The architecture at the heart of ZD-HybridNet is deliberately dual-brained. One branch is a Transformer encoder, the attention-driven design that has revolutionized natural language processing, repurposed here to capture global dependencies across the statistical and protocol-level features of network flows. Each feature of a traffic record is treated as a token, projected into an embedding space, and processed through multi-head self-attention so that the model can weigh how distant, seemingly unrelated attributes interact. The other branch is a Long Short-Term Memory network, a recurrent architecture well suited to ordered dependency patterns, which reads the same feature sequence and extracts localized sequential relationships. A learnable fusion gate, computed through a small neural network and a sigmoid activation, then blends the two representations element by element, dynamically deciding for every single network flow whether global context or sequential structure deserves more weight.

This adaptive fusion is more than an engineering flourish. Zero-day attacks often manifest as subtle deviations that neither a purely global nor a purely local model captures well on its own. By letting the gate vary per sample and per embedding dimension, ZD-HybridNet can lean on the Transformer’s broad view for one suspicious flow and on the LSTM’s sensitivity to ordered patterns for another. The fusion coefficients themselves double as a diagnostic signal, revealing how much each branch contributed to a given decision. In ablation experiments, replacing the adaptive gate with fixed averaging cost the model 0.91 percentage points of F1-score, while swapping learned attention pooling for simple mean pooling produced the largest single-component drop of 1.18 points, confirming that both the complementary branches and the learned aggregation mechanism pull real weight.

What truly distinguishes the study, however, is its evaluation protocol. Most intrusion detection systems are trained and tested on random splits of benchmark datasets, which means the test set contains attack variants the model has effectively already seen. The researchers instead adopted a category-holdout design: two entire attack families, Shellcode and Worms, were completely excluded from training, validation, and hyperparameter selection, and were reserved exclusively for the final test. The team merged the official UNSW-NB15 partitions, screened out exact duplicate records to prevent leakage, and verified after partitioning that the held-out categories appeared nowhere in model development. In this framing, zero-day means attack categories genuinely unseen during training, though the authors are careful to note the model performs binary benign-versus-attack detection and does not assign specific attack-family labels to the novel traffic it flags.

The dataset itself, UNSW-NB15, is a widely used benchmark generated with the IXIA PerfectStorm tool at the Cyber Range Lab of the Australian Centre for Cyber Security in Canberra. Roughly 100 gigabytes of raw traffic were recorded and processed into flow-level records, yielding about 2.5 million samples across nine attack categories plus benign traffic, with 49 documented features per flow. Preprocessing was rigorous and leakage-conscious: all transformations were fitted only on the training subset and applied unchanged elsewhere. Numerical features underwent median imputation, a quantile transformation to tame extreme skewness, and standard scaling, while categorical attributes were one-hot encoded. An unsupervised Isolation Forest, trained without labels, contributed an anomaly-score feature that captures distributional irregularities potentially misaligned with known attack classes. Removing that score cost 0.54 F1 points, a modest but measurable contribution.

Under the strict holdout protocol, ZD-HybridNet achieved an accuracy of 94.04 percent, a precision of 96.76 percent, a recall of 93.96 percent, and an F1-score of 95.34 percent, outperforming standalone LSTM, Transformer, FT-Transformer, and 1D CNN baselines that were trained under an identical pipeline, optimizer, learning rate, batch size, and threshold-selection procedure. The controlled comparison matters: because every variable except architecture was held constant, the reported gains reflect the representation-learning capability of the hybrid design itself. The full model beat the strongest standalone Transformer by 1.68 percentage points in accuracy and 1.71 points in F1, evidence that global attention and sequential recurrence are genuinely complementary rather than redundant.

Drilling into the zero-day subset reveals a more nuanced picture. On attacks the model had seen during training, recall reached 94.26 percent, while the combined held-out Shellcode and Worms traffic retained a recall of 88.13 percent. Shellcode was detected more reliably than Worms, indicating that the extremely rare Worms category poses the hardest unseen-category challenge. Precision-recall curves remained strong across training, validation, and test splits, with average precision between roughly 0.98 and 0.99, and ROC analysis yielded area-under-curve values of 0.9917, 0.9899, and 0.9893 respectively, showing only a small generalization gap between training and unseen data. Confusion matrices on the test set recorded 2,072 false negatives out of tens of thousands of attack samples, a figure the authors highlight as critical, since missed attacks are the costliest errors in security operations.

