Official implementation of "Dynamic Risk Assessment for Industrial IoT Networks Using TiDE Time-Series Forecasting and Fuzzy SAW", submitted to the Journal of Information Security and Applications (2026).
Anonymised for peer review. This repository will be migrated to a permanent location and the corresponding author listed below will be contactable directly upon acceptance. A Zenodo archive with a permanent DOI will be released alongside the final version.
- Overview
- Key Results
- Repository Structure
- Quick Start
- Reproducing Paper Results
- Datasets
- Expert Elicitation Data
- Edge Deployment
- Hardware Requirements
- Known Limitations
- Citation
- License
- Contact
TiDE-SAW is a hybrid dynamic risk assessment framework for Industrial Internet of Things (IIoT) networks. It couples the Time-series Dense Encoder (TiDE) — a deep residual MLP architecture — with a Fuzzy Simple Additive Weighting (SAW) module to produce a continuously updated, asset-aware risk signal:
where:
- P_i(t) is the per-window threat probability predicted by TiDE on 50-packet sliding windows of network telemetry,
- Impact(A_i) is the static asset criticality derived via Fuzzy SAW from expert elicitation (Fleiss' κ = 0.82),
- γ_i(t) is the Operational Context Factor, grounded in ISA-95 duty-cycle conventions and ICS vendor documentation (Siemens SIMATIC WinCC OA, Rockwell FactoryTalk View SE).
A K-consecutive-exceedance rule (K = 3) stabilises alerting and guarantees zero actionable false alarms on critical gateways while preserving sub-200 ms attack-to-alert latency.
Existing IIoT risk assessment approaches fall into three categories, each with structural limitations:
| Category | Examples | Limitation |
|---|---|---|
| Static fuzzy MCDM | Amirova et al. [1], Kerimkhulle et al. [25] | Static threat probabilities → unbounded response lag |
| Deep learning IDS | CNN/DNN/LSTM-based | Asset-agnostic alerts → alert fatigue (up to 45% ignored) |
| Dynamic risk (shallow) | HiRAM [23], CIRA [24] | Limited attack coverage (≤5 categories), shallow models |
TiDE-SAW addresses all three gaps simultaneously through deep residual temporal encoding, formal asset-aware gating, and operational context modulation.
| Metric | Edge-IIoTset | TON_IoT | CICIoT2023 |
|---|---|---|---|
| F1-score | 0.999 | 0.985 | 0.980 |
| ROC-AUC | 0.9999 | — | — |
| Inference latency (RTX 5060, FP32) | 2.4 ms/batch | — | — |
| Inference latency (Jetson Nano, INT8) | 0.08 ms/window | — | — |
| FAR (critical gateway, τ = 0.5) | 0.0% | — | — |
| Attack-to-alert delay | ~150–200 ms (3–4 windows) | — | — |
| Expected Calibration Error (ECE) | 0.0018 | — | — |
| Model parameters (released checkpoint) | 908,801 | — | — |
| Framework | F1 | Latency | FAR |
|---|---|---|---|
| CIRA-equivalent [24] | 0.892 | 5.8 ms | 8.7% |
| HiRAM-equivalent [23] | 0.945 | 12.5 ms | 4.2% |
| TiDE-SAW (ours) | 0.999 | 2.4 ms | 0.0% |
Full numerical details, 95% bootstrap confidence intervals, DeLong and McNemar significance tests are in the paper.
