low-dimensional feature subset ℳ for subsequent model training, thereby forming the final feature mapping Φ(⋅).

After obtaining the low-dimensional feature representation, a lightweight MLP, named TrustMLP, is constructed as the source-domain trust evaluator. Let the model parameters be denoted by θsrc. The network consists of an input layer, two hidden layers, and an output layer, with width m→64→32→2, where m is the input dimension after feature selection, as shown in Fig. 3. Batch Normalization (BN) and Rectified Linear Unit (ReLU) activation are introduced after both hidden layers to improve training stability and to provide interfaces for the restricted BN updates used in the subsequent online stage.

Given the input feature z=Φ(x), the model outputs a logits vector gθsrc(z)∈R2. After the Softmax mapping, the predicted probability for class c is obtained as (13)Pθsrc(y=c∣z)=exp⁡(gθsrc,c(z))∑k=01exp⁡(gθsrc,k(z)),c∈{0,1}.

Here, gθsrc,c(z) denotes the logit output of the model for class c. In the binary setting considered in this work, c=0 denotes normal and c=1 denotes attack. Since both the attack risk and the task-level trust score are derived from the same output probability space, no additional scoring head is required, which helps reduce inference overhead.

If the standard cross-entropy loss is directly adopted for source-domain supervised training, the model is prone to output extremely high or low probabilities close to 0 or 1 in the later stage of training, thereby causing an overconfidence problem [20]. For scenarios where a statistical baseline needs to be constructed based on the prediction entropy subsequently, this will cause the entropy values of normal samples to overly concentrate in the low range, weakening the statistical sensitivity of the entropy distribution to domain shifts. Therefore, a label smoothing strategy is introduced in the source-domain offline training stage.

Let the number of classes be C, the smoothing factor be ε, and the ground-truth class be y. The smoothed target value for the k-th class is defined as (14)ykLS={1−ε,k=y,εC−1,k≠y.

Here, ykLS denotes the k-th component of the smoothed label vector, and k is the class index.

Based on this, offline training is completed by minimizing the cross-entropy between the predicted distribution and the soft label distribution. Before the features are input into the model, logarithmic compression and standardization processing are still adopted to eliminate the scale differences among different features. After the offline training is completed, the model parameters with the best performance on the validation set are selected as the source-domain reference model θsrc.

To build the normal reference baseline required for online shift detection in the target domain, predictive entropy is computed only over the normal source-domain sample set 𝒟H after the source-domain reference model has been obtained. The resulting normal-entropy set is (15)ℰH={hθsrc(xis,0)}i=1NH.

Based on the entropy set in Eq. (15), the corresponding empirical distribution function is still defined by Eq. (8).

This distribution characterizes the typical uncertainty structure of the model under normal behavior conditions and can be used as a reference to determine the degree of distribution shift in the target domain during the online phase. It is necessary to emphasize that the entropy baseline constructed in this paper is only derived from normal samples in the source domain and does not include attack samples, in order to reduce the contamination of abnormal samples on the normal reference distribution.

To enhance the statistical matching in the early stage of deployment, this paper introduces an explicit deployment assumption: a short controlled trial period containing normal target-domain traffic is available at the beginning of deployment. The corresponding target-domain normal calibration window is denoted by (16)W0={xiT,0}i=1N0,where W0 is not used for supervised training. Instead, it is used only for target-domain statistical calibration and reference-baseline estimation, and it does not overlap with the online evaluation stream.

In practical IIoT deployment, such a startup window can be collected during system commissioning, scheduled maintenance, device restart, or a short trusted initialization period in which the production process operates under known normal conditions. This assumption does not require attack labels and does not expose target-domain class labels to training or online updates. If a clean startup window cannot be guaranteed, the system should operate in a conservative mode by disabling online updates until operator-confirmed normal traffic is available. The startup-window robustness analysis in Section 4.7 further evaluates this assumption under limited and contaminated calibration data.

At deployment initialization, the collected N0 normal samples form the startup window W0, which is used only for AdaBN-based anchor calibration, target-domain normal-reference estimation, and sample-level threshold initialization.

