Introduction

The integration of Internet of Things (IoT) technologies in industrial environments has enabled smart factories with autonomous monitoring capabilities1,2,3,4,5,6,7,8,9,10,11,12. While enhancing operational efficiency, this transformation introduces cybersecurity risks to production systems and data integrity13,14,15. Machine learning (ML) has emerged as a superior approach for detecting anomalies in IoT-driven factories compared to traditional threshold-based methods, particularly for identifying both malicious activities and operational failures1,2,13,16,17,18,19,20,21,22.

Current industrial anomaly detection systems primarily utilize Random Forest and Support Vector Machines (SVM) algorithms3,20,23,24,25, which face challenges with imbalanced datasets and scalability4,5,26. Despite their theoretical advantages in handling class imbalance through adaptive weighting mechanisms17,27, ensemble boosting techniques like Logistic Boosting remain understudied for industrial IoT applications28,29,30,31,32. This gap is particularly significant given the critical nature of rare anomalies in manufacturing datasets. Recent advances in deep learning, including hybrid CNN-transformer architectures and bio-inspired optimization33,34, suggest promising directions for combining neural frameworks with ensemble methods to capture complex temporal patterns.

We present a comparative analysis of Logistic Boosting, Random Forest, and Support Vector Machines (SVM) for industrial IoT anomaly detection using 15,000 sensor instances collected over six months. Key contributions include:

  1. 1

    Demonstration of Logistic Boosting’s superior performance (AUC = 0.992) with imbalanced industrial data

  2. 2

    Identification of power consumption and motion detection as most discriminative features through ablation studies

  3. 3

    Practical guidelines for deployment addressing computational efficiency and continuous learning needs

These findings establish Logistic Boosting as the preferred method for industrial IoT security while highlighting opportunities for hybrid architectures and edge computing implementations12,33.

Related Works

Anomaly detection in industrial IoT systems has advanced through diverse machine learning approaches. Breiman35 established Random Forests for classification, while Friedman36 developed gradient boosting frameworks, laying the foundation for modern industrial anomaly detection37.

Traditional ML algorithms show promise in factory environments. Wang & Li20 achieved 95.63% accuracy with Random Forests on simulated IoT data, and Li & Zhang19 reported 92.4% success using SVMs in lab settings. However, these methods struggle with real-world data imbalances and scalability4,5. Choi et al.30 found ensemble methods generally outperform single classifiers but vary with dataset characteristics.

Boosting algorithms address limitations of conventional methods. Chen & Guestrin38 introduced XGBoost for imbalanced tasks, while Jang et al.31 demonstrated its advantages for rare anomaly detection in industrial applications. Li et al.12 further validated boosting techniques, with Logistic Boosting excelling in factory sensor analysis. Deep learning has gained traction for complex tasks. Jiang et al.33 proposed transformer-based temporal pattern recognition, and Alenezi et al.34 combined bio-inspired optimization with deep networks. However, these often require larger datasets than industrial settings typically provide, making classical ensemble methods more practical12,39.

Recent advances in optimization and machine learning techniques have demonstrated significant potential across various domains. Bio-inspired optimization approaches have shown particular promise, with applications including lung cancer classification40, COVID-19 spread prediction41, and cardiovascular disease detection42. Similarly, hybrid deep learning architectures have proven effective for EEG signal analysis43 and agricultural disease detection44,45. Feature selection methods continue to evolve, with novel algorithms improving performance in gene expression analysis46 and mental health diagnostics47,48. These developments highlight the growing synergy between optimization techniques and machine learning across healthcare and agricultural applications45.

