HADVB: An Interpretable and Auditable Intrusion Detection Framework for Multimodal Industrial Communication

In the context of the continuous evolution of the Industrial Internet of Things (IIoT), network intrusion behaviors have become increasingly complex. These behaviors involve heterogeneous data sources, class imbalance, and attack variation. Such characteristics pose significant challenges to traditional intrusion detection methods. To address these challenges, this paper presents a multimodal intrusion detection framework named HADVB. The framework combines communication traffic data and node behavior logs. It applies a unified preprocessing pipeline to improve input consistency and stability. It also introduces a hybrid resampling strategy based on clustering, integrating HCBOU and ADASYN, to mitigate the impact of imbalanced class distribution. For feature learning, the system employs a denoising autoencoder to compress highdimensional features. The AdamW optimizer improves training robustness and generalization. In the classification phase, the framework employs a soft voting model that integrates Random Forest, XGBoost, and MLP to enhance detection performance across diverse attack scenarios. To improve model transparency and trustworthiness, the system incorporates SHAP and LIME for decision interpretability. It also employs structured logs and summary-based signatures to record and audit each inference in a chained manner. Experiments on three public datasets—WSN-DS, WSNBFSF, and InSDN—show that the proposed method achieves 99.03%, 99.69%, and 99.97% accuracy, respectively. It also demonstrates strong performance in detecting minority-class attacks such as Forwarding and Blackhole. Overall, HADVB establishes a systematic approach that integrates multimodal fusion, class imbalance handling, interpretability, and auditable inference. It provides practical support for building reliable intrusion detection systems in industrial environments.