Internet of Things (IoT) has managed to pervade numerous domains from home automation to industries with crucial frameworks. The contributions of IoT are wide enough started from attaining the final cases or complementing/exchanging the processes involved in industrial control systems. The extensive applicability of IoT gadgets allows the industrial technologies to flourish, in industries with less technical maturity. Few appropriate instances are linked with exploitation of oil and electricity production while both the domains are straightforwardly linked with national cyberdefence [1]. Industrial Internet of Things (IIoT) combines multiple players such as sensors, gadgets, and physical machineries with internet. Then, it utilizes software to conduct deep analytics and convert huge volumes of both structured and unstructured data into powerful insights and information [2]. IIoT emphasizes the application of IoT in manufacturing zones since there is a growing interest among researchers to involve Machine-to-Machine (M2 M) transmission, big data, and Machine Learning (ML) in industry settings. IoT can also be applied in some other domains such as linking wastewater systems and manufacturing of robots, flow gauges, electric meters and other connected systems, and industrial gadgets. With the incorporation of IIoT, institutions as well as manufacturing hubs gain high efficiency and dependability upon its works [3]. Since IoT is capable of linking multiple gadgets with internet, it allows the identification of distinct threats to perform anomalous actions. There is an increasing number of loopholes and susceptibilities found in the protocol utilized by IIoT structure. If it encounters risks, sophisticated attacks can be made at IIoT environment using multiple methods [4]. The intentions of an attacker are multitude in nature such as gaining access to appropriate data, money theft, and source corruption [5].

IoT gadgets have special features with regard to transmission. So, whenever there is an attack made, it tends to provoke the decentralized assaults on any kind of structures [6]. These are the difficulties faced in designing an identification algorithm for IoT which are well known in traditional networks [7,8]. The main goal of machine learning technique is to empower the technologies so that it learns and performs estimation based on the information scheduled earlier. Though the usage of ML in identifying anomalous conduct is an established process, intruder identification domain has been mostly untouched [9]. In conventional techniques, anomaly recognition has been performed by statistical methodologies. Therefore, the increasing penetration of ML methods has unlocked new probabilities for the identification of outlier information, thanks to the accessibility of huge volume of information which might be leveraged using ML methods. In this perspective, such ML methods provide an alluring viewpoint to be applied in IoT application zones. It is challenging to make use of stationary models in this regard [10].

Aboelwafa et al. [11] proposed a novel attack detection methodology via Autoencoder (AE). The study exploited the sensor data in correlation with time and space to sequentially recognize the fabricated dataset. Furthermore, the fabricated dataset is refined by Denoising AE (DAE). The DAE dataset was cleaned in an efficient manner and produced clean datasets from the corrupted (attacked) information. Hassan et al. [12] developed a down sampler-encoder-based collective dataset generator. This model was to ensure the effective collection of real distribution of the attack model for large-scale IIoT attack surfaces. The presented downsampler-based data generator is upgraded simultaneously and confirmed at the time of training Deep Neural Network (DNN) discriminators so as to ensure robustness.

Qureshi et al. [13] presented a secure and novel architecture for identification of security threats in RPL-based IoT and IIoT systems. The presented architecture possesses the ability to identify Version number, HELLO-Flood, Blackhole, and Sinkhole attacks. Hassan et al. [14] enhanced the reliability of IIoT systems using a scalable and reliable cyberattack recognition method i.e., Supervisory Control and Data Acquisition (SCADA) technique. To be specific, an ensemble-learning method, related to the integration of Random Subspace (RS) learning model using Random Tree (RT), was presented to identify SCADA cyberattacks o through network traffic from SCADA-related IIoT architecture. The researchers in the literature [15–19] developed a detection module based on Stacked Variation Auto-Encoder (VAE) with Convolution Neural Network (CNN). This model has the capability to learn about hidden architecture of the scheme’s activity and reveal its ransomware behaviour. Furthermore, a data augmentation technique was proposed based on VAE to generate a novel dataset that can be utilized in training a system and to improve the generalized abilities of the presented method.

