Because IIoT plays a critical role in the modern industrial revolution and livelihood, creating a resilient security system to protect IIoT devices is paramount (Wurm et al., 2016). However, the IIoT has resource-constraint problems, and they are deployed in hostile distributed environments, which expose their network interfaces to external access and cyberattacks. The issues above can be mitigated by placing a MEC server at the edge of the IIoT network, which hosts a sophisticated security system. The proposed method demonstrates the deployment of an online machine learning–based security (MLS) system to the MEC server while offloading the MLS task from the IIoT devices at a timely interval to perform deep intrusion analysis and provide adequate security for the connected IIoT devices. An online machine learning algorithm is employed in our proposed method to enhance the security model ability to continuously learn new attacks and normal data to prevent it from been obsolete. The offloading process between the IIoT and the MEC server must be optimized to achieve real-time security response. Because of the number of IIoT devices that share the MEC server resources in the network topology, three common problems arise (Akherfi et al., 2018).

• Network congestion

This paper presents a novel ASTO that uses a minimum resource to offload computational MLS from the IIoT devices (nodes or the sources) to a proximal MEC server (vertices). The MEC server receives the IIoT end device request and creates a schedule for offloading MLS task based on the availability of resources, congestion rate (latency on the network), and priority of the task. Each IIoT in the queue receives an update timestamp from the MEC server to enhance time synchronization and energy consumption optimization. We also modeled the network between the IIoT devices and the MEC servers as a probabilistic direct acyclic graph. Moreover, we applied the Markov queuing process to optimize the congestion and latency rate during the MLS task offloading. Our contributions in this paper are summarized as follows:

• We propose a novel energy-efficient ASTO to produce reliable security in a distributed large-scale IIoT network.

The rest of this paper is organized as follows: Section 2 contains the related works. Section 3 presents the mathematical models of the task offload process. Section 4 provides a detailed presentation of the proposed ASTO algorithm. Section 5 describes the experimental setup and performance evaluations, and Section 6 concludes our findings.

Consider a practical industrial context consisting of nth number of IIoT devices μ _n , such that each IIoT device can connect to one of the kth number of the proximal distributed MEC servers Φ _k , through a wireless connection with distance δ at the edge of the network. We also assumed that each IIoT device connects to a selected MEC server in an orthogonal link, whereas the IIoT devices share security information through context-awareness. Let ϑ represent the network traffic density for the interconnected IIoT devices and the MEC servers. By applying Poisson distribution for a large-scale network, the probability of selecting the closest MEC server Φ _k with a wireless link x _n can be expressed as follows: F Φ k , x n = χ Φ e − χ Φ k ! , Φ k ≥ 0 (1) where χ = ϑx signifies the Poisson distribution parameter for a random bounded section of the distributed network. We obtain the probability that the distance between the connected IIoT device and a MEC is minimal than δ. Hence, the likelihood that at least one IIoT connects to a MEC server within δ is expressed as follows: ρ c δ ≤ x n = F x n = 1 − e − ϑ x n (2)

Considering that the IIoT devices connects to a MEC server in an industrial settings, we define a variable R k to determine whether the MEC servers Φ _k are deployed at location L ; then, we can express the variable as follows: R k = 1  if MEC server  Φ k  is deployed at location  L , 0  otherwise.  (3)

However, let the probability that there is no accessible MEC server available for the IIoT device be represented as ρ _o at a distance δ such that MLS task offloading can take place is given by ρ o = F 0 , x n = e − ϑ x n (4)

The state of ρ _o could occur when all the MEC servers are engaged with an equally important task to execute. However, the IIoT device will move into a waiting state and continue to retry till a connection is established to a MEC server. This state is considered in the MLS task offload model in the following subsection.

In a MEC-IIoT environment, each IIoT device executes MLS locally or remotely on the MEC servers. We represent each MLS task as φ[γ, τ, κ] where γ denotes the input size (in bit), τ denotes completion deadline (in seconds), and κ is the computational workload intensity (in CPU cycles per bit). Moreover, the MLS algorithms are implemented on various MEC servers based on a virtualized platform (Bing et al., 2019; Doan et al., 2019) that leverages the current improvements in NFV, information-centric, and software-defined network. During task offloading processes, the IIoT devices could be destructed by network attacks, such as denial-of-service (DoS) network flooding, increasing energy consumption and latency. In our proposed model, the MLS detects network attacks, thereby mitigating all attacks to enhance the optimal offloading process. All our assumptions are based on these virtualization technologies. The MLS begins its process on the IIoT devices and performs deep intrusion analysis, which requires high computation resources on the MEC server. During the MLS task offloading process, energy and latency must be paramount. We represent the task offloading algorithms with the principle of the task call graph. Figure 2 shows the directed acyclic graph (DAG) of a computational offloading.

