Paper deep dive
Exploring Robust Intrusion Detection: A Benchmark Study of Feature Transferability in IoT Botnet Attack Detection
Alejandro Guerra-Manzanares, Jialin Huang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 7/20/2026, 7:25:31 AM
Summary
This study benchmarks the transferability of three flow-based feature sets (Argus, Zeek, CICFlowMeter) across four IoT/IIoT datasets (MedBIoT, TON_IoT, Edge-IIoTset, CICIoT2023) using four machine learning classifiers (RF, SVM, k-NN, XGBoost). The results indicate significant performance degradation in cross-domain scenarios due to distribution shifts, highlighting the need for robust feature engineering and adaptive strategies.
Entities (14)
Relation Signals (14)
Argus ā usedin ā IoT Botnet Detection
confidence 95% Ā· evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter)
Zeek ā usedin ā IoT Botnet Detection
confidence 95% Ā· evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter)
CICFlowMeter ā usedin ā IoT Botnet Detection
confidence 95% Ā· evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter)
MedBIoT ā usedin ā IoT Botnet Detection
confidence 95% Ā· Four representative public datasets (MedBIoT, TON IoT, Edge-IIoTset, CICIoT2023) are selected
TON_IoT ā usedin ā IoT Botnet Detection
confidence 95% Ā· Four representative public datasets (MedBIoT, TON IoT, Edge-IIoTset, CICIoT2023) are selected
Edge-IIoTset ā usedin ā IoT Botnet Detection
confidence 95% Ā· Four representative public datasets (MedBIoT, TON IoT, Edge-IIoTset, CICIoT2023) are selected
CICIoT2023 ā usedin ā IoT Botnet Detection
confidence 95% Ā· Four representative public datasets (MedBIoT, TON IoT, Edge-IIoTset, CICIoT2023) are selected
Random Forest ā usedin ā IoT Botnet Detection
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Cross-domain intrusion detection remains a critical challenge due to significant variability in network traffic characteristics and feature distributions across environments. This study evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter) across four widely used datasets representing heterogeneous IoT and Industrial IoT network conditions. Through extensive experiments, we evaluate in- and cross-domain performance across multiple classification models and analyze feature importance using SHapley Additive exPlanations (SHAP). Our results show that models trained on one domain suffer significant performance degradation when applied to a different target domain, reflecting the sensitivity of IoT intrusion detection systems to distribution shifts. Furthermore, the results evidence that the choice of classification algorithm and feature representations significantly impact transferability. Beyond reporting performance differences and thorough analysis of the transferability of features and feature spaces, we provide practical guidelines for feature engineering to improve robustness under domain variability. Our findings suggest that effective intrusion detection requires both high in-domain performance and resilience to cross-domain variability, achievable through careful feature space design, appropriate algorithm selection and adaptive strategies.
Tags
Links
- Source: https://arxiv.org/abs/2602.23874v1
- Canonical: https://arxiv.org/abs/2602.23874v1
Trouble viewing inline? Open PDF directly ā
Full Text
55,520 characters extracted from source content.
Expand or collapse full text
Exploring Robust Intrusion Detection: A Benchmark Study of Feature Transferability in IoT Botnet Attack Detection Alejandro Guerra-Manzanares 1a b and Jialin Huang 2 1 School of Computer Science, University of Nottingham, Ningbo, China 2 School of Computer Science, University of Nottingham, Nottingham, United Kingdom Keywords: machine learning, intrusion detection, benchmark, feature, transferability, transfer learning, domain shift, botnet, industrial, internet of things, iot, iiot, attack detection, iot security, cross-domain generalization Abstract: Cross-domain intrusion detection remains a critical challenge due to significant variability in net- work traļ¬ic characteristics and feature distributions across environments. This study evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter) across four widely used datasets representing heterogeneous IoT and Industrial IoT network con- ditions. Through extensive experiments, we evaluate in- and cross-domain performance across multiple classification models and analyze feature importance using SHapley Additive exPlana- tions (SHAP). Our results show that models trained on one domain suffer significant performance degradation when applied to a different target domain, reflecting the sensitivity of IoT intru- sion detection systems to distribution shifts. Furthermore, the results evidence that the choice of classification algorithm and feature representations significantly impact transferability. Be- yond reporting performance differences and thorough analysis of the transferability of features and features spaces, we provide practical guidelines for feature engineering to improve robustness under domain variability. Our findings suggest that effective intrusion detection requires both high inādomain performance and resilience to crossādomain variability, achievable through careful feature space design, appropriate algorithm selection and adaptive strategies. 1 INTRODUCTION The Internet of Things (IoT) represents a major milestone in the evolution of the global informa- tion sector, building upon the foundation estab- lished by the Internet. At its core, IoT is an intel- ligent network that enables devices to exchange information and communicate continuously over the Internet. This connectivity allows individuals to track, monitor, locate, identify and control a wide range of objects and devices with unprece- dented eļ¬iciency (Alissa et al., 2022). The number of connected IoT devices reached 18.5 billion in 2024 and is projected to grow by 14% in 2025, reaching 39 billion by 2030 and sur- passing 50 billion by 2035 (Sinha, 2025). This exponential growth brings significant benefits in a https://orcid.org/0000-0002-3655-5804 b Correspondingauthor:alejan- dro.guerra@nottingham.edu.cn automation, eļ¬iciency and connectivity, but it also introduces critical security challenges. IoT devices often suffer from inherent limitations, in- cluding restricted processing power, limited stor- age capacity and constrained battery life, which hinder the implementation of robust security con- trols (Rozlomii et al., 2024). Further, the IoT ecosystem remains in a developmental stage, lack- ing standardized security models and