The Critical Role of Dataset Balancing in Rare-Class Detection for Multi-Class SCADA/IIoT IDS
23.Uluslararası İstanbul Fen, Mühendislik, Mimarlık ve Matematik Bilimlerinde Bilimsel Araştırmalar Kongresi, İstanbul, Türkiye, 20 - 22 Kasım 2025, ss.1282-1289, (Tam Metin Bildiri)
- Yayın Türü: Bildiri / Tam Metin Bildiri
- Basıldığı Şehir: İstanbul
- Basıldığı Ülke: Türkiye
- Sayfa Sayıları: ss.1282-1289
- Marmara Üniversitesi Adresli: Evet
Özet
Abstract
There exists class imbalance problem in SCADA and IIoT networks due to the fact that some attack patterns are massively more frequent than others in reality, which will lead intrusion detection systems targeting at SCADA/IIoT data to be biased towards majority behaviors rather than rare but critical attacks. Therefore, while overall accuracy may be high, significant threats can go undetected. Utilizing it, this paper investigates the significance of data balancing in dealing with rare-class detection and offers a deployment focused view for imbalance treatment in the industrial setting. We identify the levels of imbalance in popular SCADA/IIoT datasets and study how they affect performance metrics. Balancing techniques including minority attack oversampling, to restrict the dominance of the majority class and generating artificial samples to increase diversity are discussed. In addition, class weighting and threshold manipulation for operational tasks are evaluated. The primary contribution that this work makes is a single framework combining balancing strategies, class-sensitive training and explainability-based validation for multi-class SCADA/IIoT intrusion detection. Contrary to previous work, we put post-balanced explainability checks in combination with threshold adjustment (beyond balanced explanation) to improve robustness when deployed. It also provides a useful perspective on the relationships between balancing decisions and facility requirements - an area often overlooked in the literature. The strategy aims at model explanations closely aligning with the engineering physical domain knowledge, which promotes transparency and ease of audit. For rare classes, it is known that the dynamic threshold readjustment is beneficial in terms of long term performance. The overall accuracy may not be meaningful in the imbalanced conditions and class level metrics are more valuable. Once calibrated, explanation methods help verify that model decisions agree with expected industrial behavior. In general, it can be concluded that a structured balancing procedure enhances the performance of rare-class detection, limits false alarms and helps enhance the robustness of multi-class SCADA/IIoT IDSs.
Keywords: dataset balancing, class imbalance, rare-attacks, multi-class intrusion detection, SCADA, IIoT.