tide-saw/
├── README.md ← you are here
├── LICENSE ← MIT
├── CITATION.cff ← machine-readable citation metadata
├── requirements.txt ← pip dependencies (pinned)
├── environment.yml ← conda dependencies (mirror)
├── .gitignore
│
├── src/ ← core Python package
│ ├── models/
│ │ └── tide.py ← the TiDE module (908,801 params)
│ ├── fuzzy_saw/
│ │ ├── tfn.py ← Triangular Fuzzy Numbers (Table 3)
│ │ ├── saw_solver.py ← SAW solver (Eq. 4, Table 4)
│ │ └── fleiss_kappa.py ← inter-rater agreement (Section 3.3)
│ ├── preprocessing/ ← sliding-window pipelines (stubs)
│ ├── risk/ ← dynamic risk + γ(t) (stubs)
│ ├── replications/ ← HiRAM/CIRA replications (stubs)
│ ├── evaluation/ ← metrics, calibration (stubs)
│ ├── robustness/ ← noise, FGSM (stubs)
│ └── edge/ ← ONNX, INT8 quantization (stubs)
│
├── scripts/ ← numbered scripts for each pipeline step
│ ├── 08_fuzzy_saw_expert_panel.py ← Section 3.3 orchestrator
│ └── 16_reproduce_all_figures.py ← master reproduction script
│
├── expert_elicitation/
│ └── raw_responses.csv ← 45 anonymised expert ratings
│
├── data/
│ ├── README.md ← dataset download instructions
│ ├── feature_schema_58.json ← canonical feature schema
│ ├── raw/ ← .gitignored; populate manually
│ └── processed/ ← .gitignored; generated by scripts
│
├── configs/ ← YAML configs for ablations
├── notebooks/ ← exploratory analysis
├── results/
│ ├── figures/ ← regenerated plots
│ ├── tables/ ← regenerated CSV/JSON tables
│ └── logs/ ← training logs
│
├── tests/ ← pytest suite (213 tests)
│ ├── test_tide.py
│ ├── test_fleiss_kappa.py
│ ├── test_fuzzy_saw.py
│ ├── test_citation.py
│ ├── test_environment.py
│ └── test_orchestrator.py
│
├── docs/
│ ├── REPRODUCIBILITY.md ← step-by-step reproduction guide
│ ├── TROUBLESHOOTING.md ← common issues and fixes
│ └── CONTRIBUTING.md ← how to contribute
│
└── .github/
├── workflows/tests.yml ← CI (GitHub Actions)
├── ISSUE_TEMPLATE/
└── PULL_REQUEST_TEMPLATE.md
git clone https://github.com/<anon>/tide-saw.git
cd tide-saw
# Option A: pip (CPU wheel for CI / laptops)
python -m venv .venv
source .venv/bin/activate # or .venv\Scripts\activate on Windows
pip install -r requirements.txt
# Option B: conda (full CUDA runtime)
conda env create -f environment.yml
conda activate tide-sawpython scripts/16_reproduce_all_figures.pyExpected output after ~90 seconds:
✓ Section 3.3 — Fuzzy SAW (Tables 4, 5) (2.67s)
✓ TiDE checkpoint load + deterministic inference (42.91s)
✓ Environment integrity — pytest suite (48.60s)
======================================================================
✓ Reproduction mode='demo' -> OVERALL SUCCESS
A JSON manifest is written to results/reproduction_manifest.json.
pytest tests/Expected: 213 passed in ~90 seconds.
The master orchestrator has two modes:
Reproduces:
- Section 3.3 — Fuzzy SAW expert panel → Table 4 (Impact scores for all 5 nodes match exactly), Table 5 (weight sensitivity), Fleiss' κ = 0.82.
- Model integrity — loads
tide_iiot_model.pthwithstrict=True, confirms 908,801 parameters, verifies deterministic inference. - Environment integrity — runs the 213-test pytest suite.
