Topology-Aware Big Data Analytics for IIoT DDoS Detection Using Sliding Visibility Graph-Derived Time-Series Features
Main article
Abstract
Industrial Internet of Things (IIoT) environments generate high-volume, time-ordered network traffic in which distributed denial-of-service attacks often appear not only as abrupt increases in packet rate but also as structural changes in temporal connectivity. This article develops a topology-aware big data analytics framework for IIoT DDoS detection by transforming packet-count time series into sliding visibility graph (SVG) representations and fusing graph-derived features with conventional statistical descriptors. The proposed framework is designed for scalable data processing, interpretable anomaly detection, and deployment-oriented risk scoring. Using a benchmark IIoT traffic setting inspired by recent CIC IIoT DDoS experiments, the study analyzes packet-window construction, z-score normalization, SVG feature extraction, feature fusion, SVM-based classification, and management-oriented interpretation of traffic families. Results show that statistical features capture local dispersion and shape, whereas SVG metrics capture temporal topology, burst isolation, community modularity, and degree-distribution behavior. The fused feature design achieves stronger detection performance than topology-only or statistics-only alternatives, with representative accuracy of 0.9716 and F1-score of 0.8954 under normalized windows. The article contributes to data science and big data technology by reframing IIoT intrusion detection as a hybrid stream-processing, network-science, and risk-analytics problem.
