BRURIIoT: A Dataset for Network Anomaly Detection in IIoT with an Enhanced Feature Engineering Approach

This paper presents an enhanced methodology for network anomaly detection in Industrial IoT (IIoT) systems using advanced data aggregation and Mutual Information (MI)-based feature selection. The focus is on transforming raw network traffic into meaningful, aggregated forms that capture crucial temporal and statistical patterns. A refined set of 150 features including unique IP counts, TCP acknowledgment patterns, and ICMP sequence ratios was identified using MI to enhance detection accuracy. The approach is experimented with our BRURIIoT dataset comprising over 59 million network packets condensed into 3 million records. Unlike existing datasets with limited attack diversity or missing key features, BRURIIoT preserves nuanced attack behaviors in real-world IIoT devices. SHapley Additive exPlanations (SHAP) analysis demonstrated the importance of aggregated features in model predictions. Machine learning classifiers, including Support Vector Machine (SVM), Gradient Boost, XGBoost, CatBoost, KNN, AdaBoost, Random Forest, Extra Trees, and a custom DNN model are trained on the aggregated data achieved outstanding performance with an accuracy of 99.52%, precision of 98.20% and recall of 98.13%, F1-score of 98.17%. These results were validated using K-fold cross-validation to verify their robustness and reliability. The outcome of this work presents an enabling framework for scaling IIoT cyberattack detection via the application of advanced aggregation and feature engineering towards developing interpretable, scalable, and effective cybersecurity solutions. The findings address the urgent need for robust anomaly detection techniques for modern IIoT environments.