A layer-aware graph attention and patch transformer framework for multi-class IIoT attack classification

Abstract

The proliferation of IIoT devices has dramatically expanded the attack surface of critical infrastructure. IIoT systems span multiple communicating tiers from physical sensors to cloud back-ends, attackers increasingly exploit inter-tier boundaries in ways that single-layer detection cannot address. Existing intrusion detection approaches treat network traffic features as unordered, independent values, discarding the structural inter-feature relationships that are characteristic of attack behaviour in layered IIoT architectures. We propose LA-STGAT-PT (Layer-Aware Spatio-Temporal Graph Attention Network with Patch Transformer), an end-to-end deep learning framework for multi-class intrusion detection in IIoT environments. It integrates four components: (1) a Layer-Aware Graph that encodes statistically correlated and architecturally co-located features as a relational graph, enabling tier-aware reasoning over the IIoT protocol stack; (2) a Spatio-Temporal Graph Attention block (STGAT) that simultaneously models feature relationships across the graph and sequential patterns along the feature vector, then adaptively fuses both views; (3) a Patch Transformer Encoder that segments the fused embedding into sub-sequences and applies self-attention to capture long-range inter-group dependencies; and (4) a Dual-Head Output that jointly optimises for attack classification and normal-traffic reconstruction, using elevated reconstruction error as a secondary anomaly signal. Evaluated on the Edge-IIoTset benchmark across 14 attack classes and one normal class, LA-STGAT-PT achieves an overall accuracy of 99.96% and a macro-F1 score of 0.9955. Encoding IIoT protocol-layer topology as a relational graph and combining it with spatio-temporal feature modelling and patch-based self-attention yields state-of-the-art intrusion detection, demonstrating that structural domain knowledge can significantly improve deep learning-based NIDS.