## 2 Related Work  
This section provides a comprehensive review of recent advances in IIoT anomaly detection, with a particular focus on analyzing the strengths and limitations of mainstream detection approaches, including traditional intrusion detection methods and machine learning-based and deep learning-based methods [1]. For traditional intrusion detection methods, on the one hand, anomaly-based intrusion detection (AID) [19; 20] identifies potential threats by contrasting observed device activities with established normal operational patterns. This methodology employs dynamically computed thresholds (THs) to quantify behavioral deviations. When a device exceeds predefined TH values, it is initially flagged for monitoring. Persistent anomalies over subsequent time intervals trigger classification as malicious, prompting the isolation of the device from the network. Researchers have developed diverse AID variants to enhance IoT security, including machine learning-driven pattern recognition, entropy-based traffic analysis,and adaptive threshold optimization frameworks. For instance, some approaches utilize temporal correlation models to minimize false alarms, while others incorporate contextual awareness to differentiate between operational anomalies and genuine cyberattacks. On the other hand, [PERSON] et al. [21] proposed a Bloom filter-based intrusion detection system (IDS) for IP-enabled ubiquitous sensor networks. However, the system's primary limitations stem from its dependence on static signature databases, rendering it ineffective against zero-day attacks and communication latency incurred during distributed node-to-filter data aggregation. For machine learning-based detection methods, earlier studies in IIoT intrusion detection have investigated various machine learning techniques that combine conventional feature engineering with ensemble-based classifiers. For instance, [PERSON] et al. [10] integrated Principal Component Analysis (PCA), Ensemble Feature Selection (EFS), and SMOTE to enhance the performance of AdaBoost. Although this approach provided improved detection capability, its relatively modest discrimination between benign and malicious traffic suggests that further advanced feature engineering or alternative ensemble frameworks could be beneficial. In a similar vein, [PERSON] et al. [22] applied recursive feature elimination (RFE) to identify optimal feature subsets and subsequently utilized a genetic algorithm to optimize a LightGBM classifier. While this method demonstrated a significant boost in detection performance, the computational expense associated with genetic algorithms poses challenges for real-time applications and large-scale systems. [PERSON] et al. [12] integrated autoencoders with XGBoost for intrusion detection, demonstrating strong recall performance but facing limitations in precision, which may lead to increased false positives--particularly in imbalanced data scenarios without the aid of resampling techniques. In XGBoost, the multi-class classification is handled by employing the Softmax function to map the output of the decision trees to multiple class probabilities. It constructs and optimizes multiple trees sequentially, with each tree aiming to minimize the loss function, which is based on the difference between the predicted probabilities and the true labels. The final predicted class is the one with the highest probability after combining the outputs of all the trees. As for large-scale IoT data, [PERSON] et al. [23] developed a tailored multi-class ensemble framework. By combining multiple base learners (e.g., decision trees, KNN, naive Bayes) via weighted voting, they achieved robust detection across diverse attack types. Although ensemble methods improve overall accuracy and resilience to concept drift, they typically demand substantial memory and incur high inference latency--constraints in resource-limited IIoT deployments. Other studies, such as those by [PERSON] et al. [24], have employed the KNN algorithm for identifying Denial-of-Service attacks.