AI-DRIVEN CYBERSECURITY FOR INDUSTRIAL IOT: COMBINING GRAPH NEURAL NETWORKS, FEDERATED LEARNING AND EXPLAINABLE AI

Abstract

The Industrial Internet of Things (IIoT) has transformed modern industrial environments by connecting sensors, programmable logic controllers, supervisory control systems, machines, gateways, and cloud platforms into highly interconnected cyber-physical ecosystems. Although this connectivity improves operational efficiency, predictive maintenance, automation, and real-time decision-making, it also expands the attack surface and creates new cybersecurity challenges. Conventional intrusion detection approaches often struggle with heterogeneous device behavior, evolving attack patterns, distributed data, limited computational resources, and the requirement for rapid and interpretable security decisions. This paper proposes an integrated artificial intelligence framework for IIoT cybersecurity that combines Graph Neural Networks (GNNs), Federated Learning (FL), and Explainable Artificial Intelligence (XAI). The proposed architecture represents industrial communication environments as dynamic graphs, allowing GNNs to capture relationships among devices, communication flows, and operational entities. Federated learning enables multiple industrial sites or edge nodes to collaboratively train a security model without directly exchanging sensitive raw telemetry. XAI mechanisms provide human-interpretable explanations of detected anomalies and attack classifications, thereby improving analyst trust and facilitating incident investigation. The framework additionally incorporates secure aggregation, client-level anomaly monitoring, adaptive graph construction, and risk-aware decision-making. A comprehensive evaluation methodology is proposed using accuracy, precision, recall, F1-score, false-positive rate, detection latency, communication overhead, computational cost, privacy leakage, robustness against poisoning attacks, and explanation fidelity. The paper argues that the integration of relational learning, decentralized intelligence, and interpretability provides a promising direction for trustworthy IIoT security, while recognizing unresolved challenges involving non-IID data, adversarial model updates, concept drift, resource constraints, and explanation reliability.