In recent years, machine learning and deep learning models have shown great potential in tackling tough classification and detection problems, which is highly relevant for anomaly detection in IoT-based factories. For example, Aly49 introduced a method for segmenting thyroid ultrasound images using weak supervision and multi-scale features, dealing with challenges like limited labeled data and class imbalance — issues we often face with industrial sensor data too. In another study, Aly et al.50 combined Vision Transformers with GRU networks to improve brain tumor detection in MRI scans, proving how hybrid and explainable models can enhance decision-making in sensitive applications. Similarly, Aly et al.51 built a deep learning system for facial expression recognition in online learning platforms, focusing on efficiency and real-time performance, which aligns with the demands of IoT systems running at the edge. These works highlight how techniques like ensemble learning, contextual feature extraction, and lightweight, explainable models can be valuable for improving anomaly detection in industrial environments.

Key literature gaps include: (1) limited exploration of boosting for industrial IoT security, (2) few comparative studies on real-world factory data, and (3) insufficient attention to deployment challenges. This work systematically evaluates Logistic Boosting against established methods using industrial datasets and offers practical implementation insights.

Materials and methods

Dataset description and preprocessing

The study analyzed a six-month dataset from factory sensors (15,000 instances) with six features: ambient temperature, light intensity, motion detection, window/door status, and power consumption. Binary labels distinguished normal operations from anomalies (power fluctuations, unauthorized access, environmental deviations).

Preprocessing followed four stages. First, missing values were handled via median imputation, with features from persistently faulty sensors (Pearson’s *r* < 0.7) removed. Second, outliers were filtered using modified Z-scores (threshold = 3.5) to retain legitimate anomalies. Third, min–max scaling normalized features to [0,1]. Finally, class imbalance was addressed using SMOTE, applied only during tenfold cross-validation training to prevent data leakage.

Feature engineering and model selection

Temporal features (5-point rolling averages) and PCA (95% variance retained) enhanced predictive performance. Three algorithms were evaluated:

  • Logistic Boosting (100 estimators, max_depth = 5, η = 0.1) for imbalanced data handling

  • Random Forest (100 trees, default parameters) as an ensemble baseline

  • Support Vector Machines (SVM): (RBF kernel, C = 1.0, γ =‘scale’) for high-dimensional classification

The hybrid model employs XGBoost for feature selection (4 ranked features) followed by SVM classification (RBF kernel, C = 1.0, γ = 0.1). Features were concatenated and normalized before final classification. The hybrid model integrates XGBoost for feature selection and SVM (RBF kernel) for classification through a two-stage pipeline:

  1. 1.

    Feature Selection Phase:

    1. o

      XGBoost (n_estimators = 100, max_depth = 5) ranks features by importance using gain scoring.

    2. o

      50% of features are selected based on empirical validation of the elbow point in cumulative importance (Figure S1 in Supplementary Materials).

  2. 2.

    Classification Phase:

    1. o

      Selected features are standardized (z-score) and fed into an SVM with RBF kernel (C = 1.0, γ = ‘scale’).

    2. o

      Feature vectors are concatenated with raw sensor data to preserve temporal patterns, creating an enriched input space.

Key Design Choices:

  • Fusion Strategy: Parallel processing of raw and XGBoost-selected features (weighted 60:40 in final prediction) to balance interpretability and performance.

  • Hyperparameters: Optimized via grid search (fivefold CV) on 20% of the training set.

  • Computational Efficiency: The pipeline adds < 15% overhead versus standalone Logistic Boosting (10.8s vs. 9.8s training time).

Evaluation framework

Models were assessed using accuracy, precision, recall, F1-score, Cohen’s κ, MCC, and ROC-AUC. A dual-validation approach combined tenfold cross-validation with hold-out testing (75:25 split). Experiments ran on Python 3.9 (scikit-learn 1.0.2, pandas 1.4.0) using an i7-11800H CPU with 16GB RAM, with Logistic Boosting completing training in < 10 s. Table 1 summarizes the Data from Different Sensors as:

Table 1 Data from different sensors.
Full size table

The hybrid model combines XGBoost feature importance ranking (50% features selected) with SVM classification (RBF kernel, C = 1.0). Feature vectors were standardized before concatenation.'Results are shown in new Table 2 with metrics: Accuracy = 95.8%, Precision = 93.2%, Recall = 94.5%, F1-score = 93.8%.

