A Situation-Based Adaptive Defense Framework For IIoT Using Hierarchical Multi-Agent Reinforcement Learning

The deep convergence of Information Technology (IT) and Operational Technology (OT) exposes Industrial Internet of Things (IIoT) systems to complex cross-layer attacks. However, traditional defense methods are mostly designed for a single domain and rely on static or rule-based mechanisms, making them ineffective in capturing cross-layer attack evolution and coordinating adaptive responses. Therefore, this article proposes a Situation-Based Hierarchical Multi-Agent Reinforcement Learning (Situ-HMARL) adaptive defense framework, which formulates defense strategies based on real-time global industrial situations and proactively enhances the resilience of IIoT systems. Firstly, a three-stage industrial situational awareness architecture is proposed to continuously fuse heterogeneous data from the IT and OT layers into a structured Global Industrial Situation Vector (GISV), which serves as a unified global observation space for defense decision-making. Secondly, a lightweight Moving Target Defense (MTD) mechanism is designed to adaptively trigger IP-hopping based on the global industrial situation, thereby reducing overhead while preserving system availability. On this basis, a two-level Hierarchical Multi-Agent Reinforcement Learning (HMARL) framework is developed to decouple perception, decision-making, and enforcement. Low-level agents perform real-time local situational perception and execute defense actions, while a high-level agent reasons over the global industrial situation to generate coordinated defense strategies that minimize system losses. Extensive experiments conducted on the Cyber Operations Research Gym (CybORG) platform validate that the proposed framework effectively mitigates cross-layer attacks and significantly improves the availability of IIoT systems.