Empirical Evaluation of Edge AI for Industrial IoT Security

Thesis Abstract

Industrial Internet of Things (IIoT) deployments increasingly rely on edge artificial intelligence to detect anomalies, enforce security policies, and enable real-time responses at the network edge. However, the heterogeneous and resource-constrained nature of industrial environments, combined with adversarial threats targeting edge devices and federated inference, raises questions about the reliability, robustness, and generalizability of edge-based security solutions. This study aims to empirically evaluate the effectiveness of edge AI for securing IIoT ecosystems, focusing on detection accuracy, latency, resource utilization, and resilience to concept drift and adversarial manipulation in real-world settings. The objectives are to (i) compare edge-based anomaly detection models with cloud-centric baselines in terms of detection performance and latency; (ii) assess the impact of hardware heterogeneity, such as CPU/GPU-assisted edge nodes and constrained microcontrollers, on inference throughput and energy consumption; (iii) examine robustness to concept drift across varying factory conditions and process changes; (iv) evaluate defenses against adversarial inputs and data poisoning at the edge; and (v) formulate a set of design guidelines for deploying secure edge AI in IIoT environments. The study adopts a mixed-methods, empirical field design conducted over twelve months in three manufacturing pilot sites representing discrete, process, and hybrid automation, with a total population of approximately 120 edge devices and 60 human operators. A purposive sampling approach identifies representative edge nodes (industrial gateways, fog nodes, and programmable logic controller aggregations) and associated IIoT sensors (vibration, temperature, current, and network flow metrics). Data collection combines passive telemetry logs, labeled security events, and controlled red-team experiments to generate adversarial and normal-condition datasets. Quantitative data consist of 10 TB of heterogeneous time-series data and 2,400 labeled security events, with a stratified sample of 1,000 edge inferences per site per week. Qualitative insights are drawn from 36 semi-structured interviews with operators and security engineers and 18 on-site observation sessions. The research employs a theoretical lens anchored in the Technology-Organization-Environment (TOE) framework and the Secure Edge Computing paradigm, integrating concepts from anomaly detection theory and adversarial machine learning. Methodologically, the study compares multiple edge AI architectures, including lightweight neural networks, ensemble methods, and federated learning configurations, using on-device inference with TensorRT and OpenVINO, and a cloud-based comparator. Data analysis employs (i) time-series anomaly detection metrics (precision, recall, F1-score, ROC-AUC) and latency benchmarks; (ii) resource utilization analysis (CPU/GPU load, memory footprints, energy consumption) using hardware counters and power profiling; (iii) concept drift evaluation via adaptive retraining intervals and drift detection methods (DDM, EDDM); (iv) robustness assessment through adversarial example generation (FGSM, BIM) and poisoning simulations, evaluated with robust accuracy and confusion matrices; and (v) qualitative coding of interview transcripts using thematic analysis to extract perceived security usability and deployment barriers. Inferential analyses include mixed-effects ANOVA to assess performance differences across device classes and sites, and regression modeling to quantify the relationship between latency, energy consumption, and detection accuracy. A hierarchical Bayesian model is employed to fuse heterogeneous data sources and quantify uncertainty in edge-detected events. The study also implements a risk-adjusted evaluation framework to translate technical performance into security posture outcomes. Expected findings indicate that edge AI can achieve near-parity detection accuracy with substantially reduced lateral communication latency compared to cloud baselines, albeit with higher variance across heterogeneous hardware and environmental conditions. Edge-specific adversarial defenses, including input sanitization and lightweight ensemble voting, are anticipated to improve robustness but require periodic retraining to counter concept drift. The investigation is expected to reveal a trade-off between inference speed and model complexity, with federated learning offering resilience benefits at the cost of communication overhead. The contributions to knowledge include empirical benchmarks for edge AI security in IIoT, a validated framework for evaluating edge instability and threat resilience, and practical deployment guidelines for secure, low-latency edge inference in multi-site manufacturing settings. The main conclusion posits that carefully engineered edge AI architectures, complemented by adaptive drift-aware maintenance and robust defense mechanisms, can provide effective, scalable IIoT security without fully relinquishing cloud-assisted oversight. Recommendations emphasize standardized evaluation protocols for edge security, continuous on-device learning with secure aggregation, and governance practices to balance security, privacy, and operational performance across diverse industrial contexts.