Explainability is woven into the framework rather than bolted on afterward. The attention pooling module produces model-internal importance signals indicating which transformed traffic features received the greatest emphasis during aggregation, and the fusion gate’s alpha values expose how much each branch contributed to a decision. These signals are complemented by SHAP, a post-hoc attribution technique that quantifies how each feature pushes a prediction toward the attack or benign class. The researchers retained a deterministic mapping from processed feature indices back to the original UNSW-NB15 attributes, allowing the anonymous inputs used during computation to be traced to real traffic characteristics. For analysts in a Security Operations Center, such ranked attributions can support alert triage by showing which flow properties most strongly influenced a verdict. The authors are careful to frame these outputs as interpretive evidence, not causal proof of malicious behavior.

The team is equally candid about the limits of the current work. All experiments ran on an NVIDIA Tesla T4 GPU in a cloud environment, and the evaluation focused on detection effectiveness rather than deployment-level benchmarking. Inference latency, throughput, memory consumption, and the time needed to generate SHAP explanations remain unmeasured, so the results cannot yet be read as evidence of real-time operational performance. The zero-day evaluation is also confined to the single Shellcode-Worms holdout configuration; additional category-holdout scenarios, session- or time-grouped partitioning, and repeated-run statistical analysis are left for future study. A contextual comparison with other recent zero-day detection studies likewise shows that some published approaches report higher accuracy, but the authors caution that differing datasets, task definitions, and protocols make direct rankings meaningless.

Even with those caveats, ZD-HybridNet represents a meaningful step toward intrusion detection systems that security teams can actually trust and interrogate. The combination of Transformer and LSTM branches, adaptive attention-based fusion, category-isolated evaluation, and integrated SHAP attribution arrives in a single unified framework rather than as loosely stitched components. The authors outline an ambitious roadmap: extending the model to federated and edge-computing environments for privacy-preserving scalability, incorporating continual learning to track evolving attack patterns, and fusing multi-modal data sources such as logs, packets, and flow records. As adversarial machine learning gives attackers ever more sophisticated tools for mimicking benign traffic, the ability to detect the unknown and justify the detection may prove as important as raw accuracy itself. In that respect, ZD-HybridNet offers a template for the next generation of explainable, zero-day-aware network defense.

Subject of Research: Explainable deep learning for zero-day network intrusion detection using a hybrid Transformer-LSTM architecture

Article Title: ZD-HybridNet integrates transformer and LSTM models for explainable zero day cyber attack detection

Article References: Madhiya, A., Jamee, S. S., Lucky, K. Y., Mujtahid, F., Mehedi, M., Rezvi, S. M., Solanki, V., & Islam, R. (2026). ZD-HybridNet integrates transformer and LSTM models for explainable zero day cyber attack detection. Discover Artificial Intelligence, 6(1), Article 1341. https://doi.org/10.1007/s44163-026-02258-0

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02258-0

Keywords: zero-day attack detection, intrusion detection system, Transformer, LSTM, explainable AI, SHAP, UNSW-NB15 dataset, attention mechanism, network security, deep learning, adaptive fusion, cybersecurity

Intrusion detection systems sit at the heart of network security. They watch the ceaseless stream of packets flowing through a network and flag the ones that look malicious, distinguishing botnet commands, denial-of-service floods, port scans and brute-force login attempts from ordinary traffic. Over the past decade, the field has largely abandoned hand-written rules in favor of machine learning and deep learning models that learn the statistical fingerprints of attack traffic from labeled datasets. These models routinely achieve impressive accuracy on standard benchmarks such as CIC-IDS2017, a widely used collection of realistic attack and benign traffic compiled by researchers at the University of New Brunswick. But benchmark accuracy tells only part of the story, because it measures performance against attacks that look exactly like the ones the model was trained on.

The deeper problem is adversarial machine learning. An adversarial example is an input that has been perturbed with tiny, carefully calculated changes, so small that a human analyst would notice nothing amiss, yet large enough to push the input across a decision boundary inside the model. In image recognition, this means a panda photograph becomes a gibbon with a few dozen altered pixels. In network intrusion detection, it means a packet stream corresponding to a real attack is modified just enough that the classifier labels it benign. The attacker does not need to change what the malware does; it only needs to change how the traffic looks to the detector. Because network features are numeric and structured, attackers can manipulate fields such as flow durations, byte counts and inter-arrival times in ways that preserve the attack’s function while destroying its statistical signature.

