TFPAG-Net: A Time-Frequency Dual-Branch Fusion and PCMCI-Based Association-Guided Network for IIoT Intrusion Detection.

The Industrial Internet of Things (IIoT) is being used a lot in important areas like advanced manufacturing, smart energy systems, and intelligent cities. Watching for intrusion detection is very important for the safety of the IIoT. Nevertheless, multivariate sensor sequences frequently demonstrate pronounced physical coupling, non-stationarity, and periodicity concurrently, rendering it prone for detection models grounded in statistical correlation to erroneously classify normal collaborative variations as anomalies. Moreover, prevailing methods predominantly concentrate on single-domain representations within either the time or frequency domain, posing challenges in addressing both burst and periodic attacks concurrently. To address these challenges, this article introduces the Time-Frequency Dual-Branch Fusion and PCMCI-Based Association-Guided Network (TFPAG-Net) for IIoT Intrusion Detection. This model initially constructs a lightweight temporal convolutional network backbone employing depthwise separable convolutions. Subsequently, parallel branches in the time and frequency domains are established to respectively model local abrupt changes, long-range dependencies, and periodic spectral structures, with time-frequency feature fusion facilitated through a sample-dependent gating mechanism. Building on this, multi-scale temporal pyramids are employed to amalgamate fine, intermediate, and coarse-scale information. Furthermore, as an auxiliary refinement, a lagged conditional-dependence prior estimated from the training data via PCMCI is projected into a bounded attention bias to provide supplementary guidance for channel feature reweighting. Evaluations on Edge-IIoTset, X-IIoTID, and SWaT yield mean Macro-F1 scores of 0.9886, 0.9466, and 0.9607, respectively, over five predefined random seeds. Under the unified training protocol, TFPAG-Net ranks second on Edge-IIoTset and achieves the highest mean Macro-F1 on X-IIoTID and SWaT. Ablation experiments show dataset-dependent effects of the proposed components. On Edge-IIoTset and X-IIoTID, the final attention-stage improvement reflects the joint effect of SE-based modulation and the PCMCI-derived association prior. Accordingly, PCMCI is treated as an auxiliary association refinement rather than a principal contribution of TFPAG-Net. Additionally, TFPAG-Net maintains a moderate computational footprint, with approximately 0.29 M parameters, providing a favorable balance between model complexity and intrusion detection performance.