frequently prioritizing functionality over protection. As a re- sult, IoT networks present numerous exploitable attack vectors (Hussain et al., 2020). A major threat in this context is the rise of botnets. A botnet is a network of infected de- vices that can execute tasks without direct hu- man involvement and be orchestrated into a pow- erful system capable of executing large-scale au- tomated operations, such as massive spam cam- paigns and Distributed Denial-of-Service (DDoS) attacks (Bitdefender, 2025). The implications arXiv:2602.23874v1 [cs.CR] 27 Feb 2026 of successful IoT botnet attacks extend far be- yond the compromise of individual devices. Since IoT systems are integrated into critical infras- tructure sectors, such as healthcare, energy and transportation, botnet attacks can result in ma- jor service disruptions, data breaches and privacy violations (Mims, 2025). IoT devices in homes also constitute a significant security challenge, as their vulnerabilities are often exploited by attack- ers (Bitdefender, 2025) As IoT botnet attacks become more sophisti- cated, traditional signature- and rule-based de- tection methods are ineffective against emerg- ing threats due to their limited adaptability to diverse IoT devices and communication proto- cols, particularly against zero-day or novel at- tacks (Abraham et al., 2018). To address this, re- searchers are increasingly using Machine Learning (ML) methods to build intelligent detection sys- tems (Guerra-Manzanares et al., 2019a). How- ever, current approaches face several challenges that limit their effectiveness in real-world de- ployment scenarios: poor cross-domain gener- alization, reliance on attack detection, overde- pendence on specific datasets and limited inter- pretability (Guerra-Manzanares et al., 2019b). These limitations reduce effectiveness against zero-day threats and diverse attack patterns aris- ing from variations in device types, network topologies and traļ¬ic behaviors. In addition, feature heterogeneity poses sig- nificant challenges for IoT botnet detection, as different feature extraction tools produce incom- patible representations. Tools such as Zeek, Ar- gus and CICFlowMeter generate different feature sets with varying dimensionalities and semantic meanings, complicating the development of uni- versally applicable detection systems (Ebrahem et al., 2025). These differences can lead to sub- stantial variations in detection performance, em- phasizing the fundamental diļ¬iculty of achieving cross-tool compatibility in IoT security. Current work provides only a limited under- standing of feature transferability, as most eval- uations emphasize in-domain performance rather than cross-domain generalization (Ferrag et al., 2020). Early-stage detection, crucial for prevent- ing botnet attacks, has also received insuļ¬icient attention (Guerra-Manzanares et al., 2020b). As a result, detection models often lack adaptabil- ity to new IoT environments, forcing practition- ers to rely on heavily customized solutions that increase deployment costs, prolong implementa- tion and increase risks during adaptation. A major constraint for model deployment is that deep learning (DL) requires large amounts of training data and computational resources, whereas classical ML methods can achieve strong performance with less data and fewer computa- tional resources for both training and inference. Finally, the lack of systematic feature transfer- ability analysis hinders the development of scal- able IoT security solutions, leaving practitioners without clear guidance on which features gener- alize across different IoT environments. Addressing these gaps, this study advances IoT botnet attack detection focusing on feature transferability across diverse environments. Our main contributions are: 1. Benchmarking feature transferability: We im- plement a unified framework to evaluate the transferability of widely used feature extrac- tion tools across multiple IoT datasets, es- tablishing a standard reference beyond sin- gleādataset evaluations. Models are trained and tested on features from the same tool, en- suring fair comparison and eliminating forced feature alignment. 2. Focus on cross-domain model evaluation: We evaluate four widely used ML algorithms under both inā and crossādomain settings. Inādomain tests measure performance when training and testing use the same dataset, while crossādomain tests apply models under zeroāadaptation conditions to new datasets, simulating realāworld deployment and high- lighting performance under distribution shift. 3. Practical reference for intrusion detection de- sign: Our results and analysis provide relevant insights to help researchers and practitioners design scalable intrusion detection systems for diverse IoT environments. This paper is organized as follows: Section 2 reviews related literature, Section 3 outlines the benchmark methodology and Section 4 presents the main findings. Section 5 discusses the results, while Section 6 concludes the study. 2 RELATED WORK Research has extensively explored ML and DL approaches to address IoT network security chal- lenges, particularly in botnet detection and in- trusion prevention. Bertino and Islam (2017) highlighted the limitations of conventional testing methods in heterogeneous and rapidly evolving IoT environments, where zero-day attacks remain diļ¬icult to counter. Based on this, Disha and Waheed (2022) proposed a Gini index weighted random forest that demonstrated superior perfor- mance on UNSW-NB15 and TON IoT datasets, while Gu and Lu (2021) combined Naive Bayes with SVM to achieve high accuracy across mul- tiple datasets. Sinha et al. (2025). demon- strated the robustness of CNN-LSTM hybrids on the BoT-IoT dataset, reaching 99.87% accuracy while maintaining resilience under noise through SHAP-based feature selection and SMOTE bal- ancing. Lightweight architectures such as Skip- GateNet achieved 99.91% accuracy with mini- mal storage and rapid processing, enabling de- ployment on constrained IoT devices (Alshehri et al., 2024). Abbas et al. (2024) emphasized the need for adaptable DL models across diverse op- erational contexts. Despite these advances, chal- lenges persist due to the lack of standardization and the highly variable nature of IoT data, which hinder model generalization across diverse envi- ronments. Transfer learning (TL) has emerged as a cru- cial approach in IoT security, enabling knowl- edge reuse across domains with limited labeled data and heterogeneous environments. RodrĆguez et al. (2022) demonstrated its effectiveness by