The current study develops an AI-based Threat Detection and Classification model for IIoT, named AITDC-IIoT model. The presented AITDC-IIoT model initially pre-processes the input data and transforms it into a compatible format. Then, Whale Optimization Algorithm-based Feature Selection (WOA-FS) model has been involved to elect the subset of features. Moreover, Cockroach Swarm Optimization (CSO) is employed with Random Vector Functional Link network (RVFL) model for classification of threats. Finally, CSO algorithm is applied to appropriately adjust the parameters involved in RVFL model. The performance of the proposed AITDC-IIoT model was validated using benchmark datasets.

In this study, a new AITDC-IIoT model has been developed for proficient threat detection and classification using IIoT. The presented AITDC-IIoT model initially pre-processes the input data to convert it into a compatible format. Followed by, WOA-FS model is applied to elect the subset of features. At last, CSO is employed with RVFL model for classification of threats. Fig. 1 depicts the overall block diagram of AITDC-IIoT technique.

In this section, the proposed AITDC-IIoT model was experimentally validated using N-BaIoT dataset [27]. The dataset holds 76,200 samples under 9 class labels which are given in Tab. 1.

Fig. 3 demonstrates the set of confusion matrices generated by the proposed AITDC-IIoT model on test dataset. The figures imply that the proposed AITDC-IIoT model effectively recognized all the nine classes in the applied dataset.

Tab. 2 illustrates the results offered by AITDC-IIoT model on threat classification in IIoT environment. The results indicate that the proposed AITDC-IIoT model gained significant results under all the classes. For instance, with entire dataset, the proposed AITDC-IIoT model categorized benign classes with accuy, precn, recal, Fscore, and Mathew Correlation Coefficient (MCC) values such as 99.28%, 99.87%, 99.02%, 99.44%, and 98.43% respectively. Simultaneously, with entire dataset, the AITDC-IIoT method categorized TCP class with accuy, precn, recal, Fscore, and MCC values such as 99.82%, 97.83%, 98.09%, 97.96%, and 97.86% respectively. Concurrently, with 70% of TR dataset, the presented AITDC-IIoT approach categorized benign classes with accuy, precn, recal, Fscore, and MCC values such as 99.27%, 99.87%, 99.01%, 99.44%, and 98.41% correspondingly. Meanwhile, with 70% of TR dataset, the proposed AITDC-IIoT system categorized TCP class with accuy, precn, recal, Fscore, and MCC values such as 99.82%, 98.04%, 97.91%, 97.98%, and 97.88% respectively. Eventually, with 30% of TS dataset, AITDC-IIoT model categorized benign class with accuy, precn, recal, Fscore, and MCC values such as 99.83%, 97.58%, 98.53%, 98.05%, and 97.96% correspondingly.

Fig. 4 demonstrates the average threat classification outcomes achieved by the proposed AITDC-IIoT model. Upon entire dataset, AITDC-IIoT model achieved average accuy, precn, recal, Fscore, and MCC values such as 99.75%, 97.43%, 98.68%, 98.05%, and 97.85% respectively. Moreover, on 70% of TR dataset, the proposed AITDC-IIoT technique offered average accuy, precn, recal, Fscore, and MCC values such as 99.75%, 97.35%, 98.63%, 97.98%, and 97.78% correspondingly. Furthermore, on 30% of TS dataset, the presented AITDC-IIoT model provided average accuy, precn, recal, Fscore, and MCC values such as 99.83%, 97.58%, 98.53%, 98.05%, and 97.96% correspondingly.

A brief precision-recall analysis was conducted upon AITDC-IIoT approach on test dataset and the results are depicted in Fig. 5. As per the figure, it is clear that the proposed AITDC-IIoT method accomplished maximum precision-recall performance under different number of class labels.

Training Accuracy (TA) and Validation Accuracy (VA) values, attained by AITDC-IIoT model on test dataset, are demonstrated in Fig. 6. The experimental outcome imply that AITDC-IIoT model gained the maximum TA and VA values. To be specific, VA seemed to be higher than TA.