Table 2 Performance of proposed model.
Full size table

This rigorous methodology ensures comprehensive evaluation of anomaly detection performance while addressing real-world industrial constraints such as data imbalance and computational practicality12,38.

Computational setup

All experiments were conducted on an Intel i7-11800H system with 16GB RAM using Python 3.9.1252, scikit-learn 1.0.2, and XGBoost 1.6.1. Training times were measured for tenfold cross-validation.

Experiments were conducted on an Intel i7-11800H (8-core) with 16GB RAM, running Python 3.9.12 with key libraries (scikit-learn 1.0.2, XGBoost 1.6.1). We used tenfold stratified cross-validation, measuring wall-clock time (9.8 ± 1.2s for Logistic Boosting on 15k samples) with < 4GB RAM usage. Random seeds (42) ensured reproducibility. Hardware/software choices mirror industrial edge-device constraints and prioritize stability (LTS versions).

Dataset description

Data collection and characteristics

A six-month industrial IoT dataset from an appliance manufacturing facility comprised 15,000 multivariate time-series instances with six key features: ambient temperature (thermostat readings), light intensity (lux), motion detection (binary), window/door status (open/closed), and power consumption (kW). The binary classification labeled instances as normal or anomalous, including three anomaly types: operational irregularities (power spikes > 3σ), security breaches (unauthorized access), and environmental deviations (temperature fluctuations > ± 2.5°C).

The dataset captured real-world industrial conditions through seasonal variations (ΔT = 15–32°C), continuous operations (24/7 shifts), and diverse equipment profiles. Figure 1 shows feature distributions, including bimodal temperature patterns (day/night cycles) and right-skewed power consumption.

Fig. 1
figure 1

Feature distributions (bimodal temperature, skewed power).

Full size image

Anomaly Taxonomy and Preprocessing.

Anomalies fell into four categories: energy (23.7%, power surges/dips > 15%), environmental (34.1%, extreme temperature/humidity), security (28.5%, unauthorized access), and motion (13.7%, unexpected activity).

Preprocessing involved:

  1. 1

    Data imputation: Median replacement for missing values (< 2.3% instances) with removal of faulty sensor features (R2 < 0.7)

  2. 2

    Outlier treatment: Modified Z-score filtering (threshold = 3.5) to retain true anomalies

  3. 3

    Feature normalization: Min–max scaling to [0,1] range

Figure 1 includes the feature distributions (bimodal temperature, skewed power). The final dataset contained 17.4% anomalies (2,610 instances), requiring SMOTE balancing during training30. Figures 2–3 detail feature distributions and preprocessing outcomes, where Fig. 2 is a graphical representation of features using Seaborn and Fig. 3 describes graphical representations of the various features from the dataset, plotted against the target variable (Anomaly) using Seaborn.

Fig. 2
figure 2

Graphical representations of features using Seaborn.

Full size image
Fig. 3
figure 3

Graphical representations of the various features from the dataset, plotted against the target variable (Anomaly) using Seaborn.

Full size image

Results & discussion

Performance evaluation

The comparative analysis of Logistic Boosting, Random Forest (RF), and Support Vector Machines (SVM) on 15,000 industrial IoT instances (17.4% anomaly prevalence) revealed significant performance differences. Logistic Boosting demonstrated superior capability with 96.6% accuracy (RF: 95.6%, SVM: 93.8%), 94.1% F1-score, and 0.992 ROC-AUC (Fig. 11). The hybrid XGBoost-SVM architecture (Fig. 6) achieved particularly strong discrimination, with balanced precision (93.5%) and recall (94.8%).

