A Dual-Module Intrusion Detection Framework for Industrial Internet Collaboration: Tackling Data Imbalance Challenges

In the industrial Internet environment, Due to its high-value attribute, data imbalance in network activity becomes a pressing concern. Rare attack-such as zero-day exploits and Advanced Persistent Threats (APTs)-pose significant risks, but their samples are often far fewer than those of normal or more common attack types. This imbalance can severely undermine the performance of intrusion detection systems, causing them to prioritize frequent attacks while overlooking rare, high-impact threats, thus weakening overall defense capabilities and compromising security in industrial environments. To address this challenge, we propose a dual-module intrusion detection system, CNN-WSG-IDS, specifically designed to handle data imbalance and significantly enhance the detection accuracy of minority-class threats in industrial Internet systems. The system consists of two core modules: the CNN-WSG module, which mitigates data imbalance by generating more balanced, high-quality data and enriching the diversity of training samples, and the IDS module, which optimizes detection performance during classification, improving both accuracy and reducing false-positive rates. To validate the system's effectiveness, we conducted exten-sive evaluations on the NSL-KDD and UNSW-NB15 datasets. The results demonstrate that, compared to traditional intrusion detection methods, CNN-WSG-IDS not only effectively mitigates the negative impact of data imbalance but also substantially improves the detection rate of minority attacks, highlighting its utility in safeguarding industrial Internet systems against both common and rare threats.