Abstract

The Industrial Internet of Things (IIoT) is central to modern industrial automation, yet its growing connectivity exposes critical systems to evolving cyber threats. Traditional intrusion detection methods struggle in IIoT environments due to class imbalance and limited adaptability to zero-day attacks. This systematic review evaluates generative AI techniques for IIoT intrusion detection and identifies deployment requirements for industrial environments. We searched five databases (IEEE Xplore, ACM Digital Library, Springer, ScienceDirect, and arXiv) for studies published between January 2019 and December 2025, applying predefined inclusion criteria. Following a systematic selection process (identification plus three progressive screening stages) across 342 records, 42 primary studies were included for systematic synthesis. We examined four GenAI paradigms-Generative Adversarial Networks, Transformers, Diffusion Models, and Variational Autoencoders-analyzing nine state-of-the-art frameworks through comparative performance analysis. Hybrid Transformer architectures (e.g., Transformer-GAN-AE) achieve the most consistent detection performance, while diffusion-based models (e.g., Diff-IDS) provide computational advantages for edge deployments. However, substantial variability in evaluation methodologies and limited reporting of statistical rigor indicate important gaps in current research practices. These findings inform the development of GenAI-driven strategies tailored to industrial infrastructure constraints and highlight key directions for advancing IIoT cybersecurity.