Based on W0, the BN statistics of the source-domain reference model θsrc are recalibrated to obtain a frozen anchor model:(17)θanc=CalibBN(θsrc,W0),where CalibBN⁡(⋅) denotes a forward-only calibration procedure that updates only the running mean and running variance of BN layers using W0, without modifying the weights of fully connected layers.

The online model is initialized as (18)θ0=θsrc.

Meanwhile, in the low-dimensional feature space, the mean vector and covariance matrix of the target-domain normal reference are estimated from W0 as (19)μT=1N0∑i=1N0Φ(xiT,0),and (20)ΣT=Cov({Φ(xiT,0)}i=1N0).

These statistics are used later for sample-level protection in high-risk stages.

Next, W0 is partitioned into calibration mini-batches {ℬk(0)}k=1K0. Here, K0 is determined by the startup-window size and the online batch size. The hyperparameter adabn_calib_batches is implemented as a maximum calibration cap Kmax, rather than a requirement that exactly Kmax mini-batches must exist. The effective number of AdaBN calibration mini-batches is therefore (21)Kcal=min(Kmax,K0).

In the main setting, N0=1000 and the online batch size is 256, so K0=⌈1000/256⌉=4. Thus, when Kmax=20, AdaBN calibration uses all available four startup mini-batches.

For the k-th calibration batch, its log-domain batch volatility is defined as (22)vk=1m∑ℓ=1mVarx∈ℬk(0)⁡(fℓlog(x)),where fℓlog(x) denotes the log-smoothed value of the ℓ-th retained feature for sample x.

Accordingly, the volatility baseline of the target-domain normal window is estimated by (23)μv=1K0∑k=1K0vk,σv=1K0∑k=1K0(vk−μv)2.

In addition, based on the Mahalanobis-distance distribution of samples in W0 to the target-domain normal-reference center, a quantile threshold τout for strong-outlier protection and a score threshold τs for subsequent selective fallback are further estimated.

In the online stage, target-domain traffic arrives batch by batch. For the current batch defined in Eq. (7), the predictive entropy of each sample is first computed using the current online model θt, and its empirical cumulative distribution function F^t(h) is constructed as in Eq. (9). This empirical distribution is then compared with the source-domain normal-entropy baseline FH(h), and the Kolmogorov–Smirnov (KS) statistic is used to quantify their discrepancy, namely, the shift measure Δt defined in Eq. (10).

When Δt is small, the current batch remains close to the source-domain normal reference in terms of model-uncertainty structure. Conversely, a large Δt indicates that the current input has significantly deviated from the normal reference distribution. Therefore, Δt serves as evidence for identifying potential domain change during the online target-domain stage.

Relying solely on entropy-distribution shift detection may still be affected by local noisy samples and short-term abnormal fluctuations. To improve decision robustness, we further introduce a batch-volatility statistic. Let the log-domain value of the ℓ-th retained feature for the j-th sample in the current batch ℬt be denoted by ft,j(ℓ),log. The average log-domain volatility of the current batch is defined as (24)vt=1m∑ℓ=1mVarj=1,…,bt⁡(ft,j(ℓ),log),where m is the dimension of the retained low-dimensional feature space, and Varj=1,…,bt⁡(⋅) denotes the sample variance over the current batch.

Based on the normal volatility baseline (μv,σv) in Eq. (23), the SafeBrake risk-gating rule is defined as (25)Statet={NoShift,Δt≤τKS,LowRiskShift,Δt>τKS and vt≤μv+ασv,HighRiskShift,Δt>τKS and vt>μv+ασv,where τKS is the entropy-distribution shift threshold, and α is the volatility adjustment coefficient. When significant entropy shift and abnormal batch volatility occur simultaneously, the current batch is judged as a high-risk shift and SafeBrake is triggered. If a significant shift is detected but the batch volatility remains within the normal range, the batch is judged as a low-risk shift. If Δt does not exceed the threshold, the batch is regarded as remaining in a no-shift state.

When the current batch is determined to have a low-risk deviation, we adopt a restricted online update strategy to improve adaptation to target-domain data. Specifically, only the learnable affine parameters of the BN layers are updated, while all other weights are frozen. Let the set of learnable BN parameters at time t be denoted by ΘBN,t. The optimization objective is defined as (26)Lt=Lalign+λpLprior+λbLreg,where Lalign is the entropy-quantile alignment term, Lprior is the attack-ratio prior constraint, Lreg is the BN-parameter regularization term, and λp and λb are weighting coefficients.