For a computational MLS task φ[γ, τ, κ] with CPU clock speed fm, the total energy that is required to execute the task on the IIoT is derived as follows: E m = z γ κ f m 2 (5) and the base execution latency task of φ[γ, τ, κ] can be calculated with the equation T m = γ κ f m (6) where z = 1 denotes the coefficient of proportionality of the energy consumed per CPU cycle on the IIoT device. If the wireless bandwidth required during task offloading from each IIoT devices to the proximal MEC is H m , ϖ _m is the latency on the wireless network during the task offloading, and A m is the size of offloaded task, then we compute the wireless communication overheads ν _m as follows: ν m = ϖ m + A m H m (7)

According to Eqs 5–7, we can then compute the computational overhead in terms of offloading latency and energy as follows: C m = α m t T m + α m e E m + ν m , (8) where α m t and α m e represent the weighting parameters of computational time and energy for IIoT device, respectively. The α m t and α m e are expressed mathematically as follows: α m t , α m e ∈ 0,1 , α m t + α m e = 1 . (9)

Suppose each MLS task must be offloaded from the IIoT to the MEC server at the edge of the network, then the probability of losing a task during the offloading process is ρ. If a task is destroyed on any wireless networks, then it must be re-offloaded across a different route in the distributed network. The probability that the MLS task is offloaded successfully is denoted by (1 − ρ) ^r , where r is the total number of remote radio units (RRU) available and (1 − ρ) is the probability of successful offloaded task in d consecutive independent trials.

An IIoT composed of d MLS tasks is much less likely to offload efficiently on the first trial. In such a scenario, the d tasks must be offloaded over the RRU network until it is received successfully or a total of rd successful transmissions. The probability of such an instance is expressed as (1 − ρ) ^rd . Let ω be the random variable representing the number of times the MLS is offloaded over the selected wireless network path, the average number of offloaded tasks through the shortest path, E(ω), and q _r,d denote the probability that the task is offloaded successfully in d trials. The q _r,d can be expressed mathematically as follows: r , d = 1 − ρ r d q r , d = 1 − ∑ j = 1 d − 1 q r , j 1 − ρ r d (10)

All the previous attempts must have failed for the re-offloading to be accomplished on the dth try. For the possibility that the offloading succeeded for some j < d is ∑ j = 1 d − 1 q r , j , the prospect of failing is 1 − ∑ j = 1 d − 1 q r , j . Finally, the dth attempt must succeed to obtain (1 − ρ) ^r . However, using non-recursive computation, Eq. 8 can be expressed as follows: q r , d = 1 − ∑ j = 1 d − 1 q r , j 1 − p r q r , d = 1 − ρ r − 1 − ρ r ∑ j = 1 d − 1 q r , q r , d = q r , d − 1 − 1 − ρ r q r , d − 1 q r , d = ρ d − 1 1 − 1 − ρ r q r , d = q r , r 1 − 1 − ρ r d − 1 q r , d = 1 − ρ r 1 − 1 − ρ r d − 1 (11)

Then, the average number of transmissions required to offload a single MLS task to the MEC is given by E ω = ∑ d = 1 ∞ d 1 − ρ r 1 − 1 − ρ r d − 1 = 1 1 − ρ r (12)

We can also estimate the energy saved after offloading the MLS task completely to the selected MEC server as follows: E s v = ∑ d = 1 k δ d E d s v (13) where E d s v is the dth energy saved. If C _m represent the computational overhead in terms of offloading latency and energy, then, using Eqs 4, 6, E d s v for offloading MLS task to a MEC server can be calculated with the equation E d s v = E m − C m E ω (14)

We determined the shortest route from an IIoT device (source node) to a selected MEC server by analyzing a collection of available wireless links with a minimum distance and congestion (minimum latency). In the proposed model, the IIoT device denotes the source node, and the target vertex is the MEC server. We apply the shortest route analysis (SRA) approach to solve a minimization problem to create an optimization technique for the offloading process. Our adopted SRA uses the greedy search algorithm to find the optimal solution.

Let S denote a set of IIoT devices (nodes) connected in a network whose final shortest route to the MEC server is determined, μ _n is the source node, and Φ _k is any of the MEC server nodes connected to μ _n . ϑ is the cost of weight or the network traffic on the link between two nodes, and then, ϑ, in our scenario, can be defined as ϑ = [N _T , δ], where N _T is the offloaded tasks between two nodes, and δ is the distance between the nodes with a priority queue Q of Q = Φ k − S k (15)

We can represent our network topology as a directed graph G and find the shortest distance between the IIoT device and MEC server using Algorithm 1.

Algorithm 1

SRA(G, ϑ , S)

We made the following assumptions during our design process to help the IIoT device synchronize with the MEC server during the offloading process.

