SHAP enhanced transformer GWO boosting model for transparent and robust anomaly detection in IIoT environments

The rapid adoption of the Industrial Internet of Things (IIoT) has transformed factory operations by enabling real-time monitoring and automation, but it has also exposed production environments to frequent anomalies and cyber-physical risks. Traditional machine learning approaches such as Random Forests, Support Vector Machines, and ensemble boosting methods have demonstrated strong performance, yet they often face limitations when dealing with data imbalance, temporal dependencies, and concept drift in evolving sensor streams. In this study, we propose a hybrid framework that integrates a temporal transformer encoder with a Logistic Boosting classifier, enhanced through bio-inspired feature optimization using the Grey Wolf Optimizer. The transformer component captures sequential patterns in sensor data, while the optimization layer refines feature selection to improve generalization. Logistic Boosting then provides robust classification, balancing sensitivity and precision under imbalanced conditions. Experiments were conducted on a real-world six-month dataset of 15,000 sensor readings collected from a smart manufacturing facility. The proposed model achieved an accuracy of 98.2%, with 96.7% precision, 97.1% recall, an F1-score of 0.969, and an AUC of 0.996, outperforming the baseline Logistic Boosting model (96.6% accuracy, AUC 0.992). In addition to superior predictive performance, the framework demonstrated resilience under data drift scenarios and maintained low inference latency suitable for edge deployment. In addition to high predictive accuracy, the framework provides explainable outputs using SHAP analysis, ensuring that anomaly alerts are transparent and interpretable for industrial operators. These findings highlight the effectiveness of combining temporal transformers, boosting ensembles, and metaheuristic optimization for accurate detection of unusual events in IoT-enabled factories, offering a framework that can be applied across different factories or scaled to larger datasets without major redesign towards secure and adaptive industrial systems.