Feature analysis revealed key operational insights:

  • Power consumption and motion detection were most discriminative (6.2% and 4.8% F1-score drops when excluded, respectively)

  • Environmental features showed limited impact (< 2% performance variation)

  • Strong correlations existed between power consumption and temperature (r = 0.82)

Statistical validation

Logistic Boosting’s balanced error profile (134 FPs, 117 FNs) outperformed both RF (401 FNs) and SVM (280 FPs), with statistical significance confirmed (ANOVA p < 0.05, Tukey’s HSD). The model showed consistent performance across:

  • Production loads (95.8–97.1% accuracy)

  • Shift patterns (93.3–94.7% F1-score)

  • Seasonal variations (93.9–95.4% recall)

Training convergence occurred within 80 iterations (Fig. 7), with final models demonstrating high reliability (Cohen’s κ = 0.88, MCC = 0.89).

Deployment considerations

Three key challenges emerged for industrial implementation:

  1. 1

    Latency requirements necessitate model optimization (pruning/quantization) for real-time streaming

  2. 2

    Resource constraints demand edge-compatible implementations

  3. 3

    Data drift requires continuous learning mechanisms

Comparative benchmarks showed Logistic Boosting’s practical advantages over alternatives:

  • 12.3% fewer false negatives than RF

  • 18.7% fewer false positives than Support Vector Machines (SVM)

  • Superior stability across operational conditions

Experimental framework and model performance

Our evaluation using rigorous tenfold cross-validation demonstrated Logistic Boosting’s superior performance for industrial anomaly detection. The model achieved exceptional metrics including 96.6% accuracy, 94.1% F1-score (93.5% precision, 94.8% recall), and 0.992 AUC, significantly outperforming both Random Forest (95.6% accuracy) and SVM (93.8% accuracy). Statistical validation through ANOVA (p < 0.05) and Tukey’s HSD tests confirmed these performance differences were significant.

Feature importance analysis revealed power consumption and motion detection as the most critical predictors, with exclusion leading to 6.2% and 4.8% F1-score reductions respectively. Environmental features showed minimal impact, affecting performance by less than 2%. The model maintained consistent reliability across varying production conditions (95.8–97.1% accuracy), shift patterns (93.3–94.7% F1-score), and seasonal changes (93.9–95.4% recall), demonstrating robust adaptability to real-world industrial environments. Figure 4 contains dataset distribution following min–max normalization. Figure 4 describes dataset distribution following min–max normalization, while Fig. 5 is the matrix depicting feature correlations showcases the relationships among various characteristics within the dataset.

Fig. 4
figure 4

Dataset distribution following min–max normalization.

Full size image
Fig. 5
figure 5

The matrix depicting feature correlations showcases the relationships among various characteristics within the dataset.

Full size image

Operational implementation and validation

The framework achieved practical computational efficiency with training completed in 9.8 ± 1.2 s, suitable for real-time deployment. However, three key implementation challenges emerged: latency requirements necessitating model optimization through pruning or quantization, resource constraints demanding edge-compatible solutions, and data drift requiring continuous learning mechanisms. Compared to alternatives, Logistic Boosting offered 12.3% fewer false negatives than Random Forest and 18.7% fewer false positives than Support Vector Machines (SVM), while maintaining balanced error rates (2.9% false positives, 1.6% false negatives).

Performance metrics followed standard formulations, with accuracy calculated as (TP + TN)/(TP + TN + FP + FN), precision as TP/(TP + FP), recall as TP/(TP + FN), and F1-score as their harmonic mean. The model showed strong agreement metrics (Cohen’s κ = 0.88, MCC = 0.89) and rapid convergence, reaching optimal performance within 80 training iterations while maintaining interpretability through feature importance analysis.

This comprehensive evaluation establishes Logistic Boosting as particularly suitable for industrial IoT security applications, combining superior detection capability with practical implementation advantages. The consistent performance across diverse anomaly types and operational conditions suggests ensemble boosting methods should be prioritized for smart manufacturing systems, while identifying clear directions for future optimization through hybrid architectures and edge computing implementations. Table 3 describes the Feature Contribution Ablation.

