Yousef Sanjalawe, F.M.A. Salam, Salam Al-E’mari, Sharif Naser Makhadmeh
The Industrial Internet of Things (IIoT) has brought transformative changes to industrial sectors by enabling intelligent automation, real-time monitoring, and data-driven decision-making. However, this increased connectivity and system integration have expanded the cybersecurity threat landscape, exposing critical infrastructure to sophisticated cyberattacks. Traditional Intrusion Detection Systems (IDS), particularly those relying on static signature-based detection, have proven inadequate in addressing the dynamic, heterogeneous, and resource-constrained nature of IIoT environments. Motivated by these emerging challenges, this paper presents a comprehensive review of AI-based IDS solutions developed over the past decade, with a specific focus on IIoT contexts. In doing so, it addresses key limitations in prior literature, including an insufficient focus on industry-specific constraints, a lack of attention to explainability and adversarial robustness, and an absence of a structured, future-oriented research agenda. The primary objectives are to synthesize the evolution of IDS methodologies, provide a multidimensional taxonomy that incorporates learning paradigms, deployment layers, and resource constraints, and critically assess the suitability of available datasets and benchmarks. The review highlights significant shifts from conventional machine learning techniques toward more adaptive, lightweight, explainable, and federated learning approaches. Additionally, it proposes a structured research roadmap outlining short-, mid-, and long-term directions for enhancing IDS in IIoT, such as edge-based detection, the integration of explainable AI (XAI), and the development of resilient, self-adaptive intrusion detection architectures. This paper offers a unified, actionable reference for researchers, practitioners, and policymakers seeking to strengthen industrial cybersecurity in increasingly complex and intelligent IIoT systems.