in- tegrating CNN with TL to improve zero-day at- tack detection through feature freezing and un- supervised adaptation. However, Li et al. (2023) found that domain mismatch and distributional shifts often hinder generalization of pretrained models. Overall, TL reduces distributional gaps and boosts detection accuracy, though future work must separate feature transferability from algorithmic adaptation to achieve robust general- ization in dynamic IoT settings. Nazir et al. (2023) highlighted inconsisten- cies in datasets, feature extraction and metrics, emphasizing the need for unified protocols. Al- though datasets like BoT-IoT (Koroniotis et al., 2019) are valuable benchmarks covering multiple attack types, concerns arise about their ability to reflect real-world traļ¬ic. To address these issues, Keshk et al. (2023) introduced a framework com- bining explainable DL with cross-domain eval- uation, enhancing transparency and reliability. Lypa et al. (2025) compared traļ¬ic analysis tools showing differences in generated features and re- source demands. Their study highlights the need to select appropriate tools for IoT security, as fea- ture extraction directly impacts model transfer- ability. Despite progress in IoT botnet detection, sig- nificant gaps remain regarding feature transfer- ability. Most studies focus on single datasets, achieving high in-domain accuracy but neglect- ing cross-dataset or cross-environment evalua- tions, leaving robustness and generalization unad- dressed. Research also lacks systematic compar- isons across widely used tools and little attention has been given to identifying which feature cat- egories retain stability across domains. Current work relies on tool-specific benchmarks without clarifying whether extracted features can general- ize beyond their original environment. To address these limitations, our work establishes a struc- tured benchmark using popular tools across mul- tiple IoT botnet datasets under zero-adaptation conditions, providing a systematic evaluation of feature transferability in heterogeneous IoT set- tings. 3 METHODOLOGY This section outlines the benchmarking frame- work implemented in our study, including the procedures used to evaluate feature transferabil- ity between domains. It also details the experi- mental setup, the datasets employed, the feature spaces, in addition to the ML classification algo- rithms and performance metrics applied. 3.1 Benchmarking Framework This study implements a benchmarking frame- work to evaluate how different feature extraction methods transfer knowledge between domains in IoT botnet detection systems. As depicted in Fig- ure 1, the framework consists of five main steps: 1. Data Collection: Four representative public datasets (MedBIoT, TON IoT, Edge-IIoTset, CICIoT2023) are selected, covering both gen- eral IoT and industrial IoT application sce- narios to ensure diversity of the experimental setup. 2. Feature Extraction: Three widely used fea- ture extraction tools (Zeek, Argus and CI- CFlowMeter) are employed to transform raw traļ¬ic packets (pcap files) into structured fea- ture representations. These tools provide dif- ferent levels of granularity and semantic con- tent, enabling systematic cross-domain com- parisons. libcap Data Collection Zeek Argus CICFlowMeter Raw Standard pcap Data LabelingData CleaningData Splitting Training dataset Test dataset Data BalancingNormalization Data Preprocessing Normalization RFSVM k-NNXGBoost AccuracyRecall Precision Normalization parameters from training dataset Feature ExtractionModel Evaluation Model Training Specificity Figure 1: Benchmarking framework overview 3. Data Preprocessing: Includes uniform stan- dardization of all feature sets through label encoding, missing value imputation, outlier truncation, normalization and class balancing. These steps are designed to remove noise aris- ing from heterogeneous data sources and en- sure comparability across domains. 4. Model Training: Classic ML algorithms (Ran- dom Forest (RF), Support Vector Machines (SVM), k-Nearest Neighbors (k-N) and XG- Boost) are trained on source domain datasets and tested on target domain data without re- training. This simulates realistic deployments where models must generalize to unseen envi- ronments or adapt to drastic changes in oper- ating conditions. 5. Evaluation: Cross-domain detection perfor- mance is systematically assessed using rele- vant performance metrics, i.e., accuracy, re- call, precision and specificity. To control for randomness bias, we perform repeated exper- iments and report confidence intervals. This framework enables rigorous assessment of feature extraction tools in cross-domain transfer operations while preserving their original feature semantics. The results provide practical design recommendations for IoT intrusion detection sys- tems. 3.2 Experimental Setup Our benchmark implements a single-source zero- adaptation cross-domain testing strategy, focus- ing on evaluating the transferability of features generated by different feature extraction tools in cross-domain detection. The experimental pro- cess is as follows: each time, one dataset is fixed as the source domain for model training and vali- dation; the remaining three datasets serve as tar- get domains, used only for testing and not for retraining. For all experiments, the classification thresh- old is fixed at0.5(the neutral midpoint for bi- nary classification) and no hyperparameter tun- ing or threshold adjustment is performed on the target domain. This strict setting ensures that there is no information leakage from the target domain, thus providing a fair and rigorous evalu- ation of cross-domain generalization ability. Al- though this setting may lead to extreme cases, such as perfect scores when source and target domains are highly similar, or high recall but low precision when threshold misalignment oc- curs, the results are considered normal and inter- pretable within the transfer learning evaluation framework. All datasets are processed using three feature extraction tools (Zeek, Argus, CICFlowMeter) to form three distinct feature spaces. Within each feature space, four classifiers (RF, SVM, k-N, XGBoost) are selected for model building. To reduce the influence of random factors, each ex- periment is repeated five times and the average results are reported. To properly assess cross-domain performance, we also conduct in-domain evaluation, which measures the modelās performance when the source and target domains are the same and serves as a reference baseline for evaluating cross- domain results. 