Adaptive confidence-aware deep authentication framework for secure industrial Internet of Things

Industrial Internet of Things (IIoT) deployments authenticate an increasing volume of heterogeneous device traffic under adversarial conditions, and single-stage classifiers—whether shallow or deep—tend to commit to a label at every operating point, including the ambiguous region where the decision boundary is least reliable. This behaviour inflates both the False Acceptance Rate (FAR) and the False Rejection Rate (FRR) precisely where an authentication system can least afford it. This paper studies a specific, narrow instance of confidence-based selective classification—an idea dating at least to Chow’s rule and later formalised for deep networks by Geifman and El-Yaniv and surveyed by Hendrickx et al.—applied to IIoT flow authentication, evaluating a two-stage pipeline in which a feed-forward deep neural network (DNN) escalates only its most ambiguous predictions to a Random Forest (RF) arbiter rather than a human operator. Rather than thresholding every prediction at 0.5, the framework partitions the DNN’s output probability into a high-confidence accept region, a high-confidence reject region, and a bounded uncertainty band; only requests that fall in the uncertainty band are escalated to a secondary ensemble vote, and the system fails closed (denies) whenever the two stages disagree. The framework is evaluated on a stratified 180,583-record subset of the X-IIoTID dataset (59 engineered features after cleaning, encoding and constant-column removal), split 70/15/15 into train, validation and test partitions; this subsample, rather than the full dataset or an independent IIoT capture, is the scope of the evaluation reported here. The proposed DNN attains 98.82% test accuracy and an AUC of 0.9991 on the binary authentication task, and a companion softmax variant attains 98.64% accuracy across ten fine-grained attack categories. Against four classical baselines—logistic regression, decision tree, linear SVM and Random Forest—the DNN is competitive but not uniformly dominant on raw accuracy: the standalone Random Forest baseline reaches higher accuracy (99.60%), lower FAR (0.668%), and lower FRR (0.137%) than the full adaptive DNN+RF pipeline (99.15% accuracy, 1.070% FAR, 0.647% FRR) reported below. The case for the adaptive pipeline over simply deploying the standalone Random Forest therefore cannot rest on measured accuracy, FAR, or FRR alone. Escalating only the 0.95% of test requests that fall inside the uncertainty band reduces FRR from 1.064% to 0.647% and FAR from 1.305% to 1.070% relative to static 0.5-threshold decisioning, while overall accuracy improves from 98.82% to 99.15%. These results, obtained from a single train/test split and a single trained instance of each model—statistical significance across repeated seeds was not evaluated in this study—indicate that selective, confidence-gated escalation applied to an automated fallback is a measurable, if incremental, way to concentrate ensemble-arbitration cost on a small fraction of IIoT traffic while reducing FRR and FAR relative to static thresholding.