AIRO improves industrial IoT security with fast streaming machine learning
AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things
Cryptography and SecurityMachine LearningNetworking and Internet Architecture
Summary
Industrial Internet of Things (IIoT) systems help monitor factories and plants remotely but can be vulnerable to cyberattacks like hacking and phishing. The authors developed AIRO, a new system that watches network traffic in real time using machine learning to spot dangerous activity automatically. It can then quickly take protective actions such as blocking suspicious IP addresses or limiting traffic. Their tests showed AIRO can detect threats accurately and respond fast, even with noisy data.
What this means in practice
- •For industrial network security teams: Monitor and defend IIoT networks in real time using AIRO’s automated threat detection and mitigation techniques specialized for industrial protocols.
- •For cloud platform operators: Integrate AIRO’s streaming machine learning framework into cloud dashboards to enhance early detection and responsiveness against cyber threats in connected edge systems.
- •For enterprise cybersecurity service providers: Develop cybersecurity products for IIoT environments that leverage AIRO’s efficient streaming analytics and automated response capabilities for better customer protection.$Commercial implications: Enables new IIoT-focused cybersecurity products that combine fast AI inference with active threat blocking and account controls, filling a market need.
Authors
Raima Deb, Pranav M Pawar, Mithun Mukherjee, Raja Muthalagu, Mian Guo
Abstract
Modern Industrial Internet of Things (IIoT) im- plementations now connect edge gateways, cloud dashboards and business applications. This improves visibility and remote monitoring. However it simultaneously exposes industrial traffic to various cyber threats including scanning, web attacks and Structured Query Language (SQL) injection (SQLi), phishing- driven credential theft, and command-and-control (C2) activity. Although rule-based tools remain useful for detecting known signatures, their efficacy decreases with minimally altered attacks or when alerts require manual investigation. This paper presents AIRO (Autonomous Intelligence-Driven Cybersecurity Risk Re- duction System), an efficient framework for IIoT monitoring and response. AIRO combines Apache Kafka streaming, attack- specific feature extraction, machine learning (ML) inference, confidence-based decision logic and risk reduction measures such as Internet Protocol (IP) blocking, account suspension and traffic limiting. We developed four specialized datasets for C2 beaconing, reconnaissance, SQLi, and phishing to evaluate AIRO. These datasets include noisy and overlapping characteristic distribu- tions to minimize label leakage. The best-performing models, primarily Gradient Boosting and LightGBM, achieve F1-scores up to 0.9229 while ensuring low-latency from event input to mitigation