## 4 Experimental Results
### Baseline Methods for Intrusion Detection  
The proposed ROSE-BOX framework is evaluated against nine other intrusion detection methods. Belief descriptions of the baseline methods used for the experiments are listed as follows.  
* **KNN**[24]: K-Nearest Neighbors (KNNs) classifies new traffic instances by measuring similarities (e.g., Euclidean distance) to labeled examples, making it straightforward to detect anomalies in IIoT flows.
* **RF**[25]: Random Forest (RF) leverages ensemble learning with multiple decision trees through majority voting, mitigates overfitting via feature randomness and bootstrap aggregation (bagging), and provides robust anomaly detection by evaluating feature importance.
* **AdaBoost**[10]: Adaptive Boosting (AdaBoost) builds a strong classifier by sequentially weighting misclassified samples and combining weak learners (typically decision stumps), which improves the detection of rare attack types in imbalanced IIoT datasets.
* **DNN**[26]: Deep neural networks (DNNs) leverage multiple fully connected layers to connect a large number of neurons to learn hierarchical representations of network features, enabling the detection of complex attack signatures.
* **LSTM**[11]: Long short-term memory (LSTM) is a recurrent architecture designed to capture long-range temporal dependencies in network traffic.
* **Transformer**[34]: Transformer embeds each categorical flow attribute into dense vectors and processes them through Transformer encoder layers to produce contextualized feature representations, which are then concatenated with numeric features and passed to an MLP that discriminates among multiple attack and normal classes.
* **CNN-LSTM**[7]: CNN-LSTM combines convolutional neural networks (CNNs) for spatial feature extraction (e.g., packet-level patterns) with LSTM layers for temporal analysis, yielding enhanced detection accuracy in IIoT attack classification.
* **XGBoost**[12]: eXtreme Gradient Boosting (XGBoost) is an optimized gradient-boosted tree ensemble that incorporates regularization, sparsity awareness, and parallel tree construction, consistently achieving state-of-the-art accuracy in multi-class IIoT intrusion detection benchmarks.
* **XGB-RF**[35]: XGBoost with RF (XGB-RF) is the proposed ROSE-BOX model without SMOTE and Bayesian optimization, that is, XGBoost-assisted Random Forest, as mentioned above. When RF is used to rank features for the IIoT datasets, XGBoost applies regularized gradient-boosted trees on the selected subset for high-precision anomaly detection simultaneously.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Parameter** & **Range** & **CIC-IDS2017** & **CIC-DDoS2019** \\ \hline learning\_rate & (0.01, 1.0) & 0.46206 & 0.2854 \\ min\_child\_weight & (0, 10) & 10 & 3 \\ max\_depth & (3, 10) & 10 & 10 \\ subsample & (0.5, 1.0) & 0.93196 & 0.86975 \\ colsample\_bytree & (0.5, 1.0) & 0.72514 & 0.70505 \\ n\_estimators & (50, 300) & 300 & 218 \\ reg\_alpha & (1 \(\times\) 10\({}^{-9}\), 1.0) & 4.23191 & 5.33418 \\ reg\_lambda & (1 \(\times\) 10\({}^{-9}\), 100) & 0.00068 & 7.24844 \\ \hline \hline \end{tabular}
\end{table}
Table 3: The optimal parameter combinations for detecting CIC-IDS2017 and CIC-DDoS2019 using BO-XGBoost.