3.3 Datasets To establish a diverse framework for evaluating feature transferability across domains, we use four publicly available IoT botnet datasets. De- tailed descriptions of these datasets are provided as follows. Note that all datasets include benign or normal IoT operation data and simulated ma- licious behaviors. ā¢ MedBIoT (Guerra-Manzanares et al., 2020a). It provides network traļ¬ic from a medium- scale realistic IoT network comprising 83 physical and emulated devices, distributed across multiple subnets to emulate oļ¬ice en- vironments. Using real malware samples (i.e., Mirai, Bashlite, Torii), the dataset focuses on capturing botnet propagation activity rather than attack execution. ā¢ CICIoT2023 (Neto et al., 2023). It is a large- scale IoT dataset, including 105 real devices, that emulate a smart home environment. It focuses on attack detection, simulating 33 dis- tinct attacks that encompass both conven- tional threats (e.g., web-based and brute-force attacks) and IoT-specific attacks (e.g., DoS, DDoS and Mirai). ā¢ TON_IoT (Moustafa, 2021). It enables secu- rity research in both IoT and IIoT domains by providing diverse data sources such as teleme- try from IoT and IIoT sensors, Windows- based systems and Linux servers. Using a realistic virtualized topology, it contains net- work traļ¬ic from real and emulated smart home devices, edge nodes and industrial sen- sors, focusing on attack simulation. ā¢ Edge-IIoTset (Ferrag et al., 2022). It allows research in industrial and edge computing en- vironments by providing network traļ¬ic from seven domains such as agriculture, health- care, manufacturing and autonomous vehi- cles. It focuses on simulating 14 distinct at- tacks within a topology composed of 13 real IoT and IIoT sensors. 3.4 Feature Spaces In this study, we use three feature extraction tools to derive statistical representations (i.e., features) from raw network traļ¬ic. Their selection is moti- vated by their widespread adoption in ML-based intrusion detection research and their ability to generate distinct feature spaces that effectively capture the behavioral dynamics of IoT environ- ments. The extraction tools are described as fol- lows. ā¢ CICFlowMeter (Draper-Gil et al., 2025). For- merly known as ISCXFlowMeter, it is a Java- based network traļ¬ic analysis tool that con- structs bidirectional flows using a standard 5- tuple (source IP, destination IP, source port, destination port and protocol) and extracts statistical features per flow, capturing traļ¬ic behavior across both directions through sev- eral metrics, time- and size-related attributes. ā¢ Zeek (Paxson et al., 2025). Formerly known as Bro, it is an open-source network monitoring framework designed as a passive traļ¬ic ana- lyzer. Rather than focusing on packet-level statistics, it interprets protocol semantics and generates structured logs that capture session or connection-level details such as duration, byte counts, TCP flags and state transitions. ā¢ Argus (Bullard, 2025). Short for Audit Record Generation and Utilization System (ARGUS), it is an open-source network flow monitoring tool designed for continuous traf- fic analysis. It generates bidirectional flow records and reports detailed attributes that cover network identification, packet dynam- ics, services and resource utilization. To evaluate feature transferability, the original pcap traļ¬ic files from each dataset were processed using the three feature extraction tools. Although applied to the same input data, the tools produce outputs that vary in structure, type and feature count, producing three distinct feature sets. Note that before feature extraction, all traļ¬ic captures were standardized to the libpcap format (.pcap) to ensure tool compatibility and address format inconsistencies. This established consis- tent processing conditions, ensuring fairness, re- producibility and reliability in the transferability analysis. 3.5 ML Workflow The following sections describe the data prepro- cessing steps applied to prepare the datasets, the ML models evaluated and the performance met- rics assessed. 3.5.1 Data Preprocessing Label Encoding. Traļ¬ic labels are consolidated into a binary scheme to ensure consistency across datasets. Specifically, all benign flows are as- signed a value of 0, while all attack categories are grouped into a single class with a value of 1. This eliminates issues arising from different labeling schemes and number of classes across datasets. Data Cleaning. The datasets used in this study originate from heterogeneous sources and experimental configurations, which inevitably in- troduce inconsistencies in structure, content and feature definitions. These discrepancies can in- troduce noise and bias, undermining model per- formance and reducing feature transferability. The data cleaning process comprises three main stages: (i) removal of environment-specific identi- fiers such as source and destination IP addresses, ports and timestamps, which encode deployment- specific characteristics that may lead to over- fitting in transfer learning; (i) exclusion of in- stances with incomplete or corrupted feature val- ues, especially when multi-tool extraction intro- duces segmentation mismatches; (i) imputing missing numerical values using the median value for that feature, or zero if that feature is entirely missing on the dataset; and (iv) standardization of feature names and column ordering across ex- traction tools to ensure dimensional and semantic alignment between datasets. Data Splitting. The final dataset was con- structed in 12 combinations derived from the cross-product of the three feature extraction tools and the four IoT botnet datasets. For each com- bination, samples were split hierarchically into training and test sets with an 8:2 ratio. To reflect realistic evaluation conditions, the test sets pre- served the original class distributions, while bal- ancing techniques were applied only to the train- ing sets. This ensures that the results report actual cross-domain generalization performance without introducing artificial bias into the test stage. Data Balancing. A major challenge is the ex- treme class imbalance present in certain datasets, particularly TON_IoT, where benign traļ¬ic is scarce and malicious traļ¬ic is dominated by DoS and scanning events. In contrast, attack types such as ransomware are rare. This skewed distri- bution biases classifiers toward majority classes, often yielding high overall accuracy but poor re- call on minority categories. To mitigate this issue, we used the Synthetic Minority Over-sampling Technique for Nominal and Continuous features (SMOTE-NC) (Chawla et al., 2002). Normalization. The datasets contain at- tributes with diverse numerical ranges, where some variables show significantly larger magni- tudes than others. Given that some algorithms are sensitive to extreme values, this may intro- duce bias towards features with extreme values. To address this, normalization was applied to rescale each feature into the[0,1]range. Nor- malization parameters are derived only from the training set and subsequently applied to both training and test sets, ensuring a realistic eval- uation scenario and preventing data leakage. 