## 2 Related Work
Although promising in certain contexts, KNN-based approaches are typically hampered by high memory requirements and scalability issues in high-dimensional spaces. In addition, Random Forest selects features by measuring the importance of each feature through its contribution to the impurity reduction (e.g., Gini impurity or information gain) across all trees. [PERSON] et al. [25] combined Random Forest (RF) for feature selection with intrusion detection, yielding high accuracy. However, the RF technique is known to be vulnerable to overfitting, particularly in the presence of noisy data, and its inherent lack of interpretability can be limiting in critical security applications. In the deep learning domain, several studies have explored the use of autoencoders for detecting previously unseen (zero-day) attacks [5]. Although autoencoders have demonstrated the capacity to outperform conventional anomaly detectors, such as One-Class SVM, their performance remains sensitive to data quality and imbalance, often leading to variable outcomes across different types of attacks. Hybrid deep neural network (DNN) architectures have also been introduced by various researchers [26; 27; 28] to achieve scalable multi-class detection. While these methods tend to deliver high detection accuracy, their significant computational requirements for both training and inference can limit their practicality in real-time IIoT deployments. More complex models that integrate convolutional neural networks (CNNs), long short-term memory (LSTM) networks, and attention mechanisms [2; 29; 30] have also been proposed. Despite their ability to capture temporal and spatial correlations in network traffic, the resulting model complexity not only increases training and inference time but also poses challenges in avoiding overfitting, especially in scenarios with limited or imbalanced data. Table 1 summarizes existing IIoT intrusion detection methods and highlights both their strengths (e.g., latency, cost, scalability) and their weaknesses (e.g., high computational cost, poor real-time efficiency, limited adaptability). Although traditional schemes incur low resource overhead, they lack scalability. ML-based methods can certainly improve detection accuracy, but they need to be improved to further reduce detection latency and computational requirements, which is impractical for resource-constrained IIoT environments. Recent DL-based architectures deliver superior accuracy and scalability, yet their high computational requirements, as well as vulnerability to overfitting, hinder real-time deployment on the edge. To overcome these challenges, we introduce ROSE-BOX, a lightweight and efficient intrusion detection framework specifically designed for resource-constrained IIoT environments. Three key motivations guide our design:  
Addressing resource-constrained scenarios: Given the stringent resource limitations of IIoT devices, we proposed a framework for minimizing computational complexity in IIoT systems. By focusing on efficient feature selection and model pruning techniques, we ensure that the processing overhead is drastically reduced. Ultra-low latency processing: In an IIoT environment, where communications between devices and the cloud are measured in milliseconds, the ability to perform instant threat detection is vital. Without real-time deployment, a delayed response could allow malicious activities to spread unchecked, potentially leading to critical system failures. Each data sample is processed within microseconds, which is crucial for maintaining real-time responsiveness. Scalable adaptability and lightweight deployment: Using XGBoost-assisted Random Forest for feature selection and Bayesian optimization for hyperparameter tuning, the