## 3 Methodology
### The XGBoost Model  
As the core component of the proposed architecture, XGBoost is instrumental in achieving high-performance multi-class intrusion detection in the Industrial Internet of Things (IIoT). Therefore, we will introduce the XGBoost model subsequently. We assume that the number of categories is \(K\), and the number of samples is \(N\). Before training begins, initialize the score belonging to each category \(k\) for each sample \(i\) as \(f_{ik}^{(0)}=0\). Using the Softmax function, the initial prediction probability can be calculated as  
\[p_{ik}^{(0)}=\frac{\exp\Bigl{(}f_{ik}^{(0)}\Bigr{)}}{\sum_{j=1}^{K}\exp\Bigl{(} f_{ij}^{(0)}\Bigr{)}} \tag{1}\]  
XGBoost maps the output of the tree to multiple class probability spaces using the Softmax function, and it gradually fits multiple trees through gradient boosting [12]. In each iteration, the model constructs and optimizes a new tree to minimize the current loss. The loss function can be represented as  
\[L=-\sum_{i=1}^{N}\sum_{k=1}^{K}y_{ik}\log p_{ik} \tag{2}\]  
where \(y_{ik}\) is the true label of sample \(i\). If it belongs to the \(k\)-th class, then \(y_{ik}=1\); otherwise, \(y_{ik}=0\), and \(p_{ik}\) is the probability that sample \(i\) is predicted as the \(k\)-th class. To measure the deviation between model predictions and true labels, it is necessary to calculate the first derivative \(g_{ik}\) and the second derivative \(h_{ik}\) of the current score \(f_{ik}\), which can be expressed as  
\[g_{ik}=\frac{\partial L}{\partial f_{ik}}=p_{ik}-y_{ik} \tag{3}\]  
\[h_{ik}=\frac{\partial^{2}L}{\partial f_{ik}^{2}}=p_{ik}(1-p_{ik}) \tag{4}\]  
We assume that the \(j\)-th leaf node of the tree is \(j\), and \(\lambda\) is a regularization parameter that controls the complexity of the model. Furthermore, XGBoost builds a tree for each category in the current iteration and uses splitting gains to select feature splitting points to increase the accuracy of category prediction. The leaf node weights of the tree are optimized based on \(h_{ik}\) and \(g_{ik}\), and the weight calculation formula is  
\[w_{j}=-\frac{\sum_{i\in j}g_{ik}}{\sum_{i\in j}h_{ik}+\lambda} \tag{5}\]  
After the new tree is generated, add its output value to the current score. For each sample \(i\) and its corresponding category \(k\), the score update formula is  
\[f_{ik}^{(t+1)}=f_{ik}^{(t)}+w_{ik}^{(t)} \tag{6}\]  
Here, \(w_{ik}^{(t)}\) is the output of the new tree for the \(k\)-th class in this iteration. After each iteration, the updated score is mapped to the corresponding category probability for better gradient calculation in the next step. The predicted probability for each sample is  
\[p_{ik}^{(t+1)}=\frac{\exp\Bigl{(}f_{ik}^{(t+1)}\Bigr{)}}{\sum_{j=1}^{K}\exp \Bigl{(}f_{ij}^{(t+1)}\Bigr{)}} \tag{7}\]  
Then, continue iterating and updating to gradually build new trees, updating scores until the preset stopping conditions are met. The stopping condition can be reached when the maximum number of trees is reached or convergence is lost.  
After training, the output of the model is the category score \(f_{ik}\) corresponding to each sample \(i\). Use the Softmax function to convert scores into predicted probabilities:  
\[p_{ik}=\frac{\exp(f_{ik})}{\sum_{j=1}^{K}\exp\bigl{(}f_{ij}\bigr{)}} \tag{8}\]  
The final predicted category is the category with the highest probability, which is \(\arg\max_{k}p_{ik}\). Therefore, XGBoost can achieve efficient multi-class learning.