ROSE-BOX: A Lightweight and Efficient Intrusion Detection Framework for Resource-Constrained IIoT Environments +
Footnote †: This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([[https://creativecommons.org/licenses/by/4.0/](https://creativecommons.org/licenses/by/4.0/)]([https://creativecommons.org/licenses/by/4.0/](https://creativecommons.org/licenses/by/4.0/))). [PERSON]  
1  
[PERSON]  
1  
[PERSON]  
2  
[PERSON]  
2  
[PERSON]  
3  
[PERSON]  
4 National Key Laboratory of Smart Farm Technologies and Systems, Harbin 150030, China  
5  
College of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), Shenzhen 518055, China  
5  
Shenzhen 518055, China  
5  
Footnote 4: [[https://github.com/hjie](https://github.com/hjie)]([https://github.com/hjie](https://github.com/hjie))  
exchange data, and even transient events can generate massive volumes of traffic. In such dynamic environments, ensuring robust security is not just important--it is critical. With the potential for cyberattacks to propagate almost instantaneously, any delay in threat detection can lead to cascading failures, production interruptions, and even catastrophic safety hazards [1; 2]. Resource constraints represent a significant challenge in IIoT deployments. Many IIoT devices are embedded systems or edge devices that operate with limited processing power, memory, and energy reserves [3]. This inherent limitation makes it impractical to deploy computationally intensive security solutions directly on these platforms. Traditional rule-based intrusion detection systems (IDSs) offer limited adaptability to emerging attack vectors. While deep learning-based IDSs have demonstrated high detection accuracy, their heavy computational overhead renders them unsuitable for real-time applications in resource-limited environments [3]. Lightweight and efficient intrusion detection is crucial in IoT contexts, as the rapid communication between devices and the cloud means that even a slight delay in the real-time identification and mitigation of attacks can lead to significant security incidents. For instance, if an attack goes undetected even for a few milliseconds, malicious data packets could compromise critical control systems, lead to unauthorized access, or trigger shutdowns of vital operations. These risks underscore the need for a security solution that not only delivers high detection accuracy but also operates with ultra-low latency and minimal resource consumption [4]. Traditional IDS approaches, including signature-based and threshold-based methods, struggle to detect zero-day attacks and require extensive manual configuration [5; 6; 7]. Meanwhile, deep learning-based IDSs, such as convolutional neural networks (CNNs) and long short-term memory (LSTM) models, demonstrate high detection accuracy but suffer from excessive computational overhead, making them unsuitable for IIoT environments with constrained processing power [8]. Furthermore, there are four challenges in IIoT environments: (1) High-dimensional IIoT data often contain redundant features that reduce the model's discriminative power; (2) severe class imbalances in IIoT datasets lead to the under-representation of rare but critical attack instances; (3) suboptimal hyperparameter settings can dramatically affect the performance and generalizability of IDSs; (4) high computational complexity and latency impede real-time threat detection on resource-limited IIoT devices. These challenges necessitate the development of lightweight, high-performance IDS solutions that are capable of detecting multi-class cyber threats while maintaining low latency and minimal resource consumption [9]. These challenges have been highlighted in the recent literature.