The entropy-quantile alignment term is defined as (27)Lalign=1Q∑k=1Q(e^t,k−e^k)2,e^t,k=F^t−1(qk), e^k=FH−1(qk), qk∈{0.1,0.2,…,0.9},where Q denotes the number of selected quantile points, and F^t−1(⋅) and FH−1(⋅) denote the inverse distribution functions of the current-batch entropy distribution and the source-domain normal-entropy baseline, respectively.

The attack-ratio prior constraint is defined as (28)Lprior=(π^t−πa)2,π^t=1bt∑j=1btPθt(y=1∣Φ(xt,jT)),where π^t is the average attack risk of the current batch, and πa is the attack-ratio prior. The prior πa is not used as a direct estimate of the true attack proportion in the current batch. Instead, it serves as a conservative regularizer in the low-risk update objective, preventing systematic underestimation of attack probabilities under unlabeled conditions.

The BN-parameter regularization term is defined as (29)Lreg=∑ℓ∈ℒBN(‖γℓ,t‖22+‖βℓ,t‖22),where ℒBN denotes the set of all BN layers, and γℓ,t and βℓ,t are the scale and shift parameters of the ℓ-th BN layer, respectively.

Accordingly, the BN-parameter update under low-risk conditions is written as (30)ΘBN,t+1=ΘBN,t−η∇ΘBN,tLt,where η is the learning rate.

When the current batch is judged as a high-risk shift, online updating is suspended, i.e., (31)ΘBN,t+1=ΘBN,t.

Under high-risk conditions, the system enters a protection mode. Based on the calibrated anchor model θanc and the target-domain normal-reference statistics, budgeted selective protection is performed for the current batch. First, the Mahalanobis distance from a sample to the target-domain normal-reference center is computed as (32)dM(x)=(Φ(x)−μT)⊤ΣT−1(Φ(x)−μT),where μT and ΣT are given by Eqs. (19) and (20), respectively.

For strongly outlying samples, the anchor-model output is directly used instead. Let the strong-outlier set be (33)𝒪t={x∈ℬt∣dM(x)≥τout},where τout is the strong-outlier threshold. The attack risk given by the anchor model is defined as (34)ranc(x)=Pθanc(y=1∣Φ(x)).

For the remaining samples, a budgeted selective-fallback mechanism is further constructed. In the final configuration, only samples predicted as normal by the online model and not identified as strong outliers are considered for arbitration. The candidate set is therefore defined as (35)𝒞t={x∈ℬt∣rt(x)<0.5, dM(x)<τout}.

To measure the necessity of correcting the current sample by the anchor model, the following score is defined:(36)st(x)=arank01(logit⁡(ranc(x)))+brank01(logit⁡(ranc(x))−logit⁡(rt(x)))+crank01(dM(x)),where rank01⁡(⋅) denotes rank-based normalization to the interval [0,1] within the candidate set, logit⁡(p)=log(p/(1−p)), and a, b, and c are weighting coefficients.

The fallback-eligible subset and the selective-fallback budget are then defined as (37)𝒞~t={x∈𝒞t∣ranc(x)≥0.5, st(x)≥τs},kt=⌈ρ|𝒞t|⌉,where τs is the score threshold estimated from the calibration window W0, and ρ∈(0,1) is the budget ratio for selective fallback.

Accordingly, the selective-fallback set is defined as (38)ℛt=TopK(𝒞~t,st,kt),where TopK⁡(⋅) selects the top kt samples in descending order of st(x).

Under the protection mechanism, the final attack risk is defined as (39)r~t(x)={ranc(x),x∈𝒪t∪ℛt,rt(x),otherwise,and the protected task-level trust score and class output are written as (40)T~t(x)=1−r~t(x),y~t(x)=I[r~t(x)≥0.5].

Here, I(⋅) is the indicator function. In the binary setting considered in this paper, y~t(x)=1 denotes attack, while y~t(x)=0 denotes normal.

This mechanism ensures that strongly anomalous samples are preferentially protected by the anchor model, while only a limited number of high-risk samples with model disagreement are selectively corrected under a fixed budget. In this way, the spread of erroneous self-adaptation can be suppressed while the online model still retains its capability to recognize anomalous behavior. For ease of implementation, the startup-window calibration, entropy-shift detection, risk judgment, and constrained maintenance procedures are summarized in Algorithm 1.