Table 3 Feature contribution ablation.
Full size table

The performance metrics were computed as follows53,54,55:

$$Accuracy =\frac{\left(TP + TN\right)}{\left(TP + TN + FP + FN\right)}$$

where TP, TN, FP, and FN represent true positives, true negatives, false positives, and false negatives respectively. This comprehensive evaluation framework not only quantifies detection capability but also provides operational insights for industrial deployment, particularly in balancing precision (reducing false alarms) and recall (minimizing missed detections)30. The implementation achieved computational efficiency (9.8 ± 1.2s training time) suitable for real-time applications while maintaining model interpretability through feature importance analysis33.

Accuracy signifies the ratio of correct predictions made by an algorithm to the total number of accurate predictions56. This metric aids in determining:

$$Precision = \frac{TP}{\left(TP + FN\right)}$$

Within factories and companies, recall represents the proportion of positive instances in the dataset correctly identified as positive.

$$Recall = \frac{TP}{\left(TP + FN\right)}$$

In the realm of factories and companies, the F1-score serves as a balanced measure between precision and recall, calculated as the harmonic mean of these two metrics6,57,58,59:

$$F1 Score = \frac{2 * Precision * Recall}{\left(Precision + Recall\right)}$$

Deployment Considerations and Computational Efficiency.

The Logistic Boosted model demonstrated efficient training, completing in under 10 s on a standard i7 CPU with 16 GB RAM for 15,000 instances.

However, real-world deployment raises several challenges:

  • Latency in streaming environments requires optimization via pruning or model quantization.

  • Resource constraints in factory devices necessitate lightweight models or inference-on-edge strategies.

  • Data drift and sensor recalibration may degrade model performance over time, calling for continuous learning mechanisms or scheduled retraining.

To statistically validate the performance differences, a one-way ANOVA was applied to accuracy, precision, recall, and F1-score values across the three models. The ANOVA results showed statistically significant differences (p < 0.05) among the models. Post-hoc Tukey’s HSD test confirmed that Logistic Boosting significantly outperformed both Random Forest and Support Vector Machines (SVM) in all metrics.

Logistic boosting model

The Logistic Boosting model achieved exceptional results in industrial anomaly detection, with 96.6% accuracy, 93.5% precision, 94.8% recall, and 0.941 F1-score on test data. These metrics demonstrate robust performance in handling class-imbalanced IoT data12,30. The confusion matrix analysis revealed balanced error rates (2.9% false positives, 1.6% false negatives), correctly identifying 7,487 normal instances and 77 anomalies in sampled cases. Figure 6 is the proposed architecture of the Hybrid Logistic Boosting Model for anomaly detection; while Fig. 7 is the Min–max normalization effects & performance of logistic boosting model.

Fig. 6
figure 6

The proposed architecture of the Hybrid Logistic Boosting Model for anomaly detection.

Full size image
Fig. 7
figure 7

Min–max normalization effects & performance of logistic boosting model.

Full size image

The model showed rapid convergence within 50 iterations and stable performance after 80 iterations (Fig. 7), outperforming Random Forest (12.3% fewer false negatives) and SVM (18.7% fewer false positives). Its effectiveness stems from three capabilities: handling class imbalance, managing complex feature interactions, and filtering noisy sensor data. These translate to practical benefits including reduced downtime, enhanced security, and improved operational efficiency.

With training times under 10 s for 15,000 instances38, the model demonstrates strong potential for real-world deployment. Future research directions include developing hybrid architectures combining these strengths with deep learning approaches34.

Model performance visualization analysis

Fig. 8 (a, b) present key insights into model optimization and evaluation. Fig. 8-a shows performance plateauing at 80 iterations, providing empirical guidance for hyperparameter tuning that balances computational cost with marginal gains12. Fig. 8-b's confusion matrix analysis demonstrates robust detection capability, with 94.8% sensitivity (77 true anomalies identified) and high specificity (7,487 true negatives), while maintaining balanced error rates (29 false positives, 16 false negatives) critical for industrial applications30,38.

Fig. 8
figure 8

(a-b) confusion matrix of the proposed model is a visual representation showcasing its classification performance.