python scripts/16_reproduce_all_figures.pyRuns scripts 01–15 in order to reproduce every table and figure:
python scripts/16_reproduce_all_figures.py --mode full| Script | Paper section | Produces |
|---|---|---|
01–03_preprocess_*.py |
4.1, 4.7 | Sliding-window tensors for all 3 datasets |
04_train_tide.py |
4.2 | TiDE checkpoint |
05_train_baselines.py |
4.2 | 1D-CNN, LSTM, DLinear, Vanilla-Transformer |
06_evaluate_crossdataset.py |
4.2, 4.7 | Tables 6, 8, 16; Figures 2, 3 |
07_ablation_study.py |
4.8 | Table 18 |
08_fuzzy_saw_expert_panel.py |
3.3 | Tables 4, 5 |
09_dynamic_risk_simulation.py |
4.3 | Figure 4, Tables 11, 13 |
10_cascading_simulation.py |
4.4 | Figure 5 |
11_gamma_modulation.py |
4.4.2 | Table 10 |
12_replicate_hiram.py |
4.6 | HiRAM-equivalent baseline |
13_replicate_cira.py |
4.6 | CIRA-equivalent baseline |
14_robustness_analysis.py |
4.8 | Table 17, Figure 6 |
15_edge_quantize_benchmark.py |
4.9 | Table 19 |
Note on script availability: scripts 08 and 16 are released in
this version; scripts 01–07 and 09–15 will be populated in a future
patch release. Until then, --mode=full reports the missing scripts
and falls back to demo-mode verification.
See docs/REPRODUCIBILITY.md for the detailed step-by-step guide.
All three datasets are publicly available through their original distributors. Due to licensing constraints we do not redistribute raw dataset files. See data/README.md for direct download links, SHA-256 checksums, and preprocessing instructions.
| Dataset | Citation | Access |
|---|---|---|
| Edge-IIoTset | Ferrag et al. (2022) [13] | IEEE DataPort |
| TON_IoT | Ismail et al. (2025) [16] | UNSW Canberra |
| CICIoT2023 | Neto et al. (2023) [37] | UNB CIC |
The unified 58-feature schema spans four semantic groups:
- Header features (15): protocol identifiers, ARP/ICMP/HTTP/TCP flags
- Flow features (18): TCP/UDP/MQTT/Modbus flow-level statistics
- Payload-derived (8): HTTP URI, DNS query metadata (headers only)
- Timing features (5): inter-arrival times, relative timestamps
- Additional (12): source-dataset-specific features, zero-padded when absent
Full specification in data/feature_schema_58.json.
Identifier and timestamp fields (IP addresses, MAC addresses, payload
hex, frame timestamps) are explicitly excluded to prevent data
leakage.
The preprocessing pipeline enforces three strict safeguards, all verified by unit tests:
- Chronological split — first 80% of the time series for training, last 20% for testing; no random shuffling.
- Temporal purge — any sliding window W_t crossing the train/test boundary is removed, preventing look-ahead bias.
- Flow-level deduplication — identical flow records are removed before splitting.
The expert_elicitation/ directory contains the
anonymised responses from five domain specialists who provided the
linguistic evaluations used in the Fuzzy SAW module (Section 3.3).
Expert IDs E1–E5 correspond to (in randomised order):
- Two ICS security engineers (≥10 years IIoT experience)
- Two information security researchers with IIoT publications
- One certified industrial automation engineer
python scripts/08_fuzzy_saw_expert_panel.pyExpected output: Fleiss' κ = 0.8217, Impact(N1) = 0.810, Impact(N2) = 0.900, Impact(N3) = 0.580, Impact(N4) = 0.210, Impact(N5) = 0.810 (exactly matching Table 4).
The src/edge/ module provides ONNX export and INT8 quantization
utilities for deploying TiDE on resource-constrained IIoT hardware.
| Platform | Quantization | Model size | Latency | RAM | F1 |
|---|---|---|---|---|---|
| NVIDIA RTX 5060 (baseline) | FP32 | 3.5 MB | 2.4 ms/batch | 12 MB | 0.999 |
| NVIDIA Jetson Nano | INT8 (TensorRT) | 1.0 MB | 0.08 ms/window | 4 MB | 0.997 |
| Raspberry Pi 4 | INT8 (ONNX RT) | 1.0 MB | 0.31 ms/window | 4 MB | 0.997 |
| STM32H7 (d_h = 64) | INT8 (TFLite Micro) | 0.34 MB | 4.2 ms/window | 0.34 MB | 0.993 |
Important caveat: the Jetson Nano, Raspberry Pi 4, and STM32H7 latency figures are estimated via ONNX Runtime / TFLite Micro benchmarking against published hardware specifications, not measured on physical hardware under realistic traffic loads. Physical hardware-in-the-loop validation is explicitly listed as future work in Section 5.3 of the paper.