The experiments are conducted on the DNN-EdgeIIoT-dataset.csv file from the Edge-IIoTset benchmark proposed by Ferrag et al. [21]. This dataset is collected from network traffic in IIoT environments and contains both normal-behavior samples and multiple categories of attack samples, thereby providing a rich set of traffic features for edge-side security evaluation. In this study, the binary label Attack_label provided by the dataset is adopted as the supervision signal, where Normal is encoded as 0 and Attack is encoded as 1. The attack-type label Attack_type is used only for cross-domain task construction, statistical analysis, and result presentation, and is not involved in model input or online parameter updates. The overall statistics of the dataset are summarized in Table 2.

This paper focuses on the cross-domain behavior distribution shift problem faced by IIoT edge nodes under continuous online streaming conditions. Unlike protocol-only domain definitions, this study defines the cross-domain task as a compound-shift scenario involving both device communication relationships and attack types. In this setting, the normal behavior patterns and attack compositions differ between the source and target domains. The specific data division, online stream construction, and feature configuration are respectively presented in Sections 4.1.2 and 4.1.3.

To ensure fair comparisons among different methods, ablation experiments, and parameter sensitivity experiments, this paper uniformly completes data partitioning, independent startup-window construction, and three-phase online stream pre-generation under the condition of fixed random seeds. Except for the variables under investigation, all experiments reuse the same data partitioning and streaming sequences. The source-domain training set is composed of source-domain normal traffic and source-domain attack samples extracted according to a fixed attack ratio. The normal and attack traffic of the target domain are split at the group level and divided into validation and test sets in a 1:1 ratio to avoid instance-level leakage. The resulting dataset compositions are summarized in Tables 3 and 4.

Before online evaluation, an independent subset W0 is drawn from the pool of target-domain normal samples to construct the deployment startup window, where W0=1000 in the main experiments. This startup window is used only for AdaBN anchor calibration, target-domain normal-reference statistics estimation, and threshold initialization, and does not participate in the subsequent three-phase online evaluation. The online stream consists of an initial normal phase (Phase 1), a perturbation phase (Phase 2), and a recovery phase (Phase 3). The main experiments are conducted on the target-domain test split with settings k=8, r=0.3, πa=0.1, and sample-level arbitration budget ρ=0.01. The main comparison adopts the random-mixing stream with r=0.3, while the extended attack-ratio and burst-injection settings in Table 5 are retained as robustness-oriented implementation settings. In the five-seed main comparison, different random seeds are used to construct or evaluate pre-built target streams; for the burst-injection robustness setting, the seed controls the attack-injection offset in Phase 2. The three-phase streaming settings are listed in Table 5.

After data construction, the raw traffic features are uniformly preprocessed and configured, and all methods share the same preprocessing pipeline and input feature space. For numerical features, the log-compression strategy described in Section 3.2.1 is applied. The standardization parameters are estimated only on the source-domain training set. They are then fixed and applied to the source-domain validation set, target-domain validation set, target-domain test set, the startup window W0, and subsequent online evaluation streams to avoid leakage of target-domain statistical information.

To reduce the model dependence on protocol identifiers, explicit identity information, and protocol-specific fields, the experiments remove the label field, time field, communication-object identifier fields, and various protocol-specific fields, while retaining only general statistical features, behavioral features, and transport-layer-related features. On this basis, following the LoFT-IIoT feature-selection strategy, candidate features are screened on the source-domain training set and the final input dimensionality is determined. Unless otherwise specified, the main experiments adopt k=8 input features. The final retained features are listed in Table 6.

