{"id":"https://openalex.org/W7204252960","doi":"https://doi.org/10.21203/rs.3.rs-9889062/v1","title":"Network Dominance and the MITM Exception: A Modality-Aware Analysis of IIoT Intrusion Detection on the DataSense Benchmark","display_name":"Network Dominance and the MITM Exception: A Modality-Aware Analysis of IIoT Intrusion Detection on the DataSense Benchmark","publication_year":2026,"publication_date":"2026-08-26","ids":{"openalex":"https://openalex.org/W7204252960","doi":"https://doi.org/10.21203/rs.3.rs-9889062/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-9889062/v1","doi":"https://doi.org/10.21203/rs.3.rs-9889062/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-9889062/v1","pdf_url":"https://www.researchsquare.com/article/rs-9889062/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-9889062/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125074919","display_name":"Okoi Michael Obeten","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210154431","display_name":"Auchi Polytechnic","ror":"https://ror.org/058qd2v11","country_code":"NG","type":"education","lineage":["https://openalex.org/I4210154431"]}],"countries":["NG"],"is_corresponding":true,"raw_author_name":"Okoi Michael Obeten","raw_affiliation_strings":["Auchi Polytechnic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Auchi Polytechnic","institution_ids":["https://openalex.org/I4210154431"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5094310436","display_name":"Omowumi Hafsat Aliu","orcid":"https://orcid.org/0009-0009-4666-9563","observed_orcids":["https://orcid.org/0009-0009-4666-9563"]},"institutions":[{"id":"https://openalex.org/I4210154431","display_name":"Auchi Polytechnic","ror":"https://ror.org/058qd2v11","country_code":"NG","type":"education","lineage":["https://openalex.org/I4210154431"]}],"countries":["NG"],"is_corresponding":false,"raw_author_name":"Omowumi Hafsat Aliu","raw_affiliation_strings":["Auchi Polytechnic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Auchi Polytechnic","institution_ids":["https://openalex.org/I4210154431"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5125074919"],"corresponding_institution_ids":["https://openalex.org/I4210154431"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/industrial-internet-of-things","display_name":"Industrial Internet of Things","score":0.9380000233650208},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.9700000286102295},{"id":"https://openalex.org/keywords/network-traffic-features","display_name":"network traffic features","score":0.7929999828338623},{"id":"https://openalex.org/keywords/man-in-the-middle-attacks","display_name":"man-in-the-middle attacks","score":0.8399999737739563},{"id":"https://openalex.org/keywords/feature-fusion","display_name":"feature fusion","score":0.6019999980926514},{"id":"https://openalex.org/keywords/attack-classification","display_name":"attack classification","score":0.5730000138282776},{"id":"https://openalex.org/keywords/shap-attribution","display_name":"SHAP feature attribution","score":0.7829999923706055},{"id":"https://openalex.org/keywords/critical-infrastructure-security","display_name":"critical infrastructure security","score":0.6570000052452087}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6104000210762024},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6036999821662903},{"id":"https://openalex.org/C183121708","wikidata":"https://www.wikidata.org/wiki/Q209867","display_name":"Telemetry","level":2,"score":0.5491999983787537},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.541700005531311},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5002999901771545},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3977000117301941},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3864000141620636},{"id":"https://openalex.org/C151913843","wikidata":"https://www.wikidata.org/wiki/Q3454555","display_name":"Dominance (genetics)","level":3,"score":0.34459999203681946},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.3407000005245209},{"id":"https://openalex.org/C32946077","wikidata":"https://www.wikidata.org/wiki/Q618079","display_name":"Network analysis","level":2,"score":0.3046000003814697},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.3041999936103821},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29910001158714294},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.29750001430511475},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.288100004196167},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.2784999907016754},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.27480000257492065},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2743000090122223},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.27160000801086426},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.26510000228881836},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.2621999979019165},{"id":"https://openalex.org/C104122410","wikidata":"https://www.wikidata.org/wiki/Q1416406","display_name":"Network model","level":2,"score":0.25780001282691956},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2529999911785126}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-9889062/v1","doi":"https://doi.org/10.21203/rs.3.rs-9889062/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-9889062/v1","pdf_url":"https://www.researchsquare.com/article/rs-9889062/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-9889062/v1","doi":"https://doi.org/10.21203/rs.3.rs-9889062/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-9889062/v1","pdf_url":"https://www.researchsquare.com/article/rs-9889062/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.5378999710083008,"display_name":"Industry, innovation