• Each IIoT device is considered a node that offloads its task and receives responses from the proximal MEC server.

The following two major steps were considered during the ATS processes:

Assume that there is c number of MEC servers at the network edge, and the various IIoT devices preparing to offload their data are organized in a queue according to a Poisson process with rate λ > 0. The inter-arrival times of the various IIoT devices are then independent and identically exponentially distributed with λ. The service times are also independent and identically exponentially distributed with rate υ > 0. We apply First-In First-Out principle and leave the queue Q capacity to infinity. This information indicates that the process X = { X t , t ≥ 0 } , where X t represent the number of IIoT end devices in the queue at time t, is a homogeneous Markov chain on state space S = N . The continuous-time Markov transition employs the birth-and-death process, where birth increase the number of IIoT end devices in the offloading queue (state variables) by one and death decrease the state by one. When birth transpires, the number of IIoT devices in the queue advances from state n to n + 1. When a death occurs, the queue goes from state n to state n − 1. The Markov chain state diagram is represented in Figure 4.

For any n ≥ 0, we represent λ _n by the transition rate from state n to state n + 1 and for any n ≥ 1, we denote by υ _n the transition rate from state n to state n − 1. We assume that υ _n > 0 for any n ≥ 1 and that υ _n > 0 for any n ≥ 1. The IIoT end device MLS task offloading process generates Q of chain represented as follows: Q = − λ 0 λ 0 0 0 0 … , υ 1 − λ 1 + υ 1 λ 1 0 0 … , 0 υ 2 − λ 2 + υ 2 λ 2 0 … , 0 0 υ 3 − λ 3 + υ 3 λ 3 … , ⋮ ⋮ ⋮ ⋱ ⋱ ⋱ (27)

The discrete-time Markov chain embedded during the transition period of X consists of the parameters p _n and q _n , for n ≥ 1 is expressed mathematically as follows: p n = λ n λ n + υ n  and  q n = υ n λ n + υ n (28)

However, we introduce a quantity η _n defined as follows: η 0 = 1  and  η n = υ 1 … , υ n λ 1 … λ n (29)

We then compute the sums A as follows: A = ∑ n = 0 ∞ η n (30)

The transition process converges to equilibrium with the expected time, w n = E τ X ( 0 ) ∣ X 0 = n , of the first passage to state 0, starting from state n. The first passage time τ X ( 0 ) to state 0 is defined as follows: τ X 0 = inf t ≥ T 1 ∣ X t = 0 (31) where T ₁ is the first instant of jump of chain X . The transient process with respect to X can be represented using the annotations X  is transient ⇔ A < ∞ , or X  is recurrent ⇔ A = ∞

To define the positive recurrence of chain X , it is no longer adequate in the discrete state to examine the invariant probability, and chain X is non-explosive, which is expressed as follows: v n = 1 − f n , 0 X = 1 A ∑ j = 0 n − 1 η j  if  A < ∞ 0  if  A = ∞ (32) where f n , 0 X is the probability, starting from n that the first return to state n occurs at X . If n ≥ 0, applying Equation (30) to η _n will produce η n = υ n n ! λ n  if  n ≤ c − 1 υ i c n − c c ! λ n  if  n ≥ c . (33)

However, the quantity A defined in Equation (32) is given by A = ∑ n = 0 c − 1 υ n n ! λ n + c ! c c ∑ n = c ∞ c υ λ n (34) where A < ∞⇔λ > cυ. The above relations indicate that chain X is non-explosive and uniform.

In this paper, we considered two types of errors that are likely to occur.

In this subsection, we demonstrate how the online machine learning method was used to design network attack detection system deployed to the MEC server. All the network traffic captured (MLS) by the IIoT devices are offloaded to MEC server using the proposed ASTO algorithm. Several machine learning methods exist in literature, but, to prove our concept, a stochastic gradient descent (SGD) was adopted to design an online network attack detection system. We adopted SGD due to the dynamic (frequent change in environmental data and network traffic) nature of the data offloaded from the IIoT devices. Moreover, cyberattackers keep changing their approaches. It is difficult to rely on classical machine learning methods to design a network attack detection system. Hence, using online SGD allows the model to learn new attacks and system operational data to prevent the model from becoming obsolete. Unlike batch gradient descent, which calculates the gradient using the whole dataset, SGD, also known as incremental gradient descent, iterates over a single randomly selected training sample to identify minimums or maximums. To achieve accurate results with SGD, the data sample should be in a stochastic order by shuffling the training set for every epoch. First, we define a cost function for determining the weights of i − th observation in the training dataset for an adaptive linear neuron as follows: J w = 1 2 ∑ i = 1 N y i − ϖ w T x i 2 (40) where x = [ x 1 , x 2 , … x i ] ∈ R is least squares with features from the training data, y = [ y 1 , y 2 , … , y i ] ∈ R denote the observations, w = [w ₁, w ₂, …, w _i ] are the weight vectors, and ϖ represent the an activation function. If a defined negative gradient weight change Δw is multiply by a learning rate r, then the cost function can be expressed as follows: Δ w = − r ∇ J = r ∑ i = 1 N y i − ϖ w T x i x i (41)

