Anomaly classification in IIoT edge devices

An early Industrial Internet of Things (IIoT) Anomaly Detection reduces maintenance costs, minimizes machine downtime, increases safety, and improves product quality. A multi-class classifier that detects events, failures, or attacks is much more efficient than a simple binary classifier, as it relieves a human operator of the task of identifying anomaly causes, thereby avoiding wasted time that could compromise process performance and security. With these issues in mind, this paper aims to determine whether it can differentiate between a failure that generates a temperature increase in an IIoT device processor, a denial-of-service attack on an MQTT broker, and an event caused by an application executing on the IIoT edge device. Data used to perform the classification comes from a Raspberry Pi 3, specifically from its CPU (e.g., temperature, load, free memory, Wi-Fi sent and received packets). A k-nearest neighbors (KNN), random forest (RF), support vector machine (SVM), and Multilayer Perceptron (MLP) algorithms were trained. Considering metrics such as false positive rate, false negative rate, accuracy, F1-score, and execution time, we concluded that SVM and MLP were the best methods for the case study because of their accuracy (78.6 and 76.1, respectively) and low execution time (17.3ms and 0.35ms).