## 5 Conclusions and Future Direction  
In this work, we proposed ROSE-BOX, a lightweight and efficient intrusion detection framework tailored to real-time cybersecurity applications in resource-constrained IIoT environments. Integrating XGBoost-assisted Random Forest for feature selection, SMOTE for class balancing, and Bayesian-optimized XGBoost for detection, ROSE-BOX achieves a compelling balance between detection accuracy and computational efficiency. The experimental results on CIC-IDS2017, CSE-CIC-IDS2018, and CIC-DDoS2019 confirmed its superior performance, consistently exceeding 99.85% detection accuracy while significantly reducing latency and CPU usage, which is suitable for resource-constrained IIoT environments. In the future, we will collect datasets covering specific attack scenarios to further verify the effectiveness of our algorithm. The key contributions of ROSE-BOX include the following:  
* Feature selection optimization: Leveraging XGBoost-assisted Random Forest to select the most relevant features, reducing data dimensionality while maintaining high detection performance;
* Class Imbalance handling: Applying SMOTE to balance intrusion datasets, improving model robustness against rare but critical cyberattacks;
* Computational efficiency: Utilizing Bayesian optimization to fine-tune XGBoost, ensuring superior anomaly detection with minimal resource consumption;
* Scalability for IIoT applications: Demonstrating feasibility for deployment in industrial control systems, edge computing platforms, and embedded security solutions. The ROSE-BOX framework also has certain limitations that should be considered for future improvements and practical deployments:  
1. Feature Selection: * Limitation: The Random Forest and XGBoost-based feature selection might not generalize well to datasets with significantly different feature distributions or when new types of attacks are introduced;
* Future Work: Further research is needed to develop more adaptive feature selection mechanisms that can dynamically adjust to evolving attack patterns and data distributions. 2. Class Imbalance Handling: * Limitation: SMOTE may introduce synthetic samples that do not fully capture the complexity of real-world attack instances. This could potentially lead to overfitting on synthetic data and reduced generalization to unseen data. Future work: Exploring advanced resampling techniques or hybrid methods that combine oversampling with other strategies (e.g., undersampling majority classes) could improve model robustness and generalization. * Computational Efficiency and Real-Time Deployment:
* Limitation: The computational overhead of Bayesian optimization and XGBoost parameter tuning might still be prohibitive for extremely resource-constrained devices, such as low-power IoT sensors;
* Future work: Investigating more lightweight optimization algorithms and model architectures that can further reduce computational requirements without compromising detection accuracy is essential. * Scalability and Deployment:
* Limitation: The framework's scalability in large-scale IIoT environments with thousands of devices and high-frequency data streams has not been extensively tested. Certain types of attacks, such as zero-day, stealthy, multi-stage, and false data injection attacks, remain challenging due to their sophisticated nature and ability to evade detection. * Future work: Developing distributed implementations of ROSE-BOX; exploring federated learning integration, deployment on resource-constrained devices, and online learning mechanisms for evolving IIoT threats in industrial control systems; and enhancing ROSE-BOX with advanced detection techniques, continuous learning mechanisms, and context-aware feature selection processes to improve its robustness and adaptability to evolving threats.