What makes this threat especially insidious is transferability. An attacker rarely knows the exact architecture, weights or training data of the defender’s model, so a direct attack is often impossible. Transferable adversarial examples solve this problem: they are crafted against a surrogate model that the attacker controls, and then deployed against the real target. If the two models learn similar decision boundaries, the perturbations that fool one often fool the other. Prior research, including surveys of adversarial machine learning for intrusion detection and empirical studies of black-box transferability in cybersecurity, has shown that this cross-model leakage is a genuine and practical danger. It means that a defense validated only against attacks crafted on the defender’s own model may offer a false sense of security against a realistic adversary working blind.

The Vietnamese team, led by Phan The Duy and Van-Hau Pham along with colleagues including Cao The Thuan, Doan Ngoc Nhu Quynh, Truong Thi Hoang Hao, Doan Minh Trung and Nghi Hoang Khoa, attacked the problem from two directions at once. First, they evaluated how well multimodal learning-based intrusion detection systems hold up against transferable adversarial examples produced by generative adversarial networks. GANs pit two neural networks against each other, a generator that produces candidate inputs and a discriminator that tries to distinguish them from real data, and this adversarial dynamic makes them a natural engine for producing deceptive network traffic. Second, the researchers integrated adversarial training into their detection pipeline, exposing the model to perturbed samples during training so that it learns to classify attack patterns even when they carry small perturbations designed to hide them.

Multimodality is the other half of the defense. Rather than relying on a single view of network traffic, a multimodal IDS fuses information from multiple sources or feature representations, much as multimodal deep learning has improved diagnosis of Alzheimer’s disease from combined imaging and clinical data, or breast cancer classification from fused mammogram and ultrasound features. In the intrusion detection context, multimodal architectures can combine flow-level statistics with payload characteristics or sequential patterns, giving the detector a richer description of each connection. The intuition is that an attacker who evades one feature space may still be caught in another, and that fused representations generalize better to unknown attacks. Recent work on multimodal and multi-view intrusion detection, including approaches for vehicle CAN bus security and few-shot detection, has supported this intuition, but robustness against transferable adversarial attacks had not been systematically evaluated.

The headline result of the new study is the MAT strategy, short for multimodal adversarial training. Under second-round adversarial attack conditions, meaning scenarios in which the detector faces a renewed wave of adversarial examples after its initial defenses, MAT achieved near-perfect detection rates across all attack types and posted the highest overall F1 score of any system tested, at 0.7595. The F1 score, the harmonic mean of precision and recall, is a demanding metric because it penalizes both false alarms and missed detections; a high F1 under adversarial pressure means the system catches attacks without drowning analysts in false positives. MAT substantially outperformed all baseline models in the comparison, demonstrating that the combination of multimodal fusion and adversarial training is more than the sum of its parts.

The authors are candid that the results, while strong, are not as remarkable as one might ultimately want. An F1 score of 0.7595, though the best in the study, still leaves room for improvement, and the gap between near-perfect per-attack detection and the overall score reflects the genuine difficulty of the problem. Adversarial training is expensive, because it requires generating and incorporating adversarial examples throughout the training process, and it tends to harden a model against the specific perturbation families it has seen. The transferability experiments underscore why this matters: defenses must be tested against examples crafted on other models, not merely against attacks the defender can simulate directly. By benchmarking multimodal IDS under exactly these conditions, the study provides a more realistic picture of deployment readiness than standard benchmark evaluations allow.

The broader significance of the work lies in its reframing of what a robust intrusion detector must do. The literature on adversarial attacks against network intrusion detection has grown rapidly, with studies demonstrating evasion attacks on practical systems, detection mechanisms such as MANDA that spot adversarial inputs, ensemble defenses like ELAT that combine multiple learners with adversarial training, and transfer-learning-based multi-adversarial detection approaches. Each of these defenses addresses one facet of the problem. The multimodal adversarial training strategy adds a complementary dimension: instead of asking whether a single model can resist a single attack family, it asks whether a system that sees traffic through several lenses at once, and has been trained under adversarial pressure, can resist attacks that were designed elsewhere and transferred in. The answer, according to the experiments, is a qualified yes, with meaningful gains over every baseline examined.