3.5.2 ML Algorithms In this study, four widely used ML algorithms were employed. These algorithms have demon- strated strong performance across diverse do- mains and are often adopted as baselines in cy- bersecurity research due to their robustness, in- terpretability and eļ¬iciency. All algorithms were evaluated using typical hyperparameters to en- sure fair and comparable results. The selected models are: Random Forest (RF), Support Vector Machines (SVM),kāNearest Neighbors (kāN) and eXtreme Gradient Boosting (XGBoost). The RF classifier was constructed with 300 estimators, ensuring suļ¬icient ensemble diversity for stable performance. The k-N classifier was configured withk=5, using the Euclidean distance metric to measure similarity. XGBoost was trained with 400 boosting rounds, balancing computational ef- ficiency with predictive accuracy. The SVM clas- sifier was implemented with a linear kernel, en- abling eļ¬icient handling of high-dimensional fea- ture spaces. 3.5.3 Performance metrics The evaluation is conducted using four relevant performance metrics derived from the confusion matrix: accuracy, recall, precision and specificity. Accuracy measures the overall proportion of cor- rectly classified instances (both positive and nega- tive) out of all predictions, providing a broad view of model performance. However, in highly imbal- anced datasets, accuracy can be misleading, as a model may achieve high accuracy simply by favor- ing the majority class while neglecting minority instances. In our case, we ensured the reliability of the accuracy metric by using balanced train- ing, validation and test sets. Recall, also known as sensitivity or True Positive Rate (TPR), re- flects the ability of the model to correctly identify positive instances, making it particularly impor- tant in scenarios where missing minority classes (e.g., rare attack types) would be costly. Preci- sion, on the other hand, reflects the correctness of positive predictions, penalizing false alarms and ensuring that detected events are truly relevant. Finally, Specificity, also known as True Nega- tive Rate (TNR), reports the modelās ability to correctly identify negative (normal) instances. It is particularly important in contexts where false positives are costly, ensuring that normal data is not incorrectly flagged as positive. 4 RESULTS The following section reports the results of the feature transferability analysis in- and cross- domain across classification models and datasets. It also provides an analysis of the most important features of each feature space for in- and cross- domain detection models. 4.1 Feature Set Transferability Across Classification Models Figure 2 provides a comparative visualization of the performance metrics obtained for the four classification algorithms in both in- and cross- domain evaluation settings. The figure uses box- plots to capture the variability in the results, pro- viding a concise yet informative summary of the distribution of performance scores. Each boxplot highlights the median and average values as mea- sures of central tendency, using an orange hor- izontal line in the body of the boxplot and an orange rhombus, respectively. The interquartile range (IQR), delimited by the boxplot body, re- ports the spread and consistency of the modelsā performance. Outliers are also depicted, report- ing cases in which the algorithms showed unusu- ally high or low accuracy relative to the bulk of the results. By juxtaposing in- and cross-domain out- comes, Figure 2 enables a direct assessment of how well each algorithm generalizes beyond the training domain. This comparison is crucial for understanding the robustness of the models and the transferability of the feature spaces, as strong in-domain performance does not necessar- ily translate to effective cross-domain transfer- ability. 4.1.1 In-Domain Performance In the in-domain evaluation (blue boxplots in Figure 2), all classifiers demonstrate consistently strong performance while revealing notable dif- ferences in distribution across feature spaces. Specifically, Argus and CICFlowMeter report similar behavior, with accuracy values ofā0.9 across all classification models, high recall (above 0.9, except for SVM) and relatively high preci- sion and specificity metrics ranging between0.8 and0.9. In contrast, the Zeek feature space shows mixed behavior: while RF and XGB achieve near- perfect accuracy, recall, precision and specificity, kNN and SVM report values below0.8for all metrics. This emphasizes that the choice of fea- ture space has a substantial impact on classifier performance. In particular, while Argus and CI- CFlowMeter provide stable and balanced results across learning algorithms, Zeek appears more sensitive to the underlying classification model, producing excellent results for tree-based mod- els, but weaker results for distance-based and margin-based approaches. These findings high- light the importance of aligning feature represen- tations with the strengths of specific learning al- gorithms. 