and infrastructure"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204252960.pdf","grobid_xml":"https://content.openalex.org/works/W7204252960.grobid-xml"},"referenced_works_count":44,"referenced_works":["https://openalex.org/W2153635508","https://openalex.org/W2295598076","https://openalex.org/W2797742547","https://openalex.org/W2911964244","https://openalex.org/W3096448935","https://openalex.org/W3106741970","https://openalex.org/W3210577968","https://openalex.org/W4226319939","https://openalex.org/W4239510810","https://openalex.org/W4283792068","https://openalex.org/W4382281941","https://openalex.org/W4384787750","https://openalex.org/W4386386840","https://openalex.org/W4387010638","https://openalex.org/W4387682168","https://openalex.org/W4390188522","https://openalex.org/W4390483481","https://openalex.org/W4391986380","https://openalex.org/W4392347784","https://openalex.org/W4393192421","https://openalex.org/W4399300323","https://openalex.org/W4399307557","https://openalex.org/W4400042137","https://openalex.org/W4402223817","https://openalex.org/W4403216970","https://openalex.org/W4403898931","https://openalex.org/W4405030644","https://openalex.org/W4405062066","https://openalex.org/W4407220666","https://openalex.org/W4407402579","https://openalex.org/W4407759436","https://openalex.org/W4408323749","https://openalex.org/W4410597999","https://openalex.org/W4411848533","https://openalex.org/W4415205097","https://openalex.org/W4415359185","https://openalex.org/W4416114192","https://openalex.org/W4416406874","https://openalex.org/W4416580945","https://openalex.org/W4416757219","https://openalex.org/W4416771909","https://openalex.org/W4417225861","https://openalex.org/W7131648545","https://openalex.org/W7160306513"],"related_works":["https://openalex.org/W7123454691","https://openalex.org/W4320919659","https://openalex.org/W3198846156","https://openalex.org/W6908296228","https://openalex.org/W7214032342","https://openalex.org/W3197213531","https://openalex.org/W7131870547","https://openalex.org/W7214930908","https://openalex.org/W4388341830","https://openalex.org/W7128784124"],"abstract_inverted_index":{"Abstract":[0],"The":[1,223],"Industrial":[2],"Internet":[3],"of":[4,13,52,65,77,86,114,183,201,206],"Things":[5],"(IIoT)":[6],"is":[7,159],"rapidly":[8],"expanding":[9],"the":[10,26,62,93,155,176,184,214,240,253],"attack":[11,208],"surface":[12],"critical":[14],"infrastructure,":[15],"and":[16,40,48,100,108,118,125,133,144,173,230],"intrusion":[17,88],"detection":[18,89,172],"systems":[19],"(IDSs)":[20],"are":[21],"increasingly":[22],"relied":[23],"upon":[24],"as":[25,34,244],"principal":[27],"automated":[28],"defence.":[29],"Recent":[30],"benchmark":[31],"datasets":[32],"such":[33],"DataSense":[35,248],"provide":[36],"synchronized":[37],"network":[38,99,107,156,194,254],"traffic":[39],"device":[41],"telemetry":[42,102,110,221,242],"to":[43,105],"enable":[44],"cross-modal":[45],"IDS":[46],"research,":[47],"a":[49,83],"growing":[50],"body":[51],"work":[53],"assumes":[54],"that":[55,154,193],"combining":[56],"these":[57],"modalities":[58],"improves":[59],"detection.":[60],"However,":[61],"per-attack-category":[63],"contribution":[64],"each":[66,139],"modality":[67],"has":[68],"not":[69],"been":[70],"empirically":[71],"tested":[72],"on":[73,90,163,170,175],"this":[74],"newest":[75],"generation":[76],"IIoT":[78,87,238],"benchmarks.":[79],"This":[80],"paper":[81],"presents":[82],"modality-aware":[84],"analysis":[85],"DataSense,":[91],"partitioning":[92],"84":[94],"pre-extracted":[95],"features":[96,111,165,195,243],"into":[97],"76":[98],"8":[101,241],"channels":[103],"(reduced":[104],"64":[106],"7":[109],"after":[112],"removal":[113],"leakage-prone":[115],"string-valued":[116],"columns)":[117],"constructing":[119],"three":[120],"feature":[121],"configurations:":[122],"network-only,":[123],"telemetry-only,":[124],"fused.":[126],"We":[127],"train":[128],"Random":[129],"Forest,":[130],"XGBoost,":[131],"LightGBM,":[132],"Support":[134],"Vector":[135],"Machine":[136],"classifiers":[137],"under":[138],"configuration":[140,186],"for":[141,197,236],"binary,":[142],"seven-class,":[143],"fine-grained":[145],"eighty-four-class":[146],"classification,":[147],"producing":[148],"36":[149],"experimental":[150],"conditions.":[151],"Results":[152],"show":[153],"channel":[157],"alone":[158],"nearly":[160],"sufficient:":[161],"XGBoost":[162],"network-only":[164],"achieves":[166],"0.9890":[167],"macro":[168],"F1":[169],"binary":[171],"0.9819":[174],"seven-class":[177],"task,":[178],"within":[179],"0.6":[180],"percentage":[181],"points":[182],"fused":[185],"in":[187,204,247],"every":[188],"category.":[189],"SHAP":[190],"attribution":[191],"confirms":[192],"account":[196],"over":[198,252],"99":[199],"percent":[200,220],"explanatory":[202],"weight":[203],"six":[205],"seven":[207],"categories,":[209],"with":[210],"man-in-the-middle":[211],"(MITM)":[212],"being":[213],"single":[215],"exception":[216],"at":[217],"approximately":[218],"10":[219],"contribution.":[222],"dominance":[224],"result":[225],"holds":[226],"across":[227],"both":[228],"1-second":[229],"10-second":[231],"window":[232],"granularities.":[233],"Practical":[234],"implication:":[235],"cost-constrained":[237],"monitoring,":[239],"currently":[245],"engineered":[246],"add":[249],"minimal":[250],"value":[251],"channel,":[255],"except":[256],"when":[257],"MITM-class":[258],"attacks":[259],"must":[260],"be":[261],"distinguished.":[262]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-08-27T00:00:00"}