For network operators, the message is sobering but actionable. Machine learning-based IDS are not plug-and-play fortresses; they are statistical systems with exploitable geometry, and an adversary armed with a surrogate model and a GAN can degrade them. The study suggests that organizations deploying learned detectors should incorporate adversarial training into their model lifecycle and consider multimodal architectures that fuse multiple feature views, raising the cost of crafting effective perturbations. For researchers, the work opens a clear agenda: better fusion strategies, cheaper adversarial training, and evaluation protocols that treat transferability as the default threat model rather than an afterthought. The research was supported by the VNU-HCM Scientific Research Support Fund under grant NCM2025-26-01, and the authors note that their code is available from the corresponding author on reasonable request. As networks grow more complex and attackers grow more sophisticated, the contest between deception and detection will only intensify, and studies like this one mark out the terrain on which it will be fought.

Subject of Research: Robustness of multimodal machine-learning intrusion detection systems against transferable GAN-generated adversarial evasion attacks

Article Title: Evaluating the Robustness and Transferable Adversarial Example Resistance of Multimodal Learning-based Intrusion Detection Systems against Evasion Attacks

Article References: Evaluating the Robustness and Transferable Adversarial Example Resistance of Multimodal Learning-based Intrusion Detection Systems against Evasion Attacks. (n.d.). https://doi.org/10.1007/s11036-026-02522-8

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02522-8

Keywords: intrusion detection system, adversarial examples, adversarial training, multimodal learning, generative adversarial networks, evasion attacks, network security, transferability, deep learning, machine learning, cybersecurity, F1 score

Researchers Hamed Alqahtani of King Khalid University in Saudi Arabia and Gulshan Kumar of Shaheed Bhagat Singh State University in India have unveiled FTL-IDS, a Federated Temporal-Aware Lightweight Intrusion Detection System. The framework is a deliberate co-design of four technologies that are usually pursued separately: multi-domain feature extraction from CAN traffic, a hybrid LSTM-Transformer temporal encoder, 8-bit quantization-aware training, and federated learning. According to the authors, existing intrusion detection systems tend to trade temporal modeling capability, privacy, or embedded efficiency against one another; the goal of FTL-IDS is to balance all three at once.

The feature engineering stage is where raw CAN traffic becomes machine-learnable. Rather than feeding raw frames into a neural network, the system organizes temporal, entropy, spectral, and payload-statistical features into fixed-length windows. Entropy features capture the randomness of message identifiers and payloads, which spikes during fuzzing or injection attacks. Spectral features expose periodic patterns that replay or denial-of-service attacks disrupt. Payload statistics reveal when a message’s data content deviates from what a given ECU normally transmits. This multi-domain representation gives the downstream model a rich but compact view of network behavior.

At the heart of the detector sits a hybrid deep learning architecture that splits the temporal modeling problem in two. A long short-term memory network, or LSTM, captures the local dynamics of CAN traffic, the short-range dependencies between consecutive frames that define normal in-vehicle behavior. A Transformer component then models longer-range dependencies across the window, using attention mechanisms to spot subtle patterns that unfold over longer horizons. This division of labor mirrors a broader trend in sequence modeling, where recurrent architectures handle fine-grained local structure while attention mechanisms excel at global context.

Deploying such a model inside a car, however, demands more than accuracy. Automotive ECUs have strict memory, compute, and latency budgets, so the researchers applied 8-bit quantization-aware training, a technique in which the neural network is trained with the constraints of low-precision arithmetic baked in from the start. The resulting quantized model occupies just 1.4 megabytes and achieves a forward-pass latency of 0.13 milliseconds per precomputed window on a Raspberry Pi 4B, a stand-in for resource-constrained embedded hardware. That footprint makes the approach realistic for integration alongside existing ECU software rather than requiring dedicated high-performance hardware.

Privacy is addressed through federated learning, a distributed training paradigm in which the model is trained across multiple clients, such as vehicles or fleet segments, without centralizing raw CAN traffic. Each client trains locally on its own data and shares only model updates, so sensitive driving behavior never leaves the vehicle. The federated version of FTL-IDS retains 99.10, 97.81, and 96.40 percent accuracy on the three evaluation datasets respectively, showing that distributed training costs only a modest amount of detection performance compared with centralized training.

