Cross-Domain Robust Dynamic Trust Evaluation for Industrial Internet of Things Edge Nodes

To address trust-score drift and unsafe online adaptation under cross-domain attack-contaminated streams in Industrial Internet of Things (IIoT) edge environments, this paper proposes a risk-aware lightweight test-time adaptation (TTA) framework, named RaL-TTA, for dynamic trust evaluation of edge nodes. RaL-TTA constructs a low-dimensional robust feature space and a source-domain normal-entropy reference baseline, and performs selective online maintenance in the target domain through Kolmogorov–Smirnov (KS) drift detection, SafeBrake risk gating, Adaptive Batch Normalization (AdaBN) anchor protection, and budgeted sample-level safeguards. Low-risk batches are adapted by updating only lightweight Batch Normalization (BN) parameters, whereas high-risk batches freeze online updates and invoke anchor-based protective inference. Experiments on Edge-IIoTset show that RaL-TTA substantially improves perturbation-stage attack detection and false-positive control compared with general TTA baselines while maintaining post-perturbation stability. In the main Edge-IIoTset setting, RaL-TTA achieves a perturbation-stage true positive rate (TPR) of 1.0000, false positive rate (FPR) of 0.0410, F1-score of 0.9544, and accuracy of 0.9713, while updating only 192 online parameters. External validation on X-IIoTID,a connectivity- and device-agnostic intrusion dataset for IIoT, further evaluates cross-service generalization under Modbus, Message Queuing Telemetry Transport (MQTT), and WebSocket target services. Additional sensitivity, startup-window robustness, calibration, and runtime-overhead analyses further characterize the stability, deployment assumptions, trust-score reliability, and edge-side feasibility of the proposed framework.