Full size image

These visualizations collectively support three key analytical functions: (1) evidence-based complexity selection, (2) performance trade-off evaluation, and (3) operational threshold optimization33. The framework effectively bridges model development with practical deployment requirements in industrial settings12.

The comparative performance of our proposed method against prior works is summarized in Table 4. As evident, while earlier studies such as Wang & Li (2017)20, Li & Zhang (2018)19, and Choi et al. (2023)30 achieved competitive results on simulated, controlled, and semi-real IoT datasets, our approach demonstrated superior performance on real-world factory IoT data, attaining the highest accuracy and F1-score, along with improved metric balance in a deployment-ready scenario.

Table 4 Comparative analysis with previous works.
Full size table

The confusion matrices reveal distinct behavioral patterns across models60,61,62,63,64,65,66,67,68. Logistic Boosting’s superior performance (134 FPs, 117 FNs) stems from its iterative weighting of misclassified instances, effectively handling class imbalance as in Fig. 8(a, b). Comparatively, Support Vector Machines (SVM) produced more false positives (280) due to margin sensitivity in high-dimensional spaces, while Random Forest generated more false negatives (401) from minority class boundary challenges. These results demonstrate ensemble boosting’s advantage in capturing nuanced anomalies.

Figure 9's comparative histogram shows all models achieving high accuracy, with SVM leading in recall (94.6%) but Logistic Boosting maintaining the best precision-recall balance (F1-score = 94.1%). The visualizations enable direct performance comparisons, highlighting Logistic Boosting’s optimal trade-offs for industrial applications where both false alarms (2.9%) and missed detections (1.6%) carry significant operational consequences.

Fig. 9
figure 9

The histogram illustrates the performance outcomes of each model.

Full size image

Comparative algorithm performance

Our evaluation of three machine learning approaches identified Logistic Boosting as the optimal solution for industrial anomaly detection. The boxplot analysis (Fig. 10)) demonstrates its consistent superiority across all metrics:

  • Accuracy: 96.6%

  • Precision: 93.5%

  • Recall: 94.8%

  • F1-score: 94.1%

Fig. 10
figure 10

Boxplot representation of model performance metrics, including accuracy, precision, recall, and F1-score.

Full size image

The model achieved exceptional discrimination (AUC = 0.992) with balanced error rates (134 FPs, 117 FNs), outperforming both Random Forest (162 FPs, 401 FNs) and SVM (280 FPs, 376 FNs). Minimal metric variance (< 1.5%) confirms its reliability across operational conditions, making it particularly suitable for industrial deployment where consistent performance is critical.

Boxplot representation of model performance metrics, including accuracy, precision, recall, and F1-score as in Fig. 10). The results demonstrate the model’s superior consistency and effectiveness compared to Random Forest and Support Vector Machines. The minimal variance in accuracy and the highest area under the curve (AUC = 0.992) further highlight its robust classification performance.

Model performance and robustness

Figure 11 demonstrates the logistic boosting model’s exceptional outlier detection capability (AUC = 0.992), attributable to its ensemble architecture. The algorithm’s effectiveness stems from three key mechanisms:

  1. 1

    Iterative weighting of misclassified instances

  2. 2

    Adaptive threshold optimization for class imbalance

  3. 3

    Aggregation of weak classifiers into a strong predictor

Fig. 11
figure 11

ROC curves (AUC: 0.992 vs. 0.982 for RF, 0.968 for SVM).

Full size image

While particularly effective for industrial anomaly detection (achieving 94.8% recall with 93.5% precision), the model’s performance remains dependent on dataset characteristics. These results highlight the importance of comparative algorithm evaluation for specific industrial applications, where balanced error rates (134 FPs, 117 FNs) are often operationally critical.

In Table 5, the Logistic Boosted model also achieved a Cohen’s Kappa score of 0.88 and an MCC of 0.89, indicating strong agreement and high classification quality, respectively. In comparison, Random Forest yielded a Kappa of 0.83 and MCC of 0.84, while SVM achieved 0.79 and 0.77. These metrics confirm the superior balance of true/false positives and negatives in the Logistic Boosting model. ROC curves (AUC: 0.992 vs. 0.982 for RF, 0.968 for SVM) are described in Fig. 11.