The evaluation spanned three widely used benchmarks of increasing realism: the HCRL Car Hacking dataset, the ROAD dataset, and CAN-MIRGU. On these, FTL-IDS achieved accuracies of 99.71, 98.94, and 97.12 percent, with macro-F1 scores of 0.9978, 0.9817, and 0.9653. The authors also stress-tested the model against adversarial examples, carefully crafted inputs designed to fool machine learning classifiers. Under a fixed perturbation level of epsilon equal to 0.1, accuracies held at 95.2, 93.1, and 91.8 percent against the Fast Gradient Sign Method, and 92.8, 90.0, and 89.7 percent against the more aggressive Projected Gradient Descent attack. The system also incorporates explainability through SHAP and LIME analyses, aligning with a growing demand for interpretable security decisions in safety-critical domains.

The authors are candid about the limits of the work. The robustness study covers only FGSM and PGD attacks; the federated experiments use five simulated clients rather than a real fleet; and the reported latency excludes raw-log preprocessing and the computation of SHAP and LIME explanations. Validation on production-grade ECUs, along with broader adaptive, black-box, and certified robustness testing, remains necessary before the framework can be considered deployment-ready. Standards contexts such as AUTOSAR and ISO 26262, which govern automotive software architecture and functional safety, will ultimately shape how such detectors are certified.

Even with those caveats, the study offers a deployment-oriented baseline for CAN intrusion detection research, demonstrating that temporal representation, privacy-preserving training, and compact inference can be engineered to coexist. As vehicles become more connected and attack surfaces widen, frameworks like FTL-IDS suggest a path toward protecting in-vehicle networks without sacrificing either driver privacy or the real-time performance that automotive systems demand. The datasets used in the study are publicly available, allowing other researchers to build on and independently verify the results.

Subject of Research: A hybrid federated deep learning framework for lightweight, privacy-preserving intrusion detection in CAN-based in-vehicle networks.

Article Title: Federated temporal-aware lightweight intrusion detection system for CAN-based in-vehicle networks: A hybrid deep learning and privacy-preserving framework

Article References: Alqahtani, H., & Kumar, G. (2026). Federated temporal-aware lightweight intrusion detection system for CAN-based in-vehicle networks: A hybrid deep learning and privacy-preserving framework. Multimedia Tools and Applications, 85(10), Article 766. https://doi.org/10.1007/s11042-026-21937-9

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21937-9

Keywords: automotive cybersecurity, intrusion detection system, CAN bus, federated learning, LSTM-Transformer, quantization-aware training, adversarial robustness, in-vehicle networks, controller area network, deep learning, embedded systems, privacy-preserving training

The system, called SA-IDS, was developed by Mahdi Ajdani and Maziar Asmani of the Department of Computer Engineering at Islamic Azad University, Qeshm branch, in Iran, and described in a study published in the journal Cluster Computing. Its central insight is that the traditional recipe for intrusion detection, training a supervised machine learning model on a large, carefully labeled dataset of attacks, simply does not work in real industrial settings. Labeled attack data is scarce, expensive, and quickly outdated, because adversaries constantly invent new techniques. Centralized retraining pipelines, in which data from thousands of devices is shipped back to a server for periodic model updates, add latency, bandwidth costs, and privacy risks that many industrial operators cannot accept.

SA-IDS takes a fundamentally different approach built on self-supervised learning, a technique that has transformed fields from computer vision to speech recognition. Instead of requiring humans to label data, the model learns by solving an artificial task on unlabeled data, in this case through contrastive learning. The idea is elegant: the system takes streams of benign telemetry from industrial sensors and controllers, creates altered versions of that data, and trains an embedding network to recognize which samples are original views of the same underlying behavior and which are different. By pulling representations of similar behavior together and pushing dissimilar ones apart, the network develops a rich internal map of what normal operation looks like, all without ever being told what an attack is.

Once that embedding space exists, anomaly detection becomes a geometric problem rather than a classification problem. SA-IDS measures the Mahalanobis distance between each new observation and the distribution of normal behavior learned during training. Unlike a simple Euclidean distance, the Mahalanobis metric accounts for the shape and correlations of the data, so it can distinguish a genuinely unusual reading from one that is merely rare but consistent with normal variation. If a new telemetry sample lands far from the cluster of benign behavior in the embedding space, the system flags it as a potential intrusion. This design means the detector can catch attacks it has never seen before, including zero-day exploits and novel variants, because it does not depend on memorizing signatures of known threats.

