## 4 Experimental Results
### Analysis of Detection Results
Table 5 highlights that the model reached 100% accuracy, precision, recall, and F1 score, demonstrating flawless performance across all key metrics. Therefore, the ROSE-BOX model is equal to the XGB-RF model at this time. The performance of the proposed model surpasses that of XGBoost without feature selection. Traditional ML-based methods, such as KNN and AdaBoost, often struggle to adapt to the dynamic nature of real-time industrial data. In contrast, deep learning models, including DNN, LSTM, and CNN-LSTM, although powerful, can require significant computational resources, thereby limiting their practical applicability. ROSE-BOX, with its efficient feature selection and optimization, offers a balance between accuracy and computational feasibility, making it more practical for IIoT applications. As shown in Figure 9, the ROC curve, which spans 18 classes (Class 0-17), shows the strong detection performance of ROSE-BOX, with an AUROC of 0.99395, indicating the model's high ability to separate various types of network intrusion attacks from normal traffic on the CIC-DDoS2019 dataset. Table 6 reveals that ROSE-BOX achieved an accuracy of 99.851%, with a precision of 63.563%, a recall of 65.687%, and an F1 score of 64.989%. While the precision and recall metrics are slightly lower than those in the previous datasets, this result is still superior to other methods, especially when considering the complex and imbalanced nature of DDoS attacks. Models such as DNN, LSTM, CNN-LSTM, and Transformer tend to struggle with this level of complexity, while simpler methods, like KNN or RF, lack the adaptability to capture the nuanced patterns in high-dimensional data. Although XGB-RF achieves outstanding performance, particularly on CIC-IDS2017 and CSE-CIC-IDS2018, its detection performance slightly degrades in highly imbalanced scenarios, such as for CIC-DDoS2019, as shown in Table 6. The primary reason is that XGB-RF does not incorporate SMOTE to handle class imbalance, nor does it employ Bayesian optimization to fine-tune its parameters. These two mechanisms, central to ROSE-BOX, allow it to maintain high recall for rare attacks and optimize performance dynamically across varying network conditions. Thus, ROSE-BOX outperforms XGB-RF and XGBoost in recall and F1 score in datasets with more complex or imbalanced structures. Across three standard IIoT intrusion detection benchmarks, ROSE-BOX attains record-setting overall accuracies of 99.991% on CIC-IDS2017, 100% on CSE-CIC-IDS2018, and 99.851% on CIC-DDoS2019, surpassing the strongest competing algorithms by margins of 0.008 to 9.2 percentage points. This exceptional performance arises from the synergistic integration of XGBoost-assisted Random Forest feature ranking to eliminate irrelevant dimensions, SMOTE-mediated minority-class augmentation to mitigate label imbalance, Bayesian optimization for principled hyperparameter calibration, and an adaptive EarlyStopping criterion to prevent overfitting. Together, these components furnish ROSE-BOX with both highly discriminative modeling capacity and rapid, resource-efficient convergence, rendering it ideally suited for real-time deployment in resource-constrained IIoT environments. In summary, ROSE-BOX demonstrates clear superiority over ML-based and DL-based methods. On the other hand, it successfully addresses these challenges by balancing multi-class samples through SMOTE and fine-tuning model hyperparameters with Bayesian optimization, which ensures more precise detection even in complex IIoT scenarios of multi-class intrusion detection. This makes it particularly well-suited for resource-constrained IIoT environments.