The　increasingly　sophisticated　cyber　attacks　have　become　a　serious　challenge　for　Industrial　Internet　of　Things　(IIoT),　which　presents　two　new　characteristics:　low　frequency　and　multi-stage.　That　is,　hackers　could　gain　authority　to　attack　industrial　equipment/infrastructure　gradually　in　a　long　interval　through　lurking,　lateral　intrusion　and　privilege　escalation.　While,　the　existing　Machine　Learning　(ML)　based　intrusion　detection　schemes　all　require　the　participation　of　expert　knowledge,　so　it　is　difficult　to　adaptively　select　an　attack　interval　and　a　retraining　period　of　the　detection　model　in　IIoT,　resulting　in　poor　detection　performance.　To　solve　above　problems,　a　bidirectional　long　and　short-Term　memory　network　with　multi-feature　layer　(B-MLSTM)　is　designed.　Firstly,　sequence　and　stage　feature　layers　are　introduced　in　the　model　training　phase　model　which　can　learn　the　corresponding　attack　interval　from　historical　data,　so　that　the　model　can　effectively　detect　attacks　with　different　intervals.　Then,　a　double-layer　reverse　unit　is　introduced　to　update　the　detection　model.　By　collecting　information　from　test　data　and　making　association　analysis　with　historical　data,　the　retraining　period　is　adaptively　selected　to　match　the　new　attack　interval.　Compared　with　the　previous　works,　our　proposed　scheme　has　a　lower　false　positive　rate　than　existing　schemes　by　at　least　46.79%,　and　the　false　negative　rate　is　reduced　by　at　least　79.85%,　which　are　carried　out　on　three　classic　IIoT　datasets.　©　1967-2012　IEEE.