But detecting anomalies is only half the battle. Industrial environments are not static. Machines age, production lines are reconfigured, seasonal demand shifts operating schedules, and firmware updates change how devices communicate. In machine learning terms, the data distribution drifts over time, a phenomenon known as concept drift, and a model frozen at deployment gradually loses accuracy, either missing real attacks or drowning operators in false alarms. Conventional solutions involve periodic retraining with fresh labeled data, which is precisely the resource industrial edge deployments lack. SA-IDS addresses this with a lightweight, unsupervised adaptation mechanism that continuously updates the model using only high-confidence benign samples, allowing the learned representation of normal behavior to evolve as the environment does, without any human annotation or cloud round-trip.

The practicality of the approach was tested on a real-world IIoT testbed built from the kind of hardware actually deployed in industrial settings: Raspberry Pi single-board computers and ESP32 microcontrollers. These are the workhorses of low-cost industrial sensing, and they are severely constrained in memory, processing power, and energy budget. Running a modern deep learning system on such hardware is a genuine engineering challenge, and many state-of-the-art detectors simply cannot operate there. The researchers demonstrated that SA-IDS maintains real-time performance on these devices, meaning detection happens locally at the edge, where attacks can be caught and responded to before they spread, rather than after data has made a round trip to a distant server.

The numbers reported in the study are striking for a system operating under such constraints. SA-IDS achieved a detection accuracy of 96.3 percent, an F1-score of 0.92, and a false positive rate of just 3.1 percent, outperforming several state-of-the-art baseline methods. The false positive figure deserves particular attention in an industrial context. In a factory, every alarm triggers human investigation, and if a detector cries wolf too often, security teams begin ignoring it, a failure mode that can be as dangerous as missing an attack. A low false positive rate combined with high detection accuracy means the system can be trusted to run continuously without exhausting its operators.

The broader significance of the work lies in what it removes from the deployment equation. No labeled attack data. No centralized retraining. No dependence on cloud connectivity for security decisions. Each of these has been a persistent obstacle to deploying machine learning-based security in the industrial sector, where operational technology networks are often air-gapped or semi-isolated by design, and where downtime is measured in thousands of dollars per minute. A detector that learns from the data flowing past it and adapts on its own fits the operational reality of industrial environments far better than models that must be periodically fed curated datasets by security specialists.

The researchers have also made the system reproducible and extensible. The source code, trained models, and experimental scripts for SA-IDS are publicly available on GitHub, including the self-supervised training pipeline, the Mahalanobis distance implementation, the online adaptation module, and the testbed scripts needed to reproduce the experiments on Raspberry Pi and ESP32 hardware. This openness matters, because industrial cybersecurity is a field where independent verification and community scrutiny can accelerate adoption far faster than proprietary black boxes. Security tools that researchers and operators can inspect, test, and improve are inherently more trustworthy than those that cannot be examined.

Challenges remain, of course. Self-supervised anomaly detectors are ultimately bounded by the quality of their representation of normal behavior, and a sufficiently patient adversary who behaves in ways that mimic benign patterns may still evade detection. The adaptation mechanism, while designed to update only on high-confidence benign samples, must also be robust against poisoning attempts in which an attacker tries to redefine normality itself. Still, SA-IDS represents a meaningful step toward security systems that match the constraints of the devices they protect: small, self-sufficient, always learning, and always watching. As industrial networks continue to expand into critical infrastructure around the world, approaches like this one, which bring sophisticated machine learning to the very edge of the network without demanding resources those edges do not have, may well define the next generation of industrial cyber defense.

Subject of Research: A self-supervised, adaptive intrusion detection system for resource-constrained IIoT edge devices that detects anomalies via Mahalanobis distance and adapts to concept drift without labeled data.

Article Title: SA-IDS: a self-supervised and adaptive intrusion detection system for edge-based IIoT security with label-free drift resilience

Article References: SA-IDS: a self-supervised and adaptive intrusion detection system for edge-based IIoT security with label-free drift resilience. (n.d.). https://doi.org/10.1007/s10586-026-06562-3

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06562-3

Keywords: Industrial Internet of Things, intrusion detection system, self-supervised learning, contrastive learning, Mahalanobis distance, concept drift, anomaly detection, edge computing, adaptive security, Raspberry Pi, ESP32, cybersecurity