Fusing Two AI Detectors Could Catch Zero-Day Attacks on Factory Networks

Industrial networks that run power plants, factories, and water systems are increasingly defended by machine-learning intrusion detectors that boast accuracy figures north of 99 percent. But those headline numbers hide a dangerous blind spot: they are almost always measured in a closed-world setting, where the detector is tested only on the same attack families it saw during training. Real adversaries do not cooperate with that assumption. When a brand-new attack family, a so-called zero-day, appears on the wire, a closed-world classifier has no learned category to assign it to, and the consequences can range from silent failure to a confidently wrong verdict that masks an ongoing breach.

A new study by Zhimin Ren and Yi Bao of Changzhou Vocational Institute of Textile and Garment, published in Cluster Computing, tackles this gap head-on. The researchers asked a deceptively simple question: what actually happens to the celebrated accuracy of industrial Internet of Things (IIoT) intrusion detectors when entire attack categories are removed from training and held out for testing? To find out, they built a rigorous leave-one-attack-category-out evaluation on the full X-IIoTID dataset, a publicly available collection of 820,834 network records spanning connectivity- and device-agnostic traffic for industrial environments. Each round of the protocol trains the detectors on all attack families except one, then tests whether they can still flag the missing family as malicious.

The study compares two philosophically different detectors. The first is a closed-world classifier, the standard workhorse of the field, which learns to sort traffic into known categories. The second is an unsupervised open-set backstop, inspired by the open-set recognition literature pioneered by Scheirer and colleagues, which does not attempt to name every attack but instead models what normal traffic looks like and raises an alarm when something falls outside that envelope. Classic examples of this second family include Isolation Forest, which isolates anomalous points with random partitions, and One-Class SVM, which learns a boundary around the legitimate data distribution.

One of the most striking findings concerns how easily appearances can deceive. At each detector’s own native operating threshold, the closed-world classifier and the open-set backstop appeared to fail on almost entirely disjoint sets of attack families, suggesting that a simple combination of the two would cover each other’s weaknesses. But that apparent complementarity narrowed sharply once the researchers placed both detectors on a matched footing, comparing them at a common 5 percent false-positive rate. In other words, part of the reported complementarity in the literature may be an artifact of comparing detectors at unequal, and often incomparable, operating points rather than a genuine property of the algorithms themselves.

Even after this sobering correction, the case for fusion survived. Ren and Bao trained a lightweight learned fusion policy that adaptively combines the scores of the two detectors, deciding per situation how much weight to give each. Across nine attack families evaluated under the leave-one-category-out protocol, the fused system was best or tied-best on six of them. It significantly outperformed both individual detectors and two established baselines from the literature, Isolation Forest and One-Class SVM, with the difference confirmed by paired bootstrap testing at p less than 0.001. The authors are careful to scope this claim: the comparison covers only these two tested baselines, not the broader open-set intrusion-detection literature, an honesty that is refreshingly rare in a field crowded with inflated benchmarks.

The practical deployment story is equally important for industrial operators. The entire pipeline, including both detectors and the fusion layer, weighs in at under 2 megabytes and scores traffic in sub-millisecond time on server-class hardware. That size and latency profile makes the approach a plausible candidate for resource-constrained edge-gateway clusters, the distributed boxes that sit at the boundary between industrial control systems and the wider network, although the authors note that they did not directly test the system on such hardware. In an era when industrial automation systems face a steadily intensifying threat landscape, as commercial threat reports attest, a detector that is both small and fast enough to sit close to the machines it protects is a meaningful engineering achievement, not merely a benchmark curiosity.

The study then pushes further, asking whether a detector trained on one industrial environment can protect a completely different one. In a genuine cross-dataset transfer experiment, the team trained the system on the ToN-IoT telemetry dataset and tested it zero-shot on X-IIoTID, with no retraining or adaptation whatsoever. The aggregate result was near-chance performance, a humbling outcome that undercuts any fantasy of a universal industrial intrusion detector. Yet the aggregate number concealed strong per-family heterogeneity: some attack families transferred far better than others, meaning the model retained partial, uneven knowledge of certain threat types even across a change of dataset, network topology, and device mix.

More troubling still, the fusion policy itself did not transfer. The learned decision layer that so effectively balanced the two detectors within a dataset turned out to be tuned to the statistical quirks of its training environment, and it lost its advantage when moved to unfamiliar territory. Ren and Bao report this as an honest, unresolved limitation rather than burying it, and that candor matters. It tells practitioners that the fusion approach should currently be treated as a within-site enhancement, to be retrained locally on each network’s own traffic, rather than as a portable artifact that can be shipped from one factory to the next without recalibration.

For the security community, the broader lesson is methodological. The finding that matched operating points erode apparent complementarity echoes a growing body of dataset-centric critiques of IoT and IIoT intrusion-detection research, which have catalogued evaluation biases and realism gaps across the field. Benchmark practices that report a single accuracy figure on a closed-world split, or compare detectors at their default thresholds, can systematically overstate how ready a system is for deployment. The leave-one-attack-category-out protocol used here, applied to the full 820,834-record dataset rather than a curated subsample, offers a template for more honest evaluation, and the authors state that their evaluation code, protocol implementation, and raw per-sample scores are available from the corresponding author upon reasonable request.

None of this means the zero-day problem is solved. The fused detector still fails on a meaningful share of unseen attack families, cross-dataset transfer remains largely unsolved, and the edge-deployment claims rest on a size and latency profile rather than field trials. But the study moves the conversation in the right direction: away from chasing another decimal point of closed-world accuracy and toward the question that actually determines whether a power grid or a production line survives its next novel attack, namely how a small, fast, locally trained combination of complementary detectors performs when the threat is something it has never seen. In industrial cybersecurity, where the adversary only needs to be new once, that is the question worth asking.

Subject of Research: Zero-day attack generalization in industrial IoT intrusion detection using adaptive fusion of closed-world and open-set detectors

Article Title: Adaptive fusion of closed-world and open-set detectors for zero-day attack generalization in industrial IoT intrusion detection

Article References: Ren, Z., & Bao, Y. (2026). Adaptive fusion of closed-world and open-set detectors for zero-day attack generalization in industrial IoT intrusion detection. Cluster Computing, 29(14), Article 807. https://doi.org/10.1007/s10586-026-06631-7

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06631-7

Keywords: industrial IoT, intrusion detection, zero-day attacks, open-set recognition, machine learning, ensemble fusion, X-IIoTID, ToN-IoT, edge computing, network security, false positive rate, cross-dataset transfer