An Edge-Deployable Lightweight Intrusion Detection System for Industrial Control

Industrial Control Systems (ICSs), critical to infrastructure, face escalating cyber threats under Industry 4.0, yet existing intrusion detection methods are hindered by attack sample scarcity, spatiotemporal heterogeneity of industrial protocols, and resource constraints of embedded devices. This paper proposes a four-stage closed-loop intrusion detection framework for ICSs, with its core innovations integrating the following key components: First, a protocol-conditioned Conditional Generative Adversarial Network (CTGAN) is designed to synthesize realistic attack traffic by enforcing industrial protocol constraints and validating syntax through dual-path discriminators, ensuring generated traffic adheres to protocol specifications. Second, a three-tiered sliding window encoder transforms raw network flows into structured RGB images, capturing protocol syntax, device states, and temporal autocorrelation to enable multiresolution spatiotemporal analysis. Third, an Efficient Multiscale Attention Visual State Space Model (EMA-VSSM) is developed by integrating gate-enhanced state-space layers with multiscale attention mechanisms and contrastive learning, enhancing threat detection through improved long-range dependency modeling and spatial–temporal correlation capture. Finally, a lightweight EMA-VSSM student model, developed via hierarchical distillation, achieves a model compression rate of 64.8% and an inference efficiency enhancement of approximately 30% relative to the original model. Experimental results on a real-world ICS dataset demonstrate that this lightweight model attains an accuracy of 98.20% with a False Negative Rate (FNR) of 0.0316, outperforming state-of-the-art baseline methods such as XGBoost and Swin Transformer. By effectively balancing protocol compliance, multi-resolution feature extraction, and computational efficiency, this framework enables real-time deployment on resource-constrained ICS controllers.