Adaptive NetFlow IIoT Intrusion Detection With Deep Transfer Learning, Genetic Optimization, and Ensemble Methods for Network Management

The growing demands of Industry 5.0 necessitate resilient Internet of Things (IoT) networks, which are increasingly susceptible to sophisticated cyber threats. While advancements in intrusion detection systems (IDS) have improved attack detection, addressing the complexity of multi-class attack scenarios and managing minority threats remains challenging. This study proposes NFIIoT-DTL-IDS, an adaptive IoT IDS for smart network management using NetFlow and IIoT data, driven by deep transfer learning and enhanced with genetic algorithm (GA) optimization. Our framework leverages pre-trained CNN models to convert data into images, enabling effective classification. GA optimizes hyperparameters to improve model flexibility and performance, while a soft voting ensemble ensures robust aggregation of predictions. The proposed IDS achieves 100 classification accuracy among 5, 10, and 19 distinct attack classes of three IoT datasets, including two NetFlow datasets (NF-TONIoTv2 and NF-BoT-IoTv2) and one industrial-based dataset (XIIoTID), detecting threats such as DDoS, ransomware, and theft in common IoT cyberattacks, as well as MQTT subscription and crypto-ransomware attacks in industrial IoT scenarios. Additional experiments demonstrate the effectiveness of the proposed method, which exceeds the classification performance results of three baseline models, including LSTM, Transformer, and 3D CNN, by more than 37.2%, 0.25%, and 1.25%, respectively, in the maximum among the three datasets. Finally, experimental results demonstrate that NFIIoT-DTL-IDS outperforms recent state-ofthe-art solutions in terms of multiclassification accuracy. This contribution advances adaptive management frameworks for IoT security, offering scalable and high-performance solutions for intrusion detection in modern network management.