## 3 Methodology
### The ROSE-BOX Algorithm  
As illustrated in Algorithm 1, the ROSE-BOX algorithm takes as input the IIoT dataset \(D\), the objective function \(O\) of the Bayesian optimization algorithm, a parameter set \(W\) for XGBoost, the acquisition function \(F\), the SMOTE sampling algorithm, and the classifiers Random Forest (RF) and XGBoost. Initially, both the best accuracy \(b\_a\) and the best number of features \(b\_n\_f\) are initialized to zero. After preprocessing, the dataset \(D\) is partitioned into training and testing subsets: \(X_{\text{train}}\), \(X_{\text{test}}\), \(y_{\text{train}}\), and \(y_{\text{test}}\). The Random Forest model is then trained on \(X_{\text{train}}\) and \(y_{\text{train}}\) to compute feature importance rankings, from which the selected feature subset \(X_{\text{train}\_s}\) is derived. Following the feature selection process, XGBoost is trained on the selected features. To mitigate overfitting and determine the optimal classification performance, EarlyStopping is incorporated during the training phase. Subsequently, the most discriminative features are leveraged to construct a balanced dataset \(D^{\prime}\) through the SMOTE oversampling technique. To further enhance the performance of multi-class intrusion detection while avoiding overfitting, Bayesian optimization is utilized to fine-tune the XGBoost parameters. This is achieved by iteratively training the model on dataset \(D^{\prime}\) and maximizing the objective function. Through this systematic approach, the BO-XGBoost model is ultimately developed for accurate multi-class intrusion detection. ```
Input:\(D,W,O,F,RF,SMOTE,XGBoost\) Output: ROSE-BOX
1\(X_{\text{train}},X_{\text{test}},y_{\text{train}},y_{\text{test}}\leftarrow\text{ Preprocess}(D)\);
2 Initial(\(b\_a\_b\_n\_f\));
3\(X_{\text{train}}\_s\leftarrow\text{RF}(X,y)\);
4 for\(n\_f=1,2,\dots,X[1]+1\)do
5 XGBoost(\(X_{\text{train}}\_s,y_{\text{train}}\));
6 if\(a>b\_a\)then
7\(b\_a\gets a\);
8\(b\_n\_f\gets n\_f\);
9 EarlyStopping
10
11 end for
12\(D^{\prime}\leftarrow\text{SMOTE}(X_{\text{train}},y_{\text{train}})\);
13\(i\leftarrow\lfloor D^{\prime}\rfloor\);
14 Initsamples(\(O,W\));
15 for\(i=1,2,\dots,N\)do
16\(p(f|w,D^{\prime})\leftarrow\text{XGBoost}(D^{\prime})\);
17\(w_{i}\leftarrow\operatorname*{arg\,max}F(w,p(f|w,D^{\prime}))\);
18\(f_{i}\gets O(w_{i})\);
19\(D^{\prime}\gets D^{\prime}\cup(w_{i},f_{i})\)
20 end for
21\(\hat{y}=\operatorname*{arg\,max}_{k\in\{0,\dots,K-1\}}\sum_{m=1}^{M}w_{m}1(T_{ m}(x)=k)\)
22 ROSE-BOX(\(D^{\prime}\)) \(\leftarrow\) BO-XGBoost(\(D^{\prime}\))
```  
**Algorithm 1**The detection algorithm ROSE-BOX  
The detailed procedure of the Bayesian optimization algorithm for XGBoost is elaborated as follows. As shown in Algorithm 1, \(N\) represents the number of iterations for the Bayesian optimization process. Given a set of parameters for XGBoost, denoted as  
\[W=\{w_{1},w_{2},...,w_{n}\},w\to R \tag{9}\]  
where each \(w\) maps to a real number \(R\), and an objective function \(O\), we commence by pairing samples \((O,W)\) to compile a dataset comprising several data pairs \((w,f)\). Additionally, a function \(F\) is harnessed to identify the next observation point for evaluation [33]. Central to this approach is the calculation of the posterior probability \(p(f|w,D^{\prime})\), which represents the likelihood of the forthcoming parameter set. This is accomplished by fitting XGBoost with the dataset \(D^{\prime}\). Moreover, by utilizing the acquisition function \(F\), we determine the maximum value \(w_{i}\) grounded on the current posterior probability and parameter \(w\). Consequentially, the outcome related to the parameter \(f_{i}\) is derived by applying \(O(w_{i})\). The process iteratively updates the dataset \(D^{\prime}\) until the optimal parameters are detected.