4.1.2 Cross-Domain Performance Cross-domain evaluation (green boxplots in Fig- ure 2) shows consistent behavior across feature spaces, but with significantly different results compared to the in-domain case. In general, for all feature spaces and classifier combinations, the accuracy boxplots show larger bodies, with mean and median values clustering around0.5, indicat- ing poor generalization to cross-domain settings. Although some exceptions can be observed, such as the combination of kNN and the Argus feature space, this general trend extends to specificity. Most models evidence high recall, at the expense of very low precision scores, highlighting a ten- dency to over-predict positive instances. This imbalance suggests that classifiers trained in one domain are prone to misclassifying benign traf- fic as malicious when applied to unseen domains, inflating recall while severely compromising pre- cision. This behavior is problematic in practi- cal deployments, as it can lead to excessive false alarms and undermine the usability of intrusion detection systems. It is worth noting that while the above trends apply to all feature spaces, the Argus feature space reports slightly better and more consis- tent results for generalization, whereas the Zeek feature space performs notably worse than CI- CFlowMeter and Argus, particularly in terms of recall. The extremely wider bodies observed in Zeekās boxplots indicate instability and high vari- ability across classifiers, suggesting that its fea- ture representations may be less robust when transferred to cross-domain settings. This insta- bility highlights the susceptibility of certain fea- ture extraction methods to domain shifts, where differences in traļ¬ic characteristics or protocol- level details can significantly affect classifier re- liability. In contrast, the relatively stable per- formance of Argus suggests that its features cap- ture slightly more generalizable patterns, making them less sensitive to distributional changes. kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Accuracy kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (TPR) kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Precision kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Specificity (TNR) In-DomainCross-Domain kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Accuracy kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (TPR) kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Precision kNNRFSVMXGB 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Specificity (TNR) kNNRFSVMXGB Model 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Accuracy kNNRFSVMXGB Model 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (TPR) kNNRFSVMXGB Model 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Precision kNNRFSVMXGB Model 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Argus Zeek CICFlowMeter Specificity (TNR) Figure 2: In- and cross-domain performance of feature spaces across classification models 4.2 Feature Set Transferability Across Domains The boxplots in Figure 3 provide a comparative visualization of performance metrics across four datasets under both in- and cross-domain eval- uation settings. In this figure, the x-axis de- notes the source domain (i.e., the dataset used for training), while the y-axis represents the gen- eralization performance for in- and cross-domain scenarios, as indicated in the legend (target do- main). To further enrich the comparison, color coding is applied in Figure 3: blue shades (dark and light) represent IoT datasets (general IoT do- main), while green shades (dark and light) corre- spond to IIoT datasets (specific IIoT domain). This comparison provides a complementary per- spective to Figure 2, emphasizing the ability of models trained on a specific source domain to generalize beyond their original training environ- ment. Such generalization is a critical require- ment for real-world IoT and IIoT deployments, where attack patterns and data distributions of- ten vary significantly across domains. Evaluat- ing cross-domain performance not only reveals the robustness and adaptability of the models but also helps identify potential domain-specific overfitting. These insights are essential for guid- ing future improvements in model design, feature representation and training strategies aimed at achieving reliable security in heterogeneous IoT ecosystems. 4.2.1 In-Domain Performance Figure 3 illustrates that when the source and tar- get domains are identical (in-domain), the mod- els achieve consistently high performance metrics. However, when evaluated across different feature spaces, the results vary significantly. Specifically, the CICFlowMeter feature space, which is larger and more complex, shows greater variability and lower mean and median values across all datasets, suggesting potential challenges in feature stabil- ity and model generalization. In contrast, the Ar- gus and Zeek feature spaces yield remarkably bet- ter in-domain performance. In general, both fea- ture spaces report low variability (shorter boxplot bodies) and superior central tendency measures. These observations indicate that feature space se- lection plays a critical role in both stability and CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Accuracy CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (TPR) CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Precision CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Specificity (TNR) Target Domain CICIoT2023MedBIoTTON_IoTEdge-IIoTset CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Accuracy CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (TPR) CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Precision CICIoT23MedBIoT TON_IoT Edge-IIoT 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Specificity (TNR) CICIoT23MedBIoT TON_IoT Edge-IIoT Source Domain 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Accuracy CICIoT23MedBIoT TON_IoT Edge-IIoT Source Domain 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Recall (TPR) CICIoT23MedBIoT TON_IoT Edge-IIoT Source Domain 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Precision CICIoT23MedBIoT TON_IoT Edge-IIoT Source Domain 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Argus Zeek CICFlowMeter Specificity (TNR) Figure 3: In- and cross-domain performance of feature spaces across source datasets predictive accuracy, with smaller, well-structured and less redundant feature sets, containing fewer but informative features, yield more reliable out- comes. 