Leakage aware gated non local fusion network for calibrated IIoT SCADA cyberattack detection supporting cyber risk management and operational resilience

Industrial Internet of Things (IIoT) and SCADA systems are increasingly exposed to cyberattacks that can threaten data integrity, cyber-physical availability, and the continuity of industrial operations. Beyond their immediate technical consequences, such threats are relevant to cyber risk management and operational resilience because reliable security monitoring can provide decision-relevant information for prioritizing potentially disruptive incidents. However, many machine-learning and deep-learning intrusion detectors process tabular network-flow records as flat vectors or arbitrary feature sequences, while preprocessing leakage, severe class imbalance, weak minority-attack detection, and poorly calibrated confidence estimates can limit the reliability of reported performance. This study proposes the Gated Non-local Fusion Network (GNF), a compact semantic tabular-flow model for five-class intrusion detection on the cleaned WUSTL-IIoT-2021 dataset, comprising 1,191,028 records split into 60% training, 20% validation, and 20% testing. The evaluated classes are Backdoor, Command Injection, DoS, Reconnaissance, and Normal. GNF applies leakage-aware preprocessing with split-before-scaling and train-only transformations, groups raw flow variables into semantic feature tokens, and embeds these tokens before local and global representation learning. A depthwise Conv1D encoder captures local traffic-feature interactions, gated non-local attention models long-range dependencies across feature groups, Transformer feed-forward refinement improves token representations, and attention-plus-mean pooling forms the final flow embedding. A calibrated classifier is trained with class-balanced focal loss and refined using temperature scaling. Against FT-Transformer, SAINT, XGBoost, TabNet, TabTransformer, and 1D-CNN-BiGRU baselines, GNF achieved 0.9998 accuracy, 0.9999 ROC-AUC, 0.9399 macro-F1, 0.9998 weighted-F1, and 0.0042 expected calibration error after temperature scaling, using approximately 1.4 M parameters and 1318.4 s training time. Macro-level and class-wise analyses provided a stricter assessment than accuracy alone. Accordingly, the results should not be interpreted as uniform detection across attack categories. Within the evaluated benchmark, GNF provides a leakage-aware, class-sensitive, and calibrated technical foundation that may support confidence-aware alert prioritization, risk-informed cybersecurity monitoring, industrial cyber risk management, and operational resilience planning without implying experimentally demonstrated business or continuity outcomes