Real-Time Intrusion Detection in IIoT/OT Networks Via Traffic-Feature Forecasting: A Testbed Study

Industrial Internet of Things (IIoT) and operational technology (OT) networks are increasingly integrated with physical processes, enabling real-time sensing and actuation while widening the cyber-physical attack surface. Enterprise intrusion detection systems (IDS) often rely on payload inspection, signatures, or high-dimensional engineered features that are difficult to deploy in OT and may yield high false-positive rates while missing some anomalies. This work presents a lightweight IDS for IIoT/OT environments that relies only on passive, per-second traffic telemetry and residual-based forecasting. From mirrored traffic, we extract low-cost statistical features, forming a dataset representation without payload parsing. We emulate denial-ofservice (DoS) flooding and injection/replay manipulations, and use simple rule-based thresholds to label traffic and construct a supervised benchmark dataset. We evaluate two forecastingbased detectors: (i) a supervised Random Forest (RF) forecaster trained on rule-labeled data, and (ii) a one-class Long ShortTerm Memory (LSTM) forecaster trained exclusively on normal traffic (label-free). Real-world experiments on a prototype PLC-to-motor-drive control loop with an external attack platform show that an LSTM-based, residual-driven temporal forecasting approach enables a robust and scalable IDS suitable for timingconstrained IIoT/OT deployments, achieving 100% detection with zero false alarms in the evaluated scenarios.