隨著工業4.0 概念的快速推進，人工智慧物聯網已成為智慧製造的核心基礎設 施。營運技術與資訊技術的深度融合，雖大幅提升了生產效率，卻也打破了過去 工業控制系統所依賴的實體隔離防護機制，使工廠設備直接暴露於複雜的網路威 脅之中。在眾多威脅中，分散式阻斷服務攻擊對工業環境的危害尤為顯著。工業 控制環境首重「可用性」，一旦遭受攻擊導致網路壅塞，輕則引發PLC強制停機 造成生產損失，重則導致設備物理損壞與工安事故。 然而，傳統入侵偵測系統難以應對不斷演進的DDoS變種攻擊；且學界多數 研究仍仰賴1990 年代的IT資料集，無法真實反映現代AIoT環境的通訊協定特 性。此外，許多工廠管理者缺乏有效的量化評估工具，無法在採購昂貴資安設備 前判斷網路的實際風險分佈，導致預算難以精準配置。 本研究採用專為AIoT攻擊偵測設計的BRUIoT資料集，涵蓋豐富的MQTT 等工業通訊協定特徵，並完整呈現DDoS攻擊的類別不平衡分佈。本研究系統性 比較涵蓋三大類別之八種主流模型：包含傳統機器學習（隨機森林、極端隨機樹、 XGBoost）、深度學習（多層感知器、LSTM）以及進階集成學習（加權軟式投票 集成、堆疊集成）。針對資料不平衡問題，另加入XGBoost-SMOTE 變體處理訓 練資料，以觀察極端少數攻擊（如Slowloris）的偵測召回率變化，並以精確率、 召回率、F1-Score 及推論耗時進行綜合評估。 本研究之成果，不僅提供具備高時效性的演算法量化比較基準，也能將偵測模 型轉化為「事前驗證工具」。管理者可透過旁路部署輕量化偵測模型，依據量化的 攻擊資訊識別高風險區域，在有限預算下做出較適當的防禦資源配置決策。;With the rapid advancement of Industry 4.0 and the Artificial Intelligence of Things (AIoT)， traditional closed Operational Technology (OT) environments are increasingly integrating with IT networks. While this interconnection enhances pro duction efficiency， it also dismantles the “air-gap” protection mechanism， exposing industrial environments to complex cyber threats. Among various threats， Distributed Denial of Service (DDoS) attacks are partic ularly detrimental. In OT environments， where “availability” is the highest priority， such attacks can cause network congestion， leading to PLC downtime， production losses， and even severe industrial accidents. Currently， traditional defense systems struggle to cope with rapidly evolving DDoS attack variants， and most academic research still relies on outdated IT datasets from the 1990s， failing to reflect the communication protocols of modern AIoT environments. Furthermore， industrial managers often lack effective quanti tative evaluation tools to assess actual network risks before purchasing expensive cybersecurity equipment， leading to suboptimal budget allocation. This study utilizes the BRUIoT dataset， which is specifically designed for AIoT attack detection， encompasses rich industrial protocol features like MQTT， and thor oughly reflects the extreme class imbalance of DDoS attacks. We systematically evaluate and compare eight mainstream models across three categories: traditional machine learning (Random Forest， Extra Trees， XGBoost)， deep learning (MLP， LSTM)， and advanced ensemble learning (Weighted Soft-Voting， Stacking Ensem ble). To address the class imbalance issue， an XGBoost-SMOTE variant is applied only to the training data to examine changes in the recall rate of extreme minor ity attacks such as Slowloris. The models are comprehensively evaluated based on precision， recall， F1-score， and inference time. The results of this study not only provide a highly relevant quantitative bench mark for algorithms but also transform the detection model into a “pre-deployment evaluation tool.” By deploying a lightweight detection model on a bypass network， managers can identify high-risk zones based on quantitative threat intelligence， enabling optimized cybersecurity resource allocation decisions under budget con straints.