Table 5 Cohen’s Kappa score.
Full size table

Comparative performance analysis

Our evaluation demonstrates Logistic Boosting’s superiority for industrial IoT anomaly detection, achieving 96.6% accuracy and 94.1% F1-score (Table 4,5 and, Fig. 12), outperforming both Random Forest (95.6% accuracy) and SVM (93.8% accuracy). The model’s 0.992 AUC30 and balanced error rates (134 FPs, 117 FNs) significantly exceed alternative approaches (RF: 162 FPs/401 FNs; SVM: 280 FPs/376 FNs)12,31.

Fig. 12
figure 12

Comparative performance analysis of anomaly detection algorithms.

Full size image

Key advantages include:

  1. 1

    Effective handling of rare anomalies (< 20% prevalence) through instance reweighting

  2. 2

    Robust feature interaction capture via gradient tree boosting

  3. 3

    Computational efficiency (< 10 s training for 15k instances)

While Support Vector Machines (SVM) achieves higher recall (94.6%) and RF offers interpretability, Logistic Boosting’s precision (93.5%) and operational reliability make it the preferred choice for industrial settings. Future research should investigate hybrid architectures combining these strengths34, with our results providing benchmark metrics (Figs. 8–12) for smart manufacturing applications12. For comprehensive benchmarking, we compared Logistic Boosting against baseline deep learning approaches (LSTM and 1D-CNN) on our industrial dataset. While the LSTM achieved competitive accuracy (94.2%), it required 3.2 × longer training time than Logistic Boosting and showed lower precision (90.7% vs. 93.5%) due to overfitting on rare anomalies. The 1D-CNN performed similarly (93.7% accuracy) but struggled with temporal dependencies in sensor data. These results confirm that while deep learning methods can achieve respectable performance, their computational demands and data requirements make them less practical for typical industrial deployments with moderate-sized datasets.

Figure 12 includes Logistic Boosting, Random Forest, and Support Vector Machines (SVM). The bar chart displays key evaluation metrics—accuracy, precision, recall, and F1-score—highlighting the overall effectiveness of each model in detecting anomalies. The results indicate that Logistic Boosting achieves the highest accuracy, while all three models maintain competitive performance across the other metrics.

Conclusions & future directions

Our evaluation establishes Logistic Boosting as the superior approach for industrial IoT anomaly detection, achieving 96.6% accuracy (AUC = 0.992) with balanced precision (93.5%) and recall (94.8%). The model’s ensemble architecture effectively handles class imbalance (134 FPs, 117 FNs), outperforming both Random Forest (162 FPs, 401 FNs) and SVM (280 FPs, 376 FNs) while maintaining computational efficiency (< 10 s training time). Statistical validation (Cohen’s κ = 0.88, MCC = 0.89) confirms its reliability across diverse operational conditions.

Three key future research directions emerge:

  • Hybrid architectures combining ensemble methods with transformer networks33 for temporal pattern recognition

  • Edge optimization through model compression and incremental learning for real-time deployment

  • Context-aware systems employing adaptive thresholds and explainable AI34 for dynamic environments

These advancements will bridge remaining gaps between theoretical ML and practical industrial applications, particularly for extreme class imbalance scenarios (< 5% anomalies) and evolving sensor. Our findings demonstrate that Logistic Boosting provides the optimal balance of accuracy (96.6%), efficiency (< 10 s training), and interpretability for industrial IoT anomaly detection, outperforming both traditional ML and baseline deep learning approaches. While advanced neural architectures may warrant consideration for very large datasets (> 50k samples), their increased complexity and computational costs offer diminishing returns for most real-world smart factory applications networks. Standardized benchmarking across manufacturing domains will accelerate technology transfer from research to production systems.