# MI2DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks

arXiv: https://arxiv.org/abs/2602.23846 · HTML: https://mlsanity.com/paper/2602.23846/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 29 references that are in the map.
- First posted on arXiv 27 Feb 2026.

## Builds on (most cited first, 3 of 3)

- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction](https://mlsanity.com/paper/2401.12262/) (2024)
- [Clustered Federated Learning Architecture for Network Anomaly Detection in Large Scale Heterogeneous IoT Networks](https://mlsanity.com/paper/2303.15986/) (2023)

## Abstract (arXiv)

The rapid expansion of Industrial IoT (IIoT) systems has amplified security challenges, as heterogeneous devices and dynamic traffic patterns increase exposure to sophisticated and previously unseen cyberattacks. Traditional intrusion detection systems often struggle in such environments due to their reliance on extensive labeled data and limited ability to detect new threats. To address these challenges, we propose MI2DAS, a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling, open-set recognition to distinguish between known and unknown attacks and incremental learning for adapting to novel attack types with minimal labeling. Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers. In the first layer, GMM achieves superior normal-attack discrimination (accuracy = 0.953, TPR = 1.000). In open-set recognition, GMM attains a recall of 0.813 for known attacks, while LOF achieves 0.882 recall for unknown attacks. For fine-grained classification of known attacks, Random Forest achieves a macro-F1 of 0.941. Finally, the incremental learning module maintains robust performance when incorporation novel attack classes, achieving a macro-F1 of 0.8995. These results showcase MI2DAS as an effective, scalable and adaptive framework for enhancing IIoT security against evolving threats.