- CPU: 4 cores, 3.0 GHz+
- RAM: 4 GB
- Disk: 2 GB free
- Runtime: ~90 seconds
- GPU: NVIDIA RTX 3060 / RTX 5060 or better, ≥ 8 GB VRAM
- RAM: 32 GB
- Disk: 100 GB free (SSD recommended)
- Runtime: ~8 hours
See docs/TROUBLESHOOTING.md for setup issues.
We believe in transparent disclosure. The following limitations are explicitly acknowledged in Section 5 of the paper:
-
Dataset scope. All three evaluation datasets contain scripted or lab-generated attack traffic rather than long-running zero-day APT campaigns in production environments. The 1.4–1.9 percentage point drop on TON_IoT and CICIoT2023 relative to Edge-IIoTset offers a more realistic performance ceiling.
-
Operational context modelling. The γ_i(t) values are derived from ISA-95 standards and vendor documentation (Siemens, Rockwell) rather than mined from operational logs of a specific industrial site.
-
Edge deployment. Latency figures for Raspberry Pi 4, Jetson Nano, and STM32H7 are ONNX Runtime / TFLite Micro benchmark estimates against published hardware specifications, not direct measurements on physical industrial gateways.
-
Comparative baselines. The HiRAM- and CIRA-equivalent implementations are faithful replications calibrated to the Edge-IIoTset feature schema and should be regarded as upper-bound approximations of the original frameworks under our experimental protocol.
If you use TiDE-SAW in your research, please cite:
@article{tokhmetov2026tidesaw,
title = {Dynamic Risk Assessment for Industrial {IoT} Networks Using {TiDE} Time-Series Forecasting and Fuzzy {SAW}},
author = {Tokhmetov, Akylbek and Kantureyeva, Mansiya and Tanchenko, Liliya and Kenesbay, Meruert},
journal = {Journal of Information Security and Applications},
year = {2026},
note = {Under review}
}A machine-readable CITATION.cff is also provided for GitHub's built-in "Cite this repository" feature.
MIT License — see LICENSE for details.
The Edge-IIoTset, TON_IoT, and CICIoT2023 datasets are distributed under their respective original licenses; please consult the dataset providers for usage terms.
The authors thank the five domain specialists who participated in the expert elicitation panel. We also thank the creators of Edge-IIoTset (Ferrag et al.), TON_IoT (Moustafa et al.), and CICIoT2023 (Neto et al.) for making these benchmarks publicly available.
For questions during peer review, please open an issue on this (anonymised) repository.
Upon acceptance, the repository will be migrated to a permanent
location and the corresponding author (Mansiya Kantureyeva,
kantureyeva_ma@enu.kz) can be contacted directly.
- Fixed random seeds across all experiments (42, 123, 456, 789, 2024)
- Deterministic data splits (chronological, no shuffling)
- Temporal purge of boundary sliding windows (unit-tested)
- Pinned dependency versions in
requirements.txtandenvironment.yml - Single-command full reproduction (
scripts/16_reproduce_all_figures.py) - Automated reproduction manifest
- Anonymised raw expert responses for Fuzzy SAW
- Unit tests (
pytest tests/) covering every public API - CI on GitHub Actions (Ubuntu × Python 3.10–3.12)
- CFF 1.2.0 citation metadata with 26-test validation suite
- Physical hardware-in-the-loop validation (future work — Section 5.3)
- Zenodo DOI (to be released upon paper acceptance)