## 3 Methodology
### Overall Framework  
Figure 1 illustrates the architecture of ROSE-BOX, a lightweight and efficient anomaly detection framework designed for real-time intrusion detection in resource-constrained IIoT environments. The system initiates with the low-overhead preprocessing of IIoT datasets, ensuring minimal computational cost. Random Forest is employed for feature selection, prioritizing the most relevant attributes to reduce dimensionality and accelerate model inference. In order to maximize the detection rate of ROSE-BOX, XGBoost is utilized to assist Random Forest in feature selection while simultaneously performing anomaly detection. The process terminates when the detection rate reaches 100%. In contrast to deep learning-based feature selection techniques, which demand considerable training resources and exhibit latency during inference, the proposed XGBoost-assisted Random Forest framework ensures lightweight and accurate feature selection [31; 32]. Random Forest provides a stable feature importance ranking, and XGBoost achieves intrusion identification capabilities through multi-class classification. This synergy offers a more practical and computationally feasible alternative to mutual information-based or neural network-based selection methods, especially in constrained IIoT deployments. Importantly, to maintain high detection efficiency and reduce unnecessary processing overhead, an adaptive EarlyStopping mechanism is integrated. This mechanism halts feature selection when detection performance stabilizes, thereby optimizing feature selection by using XGBoost-assisted Random Forest, and the optimal feature subset is obtained after feature selection. IIoT datasets often exhibit severe class imbalances, where normal operations vastly outnumber abnormal or attack events [31]. To overcome this challenge, SMOTE is utilized to oversample minority-class attack instances for the optimal feature subset, thereby improving the robustness of the XGBoost model without significantly increasing computa  
Figure 1: Overall architecture of detection model based on ROSE-BOX. tional complexity [32]. This approach ensures that even infrequent, high-impact attacks are accurately identified. The selected dataset is obtained after balancing the optimal feature subset, which is then partitioned into training, validation, and test sets to ensure optimal model generalization. Although the framework partitions the dataset into separate stages for feature analysis and classification, this design minimizes total computation by reducing feature dimensionality early. The significant gains in model inference speed and memory reduction offset the cost of feature selection. Moreover, SMOTE is applied only to the compact subset of relevant features, further reducing data expansion and ensuring efficient resource usage. Therefore, the framework achieves a net decrease in computational overhead despite multi-stage processing. Our approach enhances the discriminative power of the model, which is crucial for accurately identifying diverse attack types and facilitating subsequent lightweight and efficient intrusion detection. The operational latency and computational overhead are drastically reduced, showing that this method is suitable for resource-constrained IIoT environments. Although the ROSE-BOX framework integrates multiple modules, each is chosen to maintain computational efficiency. Feature selection using XGBoost-assisted Random Forest significantly reduces dimensionality and noise. SMOTE is applied only after feature reduction, ensuring minimal data expansion. Bayesian optimization is performed during training only, not inference. These design decisions collectively mitigate information overhead, as evidenced by our low latency and CPU metrics in Section 4.6. To further enhance detection efficiency, a Bayesian optimization algorithm is applied to fine-tune the hyperparameters of the XGBoost model (BO-XGBoost), thereby achieving an optimal trade-off between detection accuracy and computational cost.