The use of eight retained features is motivated by the trade-off among cross-domain robustness, lightweight edge-side deployment, and avoidance of shortcut learning, rather than by an assumption that eight features are universally sufficient for all IIoT scenarios. During feature construction, label fields, timestamps, communication-object identifiers, and protocol-specific application-layer fields are removed to reduce identity or protocol shortcuts. The retained features cover complementary low-level behavioral evidence, including transport-layer integrity, port and connection patterns, packet-control behavior, packet-length statistics, temporal behavior, connection-state information, and flow-level session association. These categories jointly characterize packet control, timing, length, and connection behavior that remain meaningful under heterogeneous service or protocol shifts. Therefore, the eight-dimensional representation provides sufficient behavioral evidence for the evaluated cross-domain robust dynamic trust task while keeping the TrustMLP model and online BN maintenance lightweight. We do not claim that the same eight features are universally optimal for every deployment; rather, they are selected as a conservative low-dimensional configuration for the studied cross-domain evaluation setting.

To comprehensively evaluate the proposed method under cross-domain continuous online streams, the evaluation criteria are organized into four aspects, namely, overall classification performance, phase-wise streaming behavior, trust-score calibration, and resource overhead. Specifically, the overall classification metrics are used to measure the general detection capability of the model; the phase-wise metrics are introduced to characterize the dynamic behavior of the model during the initial deployment stage, the perturbation stage, and the recovery stage; the calibration metrics are used to evaluate the probabilistic interpretability of the task-level trust score; and the resource-overhead metrics are adopted to assess the feasibility of the proposed method under edge-side deployment conditions. The definitions of all evaluation metrics are summarized in Table 7, while the experimental environment and the main parameter settings are listed in Table 8.

To evaluate generalization beyond Edge-IIoTset, we additionally conduct external validation on the X-IIoTID dataset [22]. Unlike the Edge-IIoTset main experiment, the X-IIoTID experiment adopts a service-holdout cross-domain protocol. The source domain contains multiple source services, while the target domain consists of disjoint Modbus, MQTT, and WebSocket services. The target perturbation stage further includes multiple attack families, including false data injection, MQTT cloud broker subscription, Modbus register reading, scanning vulnerability, and fuzzing. This setting is used to evaluate whether RaL-TTA can maintain dynamic trust evaluation capability under external cross-service distribution shift.

To analyze the main sources of performance improvement during the perturbation stage, this paper constructs three representative ablation settings: removing anchor protection (RaL-TTA w/o Anchor), removing budgeted sample-level safeguard/rollback (BSR; RaL-TTA w/o BSR), and always freezing updates (AlwaysFreeze). The results are summarized in Table 13.

Table 13 shows that simply freezing updates cannot effectively handle cross-domain abnormal perturbations because AlwaysFreeze preserves attack recall but causes a high false-positive rate and poor recovery. The variant without anchor protection is close to the POEM+SafeBrake control, indicating that SafeBrake-style risk gating is the dominant source of false-positive control in the Edge-IIoTset stream. The comparison between RaL-TTA and RaL-TTA w/o BSR further shows that budgeted sample-level rollback has only a limited numerical effect under the main setting. Thus, the ablation study supports a conservative interpretation: risk gating is the primary stabilization mechanism, whereas AdaBN anchor protection and budgeted rollback provide additional safety boundaries for the full trust-evaluation framework rather than serving as the sole source of raw metric gains.

To further illustrate how RaL-TTA operates in the main experiments, Table 14 summarizes the numbers of batches under different risk states and the corresponding maintenance actions across the three-phase online stream.

Table 14 shows that all 12 batches in the perturbation stage are judged as high-risk and therefore enter the protection mode, with no online updates being executed. This indicates that the proposed method prioritizes freezing unreliable adaptation when attack traffic is mixed into the stream. In contrast, updates occur mainly in low-risk batches during the initial normal phase and the recovery phase, showing that RaL-TTA follows a selective online strategy of freezing at high risk and maintaining at low risk.

To verify that the task-level trust scores output in this paper have probabilistic interpretability, we further assess calibration using expected calibration error (ECE), Brier score, and negative log-likelihood (NLL). Table 15 compares the trust-score reliability of RaL-TTA and representative baselines on the target-domain online stream.

Table 15 indicates that Source-Only suffers from large calibration errors after direct transfer to the target domain. During the perturbation stage, RaL-TTA and POEM+SafeBrake both provide substantially better calibration than Source-Only, with POEM+SafeBrake slightly lower on the three calibration metrics. Over the full stream, however, RaL-TTA obtains lower ECE, Brier score, and NLL, suggesting that the full protection-oriented trust-score output improves overall probabilistic reliability across deployment, perturbation, and recovery.