The rapid expansion of Industrial IoT (IIoT) systems has amplified security challenges, as heterogeneous devices and dynamic traffic patterns increase exposure to sophisticated and previously unseen cyberattacks. Traditional intrusion detection systems often struggle in such environments due to their reliance on extensive labeled data and limited ability to detect new threats. To address these challenges, we propose MI$^2$DAS, a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling, open-set recognition to distinguish between known and unknown attacks and incremental learning for adapting to novel attack types with minimal labeling. Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers. In the first layer, GMM achieves superior normal-attack discrimination (accuracy = 0.953, TPR = 1.000). In open-set recognition, GMM attains a recall of 0.813 for known attacks, while LOF achieves 0.882 recall for unknown attacks. For fine-grained classification of known attacks, Random Forest achieves a macro-F1 of 0.941. Finally, the incremental learning module maintains robust performance when incorporation novel attack classes, achieving a macro-F1 of 0.8995. These results showcase MI$^2$DAS as an effective, scalable and adaptive framework for enhancing IIoT security against evolving threats.

翻译：工业物联网（IIoT）系统的快速扩张加剧了安全挑战，异构设备和动态流量模式增加了遭受复杂及前所未见网络攻击的风险。传统的入侵检测系统在此类环境中往往表现不佳，因其依赖于大量标注数据且检测新威胁的能力有限。为应对这些挑战，我们提出了MI$^2$DAS，一个多层入侵检测框架。该框架集成了基于异常的分层流量池化、用于区分已知与未知攻击的开集识别，以及能以最少标注适应新型攻击类型的增量学习。在Edge-IIoTset数据集上进行的实验表明，该框架在所有层级均表现出强劲性能。在第一层，GMM实现了优异的正常-攻击判别能力（准确率 = 0.953，真正率 = 1.000）。在开集识别中，GMM对已知攻击的召回率达到0.813，而LOF对未知攻击的召回率达到0.882。对于已知攻击的细粒度分类，随机森林的宏平均F1分数达到0.941。最后，增量学习模块在纳入新型攻击类别时保持了稳健的性能，宏平均F1分数达到0.8995。这些结果表明，MI$^2$DAS是一个有效、可扩展且自适应的框架，能够增强IIoT安全性以应对不断演变的威胁。