4.2.2 Cross-Domain Performance Cross-domain evaluation, reported in Figure 3 as boxplots derived from different source and tar- get domain combinations, shows poor general- ization across all datasets, regardless of whether the domains belong to IoT or IIoT. These results emphasize the inherent challenge of transferring knowledge between heterogeneous environments where feature distributions and attack patterns differ significantly. Despite this general trend, a few interesting observations emerge. Regarding feature space transferability, the Argus feature space produces the most consis- tent results for accuracy and specificity, as indi- cated by shorter boxplots, but shows greater in- consistency for recall and precision, particularly for the latter. In contrast, the Zeek feature space shows higher variability in accuracy and speci- ficity but achieves better precision and recall in cross-domain settings, suggesting stronger adapt- ability to detect diverse attack patterns. Finally, the CICFlowMeter feature space demonstrates the highest variability across datasets for recall and precision, while maintaining relatively com- pact boxplots for specificity, indicating that its larger feature set may introduce noise affecting certain performance metrics. Regarding datasets, while overall performance metrics across domains are notably poor, cer- tain source domain and feature space combi- nations yield remarkable results. For example, the TON_IoT dataset provides the best cross- domain performance when paired with the CI- CFlowMeter feature space, suggesting that spe- cific combinations of source data and feature rep- resentation can partially mitigate domain shift. Similarly, the MedBIoT dataset demonstrates rel- atively strong cross-domain performance when evaluated on the CICIoT23 dataset (both belong- ing to the IoT domain) using the Zeek feature space. These observations reinforce the impor- tance of analyzing feature-domain interactions, as certain combinations seem to mitigate domain shift more effectively than others. Understanding these relationships is crucial for designing mod- els that can generalize across heterogeneous IoT and IIoT environments, where variability in traf- fic patterns and attack behaviors poses significant challenges for intrusion detection systems. Finally, it is worth noting that while ac- curacy and specificity results generally indicate poor cross-domain transferability for most feature spaces, recall is particularly high in some cross- domain settings, often paired with extremely low precision. This imbalance suggests that models tend to over-predict positive cases in unfamiliar domains, capturing most true positives (attacks), but at the cost of a large number of false positives. This behavior can be problematic in IDS, as it may lead to excessive false alarms, significantly compromising operational eļ¬iciency. These find- ings highlight the need for strategies that balance recall and precision, such as threshold calibration or domain adaptation techniques, to achieve reli- able performance in heterogeneous environments. 4.3 Feature Importance Since the k-N model demonstrated slightly better performance in Section 4.1, we adopt this model to analyze feature importance for both in- and cross-domain settings. To achieve this, we employ SHapley Additive exPlanations (SHAP) (Lundberg and Lee, 2017) to approxi- mate feature contributions. For each evaluation scenario, SHAP values are computed on the tar- get test set and the mean absolute contribution of each feature is taken as its importance. Fea- tures are then ranked according to these values. The in-domain SHAP analysis measures the rela- tive influence of features when models are trained and evaluated within the same domain, whereas the cross-domain SHAP analysis assesses feature influence when models are trained on a source dataset and tested on a different target dataset. The top three features for both in- and cross- domain performance within each feature space are provided in Figure 4, highlighting numerical differences and providing insights into feature rel- evance under both stable and domain-shift con- ditions. It is worth noting that this analysis pro- vides a global assessment of feature importance, although the significance of individual features may vary across specific contexts (i.e., different combinations of feature sets, classification mod- els and sourceātarget domain pairs). Interestingly, across all feature sets, two of the three most influential features remain consistent between in- and cross-domain settings. However, their relative importance and ranking differ sig- nificantly across these conditions. In the Argus feature set, cross-domain anal- ysis ranks state (0.176), Proto (0.115) and N IN Conn P DstIP (0.097) as the top three fea- tures. Under in-domain conditions, N IN Conn P DstIP (0.205) becomes the most important feature, nearly doubling its cross-domain value, while state shifts to second (0.115) and N IN Conn P SrcIP (0.099) replaces Proto in third posi- tion. Although topology-dependent features (i.e., IP addresses) were removed, Argus still shows a strong reliance on behavioral indicators, such as counts of new connections, which gain promi- nence under in-domain conditions. The connection state feature, which represents the lifecycle of network sessions, shows high im- portance in cross-domain scenarios, almost twice its relevance compared to in-domain. This sug- gests that session behavior generalizes well across different environments, making it a robust indica- tor to detect anomalies when training and testing occur in different domains. In contrast, the pro- tocol feature emerges (Proto) as significant only in cross-domain settings, likely because protocol distribution patterns differ between domains. For the Zeek feature set, the three most in- fluential features for in-domain performance are conn_state, duration and resp_pkts, all with im- portance values between 0.148 and 0.099. For cross-domain, conn_state remains the most im- portant feature, increasing its weight to 0.203, while duration slightly decreases in importance and orig_pkts replaces resp_pkts as the third most relevant feature. This shift highlights several insights. First, the dominance of conn_state across both sce- narios indicates that session lifecycle behavior generalizes well across domains, making it a ro- bust feature for detecting anomalies in heteroge- neous environments. Second, the reduced impor- tance of duration in cross-domain settings sug- gests that timing characteristics may be more domain-specific, limiting their transferability. Fi- nally, the substitution of orig_pkts for resp_pkts under cross-domain conditions reflects a change in traļ¬ic directionality patterns between domains, which can serve as a discriminative signal when adapting models to new environments. Overall, the findings in the Argus and Zeek important features suggest the need to prioritize behavioral features that capture protocol state 0.000.050.100.150.20 Importance Mean N IN Conn P DstIP state N IN Conn P SrcIP 0.205 0.106 0.099 In-Domain 0.000.050.100.150.20 Importance Mean state Proto N IN Conn P DstIP 0.176 0.115 0.097 Cross-Domain 0.000.050.100.150.20 Importance Mean conn_state duration resp_pkts 0.148 0.113 0.099 In-Domain 0.000.050.100.150.20 Importance Mean conn_state orig_pkts duration 0.203 0.093 0.091 Cross-Domain 0.000.050.100.150.20 Importance Mean Bwd Init Win Bytes SYN Flag Count Fwd Packet Length Min 0.175 0.149 0.071 In-Domain 0.000.050.100.150.20 