Training Loss (TL) and Validation Loss (VL) values, achieved by the proposed AITDC-IIoT technique on test dataset, are portrayed in Fig. 7. The experimental outcomes infer that AITDC-IIoT model achieved the least TL and VL values. To be specific, VL seemed to be lower than TL.

In order to validate the supremacy of the proposed AITDC-IIoT model, a detailed comparative analysis was performed against existing models and the results are shown in Tab. 3 [28].

Fig. 8 illustrates the comparative examination results of AITDC-IIoT model and other existing methods in terms of precn. The experimental values indicate that Cu-DNN-long Short Term Memory (LSTM) model achieved ineffectual outcome with the least precn of 94.91%. Followed by, Gated Recurrent Unit (GRU)-Recurrent Neural Network (RNN), AutoEncoders-EDSA, Multi-CNN, Cu-LSTMGRU-Cu-BLSTM, and Cu-DNN-GRU models produced reasonably closer precn values such as 96.75%, 96.36%, 96.79%, 96.99%, and 96.11% respectively. However, the proposed AITDC-IIoT model accomplished an enhanced performance with a maximum precn of 97.58%.

Fig. 9 showcases the comparative analysis results achieved by the proposed AITDC-IIoT model and other existing methods in terms of recal. The experimental values indicate that Cu-DNN-LSTM model showcased ineffectual outcomes with a minimal recal of 97.70%. Next, GRU-RNN, AutoEncoders-EDSA, Multi-CNN, Cu-LSTMGRU-Cu-BLSTM, and Cu-DNN-GRU models produced reasonably closer recal values such as 94.40%, 95.59%, 97.65%, 98.12%, and 97.01% correspondingly. But, the proposed AITDC-IIoT model accomplished an enhanced performance with a maximum recal of 97.58%.

Fig. 10 depicts the comparative investigation results attained by the proposed AITDC-IIoT approach and other existing methods in terms of accuy. The experimental values infer that Cu-DNN-LSTM model achieved ineffectual outcome with the least accuy of 98.86%. Likewise, GRU-RNN, AutoEncoders-EDSA, Multi-CNN, Cu-LSTMGRU-Cu-BLSTM, and Cu-DNN-GRU models produced reasonably closer accuy values such as 96.87%, 97.24%, 99.11%, 99.47%, and 99.16% correspondingly. However, the proposed AITDC-IIoT model accomplished enhanced performance with a maximum accuy of 99.83%.

Fig. 11 demonstrates the comparative analysis results achieved by AITDC-IIoT system and other existing systems in terms of Fscore. The experimental values imply that Cu-DNN-LSTM algorithm attained ineffectual outcome with a minimal Fscore of 97.51%. Along with that, GRU-RNN, AutoEncoders-EDSA, Multi-CNN, Cu-LSTMGRU-Cu-BLSTM, and Cu-DNN-GRU techniques produced reasonably closer Fscore values such as 97.88%, 97.41%, 96.81%, 97.95%, and 97.57% respectively. At last, the proposed AITDC-IIoT methodology accomplished an enhanced performance with a maximum Fscore of 98.05%.

Based on the results and discussion made above, it is apparent that the proposed AITDC-IIoT model is an excellent performer in terms of threat detection and classification compared to the existing techniques.

In this study, a new AITDC-IIoT model has been developed for proficient threat detection and classification. The presented AITDC-IIoT model initially pre-processes the input data so as to convert it to a compatible format. Followed by, WOA-FS model is involved to elect the subset of features. Moreover, CSO is employed with RVFL model for threat classification. Finally, CSO algorithm is applied to appropriately adjust the parameters related to RVFL model. The performance of the proposed AITDC-IIoT model was validated under benchmark datasets. The experimental results established the supremacy of the proposed AITDC-IIoT technique over recent approaches. Thus, AITDC-IIoT model can be employed for effectual threat detection and classification in IIoT environment. In future, the performance of the model can be enhanced by including outlier detection and clustering processes.