In batch gradient descent, the gradient is computed from the whole training set to minimize a cost function. If we have a large dataset with millions of data points, then performing batch gradient descent may be extremely expensive because we must assess the whole training dataset once we go one step closer to the global minimum. Rather than updating the weights based on the total cumulative errors across all samples x i through the Δw described above, we may utilize the following update in the SGD method: Δ w = − r ∇ J = r y i − ϖ w T x i x i (42)

However, we update the weights incrementally when new data arrive from IIoT devices.

Assuming the T _sync is the average synchronization time (in seconds) of the MEC server connected with S _i IIoT devices, X t denotes the various of IIoT in the queue, and T _resp is the average response time of the MEC server.

Algorithm 2

Proposed Adaptive Time Synchronization

The shortest route between the selected MEC server and the source node is determined based on Algorithm 2. The MEC server creates an offloading task schedule and communicates the result to the IIoT devices. If any of the MEC servers experience changes or delays, then the new offloading time is synchronized with the IIoT devices to minimized latency, energy consumption, and offloading errors. The task offloading process initializes after the aforementioned processes. Finally, the selected MEC server applies the online SGD to perform attack detection and return the security responses to the corresponding IIoT devices in the network to implement the right security policies on the network, where T _off is the scheduled offloading time by the MEC server, T _sn is the synchronized time on the IIoT end device, and T _local is the local time of the IIoT end device.

The setup consists of three IIoT devices connected in a mesh topology to two remote radio head made up of wireless routers. The IIoT devices connect to the router via its wireless links. The MEC layer consists of three MEC servers connected in a mesh topology via a border router. In each of the experiments, the network traffics w on the various links are varied. Figure 5 shows a sample of the SRA algorithm finding the shortest route from the IIoT device to the MEC server based on w on the network link. Node 1, Node 2, and Node 3 represent our IIoT end devices, Node 4 and Node 5 form the RHH that connects the three IIoT devices in a mesh topology, Node 6 and Node 7 are the border routers that connect the MEC servers (Node 8, Node 9, and Node 10) at the edge of the network. The red path indicates the selected optimal path with minimum network congestion from a source node 1 (IIoT end device) to a MEC server (Node 10). The values assigned to the links between the connected nodes show the network traffic w.

The MEC servers contain the trained MLS model for network attack analysis, the synchronization algorithm, and the Markov chain queuing algorithm. Because the IIoT devices are resource constraints, we reduced the computational stress on these nodes. We deployed a simple model consisting of a network packet capturing, a table for the queuing, synchronization time parameter, and task offloading system. The IIoT devices sampled different sizes of the test set and submit it to the MEC servers. In each sample, MLS model performs network attack analysis and send responds to the IIoT device that offloaded the task.

There are no approved public datasets for network attack detection created in the context of IIoT devices to MEC networks during our studies, as far as we know. However, we created and tested the MLS model’s performance using a publicly available DoS dataset known as the CICDDoS2019 intrusion datasets created by the Canadian Institute for Cybersecurity (Sharafaldin et al., 2019). CICDDoS2019 is a collection of benign and up-to-date common DDoS attacks that closely mimics real-world data. It also provides the results of a network traffic analysis with labeled flows based on the time stamp, source and destination IPs, source and destination ports, protocols, and attack using CICFlowMeter-V3. PortMap, NetBIOS, LDAP, MSSQL, UDP, UDP-Lag, SYN, NTP, DNS, and SNMP are among the contemporary reflecting DDoS network attacks included in the dataset. The CICDDoS2019 dataset suites our experiment due to its modern attacks, structure, and network architecture used during its creation.

In the experiment, we repeated our algorithms multiple times in a loop (30 iterations) and calculated an average value from the results obtained. Table 1 shows the response from the MLS model, which was trained and deployed to the MEC servers.

The experiment was repeated for 10 different samples of the test dataset, and Table 2 shows the results obtained.

Figure 6 compares the prediction of different the machine learning models deployed to the MEC server. Figure 6A provides the total time (turnaround time) required to complete for each IIoT device to offload the sampled test data to the MEC server for network attack analysis. Figure 6B shows the average time taken for the MEC server to perform attack analysis based on the size of test sampled dataset received.

In Figure 7, we increased the number of connected IIoT devices and measured the latency and the energy consumed when our proposed system was applied. Figure 7C and Figure 7D show respectfully the latency and the energy consumed (in kilojoules).