Adaptive hybrid ensemble framework for intrusion detection in Industry 5.0 environments
Project description
Aegis-5: A Hybrid Ensemble Framework for Intrusion Detection in Industry 5.0 Driven Smart Manufacturing Environment
Published in: ACM Transactions on Autonomous and Adaptive Systems, 2026
DOI: 10.1145/3787224
Authors
- Vijay Govindarajan — Colorado State University, Fort Collins, CO, USA
- Faraz Ahmed — Crisp Technologies LLC, USA
- Zaid Bin Faheem — Wuhan University, Wuhan, China
- Muhammad Bilal — Rawalpindi Women University, Pakistan
- Manel Ayadi — Princess Nourah Bint Abdulrahman University, Riyadh, Saudi Arabia
- Jehad Ali — Ajou University, Suwon, South Korea
Abstract
Industry 5.0 represents a transformative paradigm that emphasizes synergy between human expertise, intelligent systems, and hyper-connected cyber-physical environments. While this evolution fosters personalized automation and resilient production, it also amplifies the cybersecurity risks inherent in Industrial Internet of Things (IIoT) infrastructures.
We present Aegis-5, a novel adaptive hybrid ensemble framework explicitly designed for intrusion detection in Industry 5.0-enabled smart manufacturing ecosystems. The proposed model integrates five diverse classifiers — Random Forest, Gradient Boosting, XGBoost, SVM, and K-Nearest Neighbors — using a dynamic weighting strategy guided by per-class precision, recall, and F1-score performance in real time. A meta-learner further synthesizes these predictions to enhance robustness against sophisticated and zero-day attacks.
We evaluate the model using two benchmark IIoT datasets: IoT-23 and CIC-IoT 2023, both of which capture a broad spectrum of real-world industrial threats. Experimental results demonstrate that our framework achieves superior performance, with accuracy rates of 99.98% on IoT-23 and 99.95% on CIC-IoT 2023, coupled with precision (99.97%, 99.93%), recall (99.96%, 99.92%), and F1-score (99.96%, 99.93%) respectively.
Key Contributions
- Dynamic Hybrid Ensemble Framework integrating five classifiers with real-time adaptive weighting
- Meta-learning via Logistic Regression with hybrid soft/hard voting for robustness against zero-day attacks
- Evaluation on real-world IIoT datasets (IoT-23 and CIC-IoT 2023) with advanced preprocessing
- State-of-the-art detection accuracy (99.98% on IoT-23, 99.94% on CIC-IoT 2023)
- Scalable, latency-sensitive solution aligned with Industry 5.0 cyber-physical requirements
Implementation
This repository includes a Python implementation of the Aegis-5 framework.
Setup
pip install -r requirements.txt
Usage
from aegis5 import Aegis5
model = Aegis5(
confidence_threshold=0.95, # tau for hybrid voting
beta=2.0, # temperature for dynamic weighting
use_feature_selection=True, # ANOVA F-test + RFECV
use_pca=True, # PCA dimensionality reduction
use_smote=True # SMOTE for class imbalance
)
model.fit(X_train, y_train)
results = model.evaluate(X_test, y_test)
Demo
Run the demo with a synthetic IIoT dataset:
python demo.py
Architecture
- Base Classifiers: Random Forest, Gradient Boosting, XGBoost, SVM, KNN (tuned hyperparameters from Table 4)
- Dynamic Weighting: Per-class softmax over F1-scores in a sliding window (Eq. 2, K=1000, β=2.0)
- Meta-Learner: Logistic Regression synthesizing weighted base classifier probabilities
- Hybrid Voting: Soft voting when meta-learner confidence ≥ τ (0.95), hard voting otherwise (Algorithm 1)
- Preprocessing: Median imputation → StandardScaler → ANOVA F-test + RFECV → PCA → SMOTE
Keywords
Industry 5.0, Smart Manufacturing, Hybrid Ensemble Framework, Real-Time Threat Detection, IIoT Security, Cyber-Physical Systems, Adversarial Training, Meta-Learning
Citation
@article{govindarajan2026aegis5,
title={Aegis-5: A Hybrid Ensemble Framework for Intrusion Detection in Industry 5.0 Driven Smart Manufacturing Environment},
author={Govindarajan, Vijay and Ahmed, Faraz and Faheem, Zaid Bin and Bilal, Muhammad and Ayadi, Manel and Ali, Jehad},
journal={ACM Transactions on Autonomous and Adaptive Systems},
year={2026},
doi={10.1145/3787224},
publisher={ACM}
}
Paper
The full paper is available at ACM Digital Library.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file aegis5-0.1.0.tar.gz.
File metadata
- Download URL: aegis5-0.1.0.tar.gz
- Upload date:
- Size: 1.6 MB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.12
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
b8b2b1ab89a1674a3476fbdba9819d31d4c4709d94c58060e8f01d2fa9eaaa5a
|
|
| MD5 |
37d8da088cae58093fc039351905985b
|
|
| BLAKE2b-256 |
70ebf1b57bc20904f013c6003ef6e2dc4530b550e824bc5b0b6aa7aaf2e74a03
|
Provenance
The following attestation bundles were made for aegis5-0.1.0.tar.gz:
Publisher:
publish.yml on vijaygovindaraja/Aegis5
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
aegis5-0.1.0.tar.gz -
Subject digest:
b8b2b1ab89a1674a3476fbdba9819d31d4c4709d94c58060e8f01d2fa9eaaa5a - Sigstore transparency entry: 1280998565
- Sigstore integration time:
-
Permalink:
vijaygovindaraja/Aegis5@20a6709f57ccbb1784af78cba2e260e742c0f940 -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/vijaygovindaraja
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@20a6709f57ccbb1784af78cba2e260e742c0f940 -
Trigger Event:
release
-
Statement type:
File details
Details for the file aegis5-0.1.0-py3-none-any.whl.
File metadata
- Download URL: aegis5-0.1.0-py3-none-any.whl
- Upload date:
- Size: 10.0 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.12
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
4b8e7de7d1a4134b87266c97414605c42ad07d9763d4a3211af6caaf33d0fe6c
|
|
| MD5 |
aa2b8aa876da8640c6169496adafdd9e
|
|
| BLAKE2b-256 |
9ffc117c69a68c4ca86f1355a69e6baf5ba1eae6a154396eab2389d009d298f1
|
Provenance
The following attestation bundles were made for aegis5-0.1.0-py3-none-any.whl:
Publisher:
publish.yml on vijaygovindaraja/Aegis5
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
aegis5-0.1.0-py3-none-any.whl -
Subject digest:
4b8e7de7d1a4134b87266c97414605c42ad07d9763d4a3211af6caaf33d0fe6c - Sigstore transparency entry: 1280998579
- Sigstore integration time:
-
Permalink:
vijaygovindaraja/Aegis5@20a6709f57ccbb1784af78cba2e260e742c0f940 -
Branch / Tag:
refs/tags/v0.1.0 - Owner: https://github.com/vijaygovindaraja
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@20a6709f57ccbb1784af78cba2e260e742c0f940 -
Trigger Event:
release
-
Statement type: