The increasingly sophisticated cyber attacks have become a serious challenge for Industrial
Internet of Things (IIoT), which presents two new characteristics: low frequency and multi-
stage. That is, hackers could gain authority to attack industrial equipment/infrastructure
gradually in a long interval through lurking, lateral intrusion and privilege escalation. While,
the existing Machine Learning (ML) based intrusion detection schemes all require the
participation of expert knowledge, so it is difficult to adaptively select an attack interval and a …