Importance Mean Bwd Init Win Bytes Bwd Header Length SYN Flag Count Argus Zeek CICFlowMeter 0.130 0.093 0.084 Cross-Domain Figure 4: Top-3 features ranked by importance, based on SHAP values, for in- and cross-domain performance and exchange patterns for robust cross-domain intrusion detection. For the CICFlowMeter feature set, the top three features under cross-domain conditions are Bwd Init Win Bytes (0.130), Bwd Header Length (0.093) and SYN Flag Count (0.084). In in- domain settings, Bwd Init Win Bytes remains the most influential feature, increasing its importance to 0.175. SYN Flag Count also rises significantly to 0.149, while Fwd Packet Length Min (0.073) replaces Bwd Header Length as the third most relevant feature. This pattern suggests several insights. First, the consistent dominance of Bwd Init Win Bytes across both scenarios suggests that TCP window size behavior is a strong and generalizable indi- cator of traļ¬ic characteristics, making it valu- able for both in-domain and cross-domain detec- tion. Second, the increased importance of SYN Flag Count in in-domain conditions indicates that connection initiation patterns become more dis- criminative when the model is trained and tested within the same environment, likely due to local- ized attack behaviors such as SYN flooding. Fi- nally, the substitution of Fwd Packet Length Min for Bwd Header Length under in-domain condi- tions reflects a shift toward finer-grained packet size characteristics, which capture subtle varia- tions in traļ¬ic flows that are more relevant within a single domain. Overall, these findings highlight the role of transport-layer and packet-level behav- ioral features in achieving robust intrusion detec- tion, with TCP-specific indicators being particu- larly important. In general, CICFlowMeter demonstrates weaker cross-domain performance primarily due to the nature of its feature set, which is dom- inated by transport-layer and packet-level indi- cators such as Bwd Init Win Bytes, SYN Flag Count and header lengths. These features are highly sensitive to protocol configurations and traļ¬ic engineering, making them less robust un- der domain shift. In contrast, Argus and Zeek fo- cus on session-level and behavioral features, such as state and conn_state, which capture the life- cycle of network connections and protocol states. These abstractions seem to generalize well across heterogeneous environments, explaining their sta- bility and similar top-ranked features in both in- and cross-domain analyzes. The volatility of CICFlowMeterās packet-centric features, com- bined with its lack of higher-level behavioral in- dicators, limits its adaptability when models are transferred between domains. Therefore, Argus and Zeek may provide a more resilient approach to cross-domain intrusion detection by emphasiz- ing protocol state and connection behavior rather than domain-specific packet metrics. 5 DISCUSSION Our experimental results show the inherent chal- lenges of cross-domain feature set transferability: models trained on one domain demonstrate poor generalization when evaluated on a different tar- get domain. Furthermore, the choice of classifica- tion algorithm significantly affects cross-domain performance, emphasizing the interplay between features and model architecture in achieving ro- bust transferability. Beyond algorithmic and source-target domain considerations, our findings show that the na- ture of the features significantly impacts trans- ferability and their relative importance under in- and cross-domain conditions. Feature space se- lection is therefore critical for intrusion detec- tion, as it directly influences whether models can maintain performance under domain shift. Our experiments indicate that the Argus and Zeek provide better stability by leveraging behavioral and session-level indicators, while CICFlowMe- terās reliance on packet-centric features makes it more vulnerable to distributional changes. This stresses the broader challenge of transferring learned decision boundaries across heterogeneous environments, where differences in traļ¬ic char- acteristics introduce significant variability. Ef- fectively addressing this issue requires strategies such as domain adaptation or designing universal feature representations that capture generalizable patterns. The observed differences suggest that, even within in-domain settings, feature extraction strategies can introduce biases that affect gen- eralization. Consequently, robust intrusion de- tection requires not only careful model selection, but also consideration of the feature space, as mismatches between representation and classi- fier can lead to significant performance degra- dation. This implies that effective network se- curity solutions must integrate both algorithmic and feature-engineering perspectives to ensure re- silience across diverse traļ¬ic patterns and attack scenarios. In conclusion, effective intrusion de- tection requires not only strong in-domain accu- racy but also resilience to cross-domain variabil- ity, as real-world deployments inevitably face di- verse traļ¬ic patterns and evolving attack land- scapes. This study has several limitations: (i) the evaluation was conducted on four IoT botnet datasets, which may not fully represent the heterogeneity of real-world traļ¬ic; (i) zero- adaptation transferability provides a strict bench- mark, but does not account for lightweight adap- tation techniques that could improve perfor- mance; (i) only three tools were included, which may limit generalization; (iv) feature semantics across tools were not aligned, which could have in- troduced bias. Despite its limitations, this study offers relevant insights into feature transferabil- ity for IoT botnet detection and provides a foun- dation for future adaptive and scalable network security approaches. 6 CONCLUSION Our results confirm the inherent challenges of cross-domain intrusion detection: models trained on one domain demonstrate poor generalization when evaluated on another, with both classifi- cation model choice and feature representation significantly influencing transferability. Besides, the nature of the features used is critical to build more resilient models to domain shift. In this regard, we provide guidelines for effective fea- ture engineering based on our experimental re- sults. However, our findings stress the need for strategies such as domain adaptation, feature nor- malization and the design of universal feature representations to improve robustness under do- main variability. Future work will explore ad- vanced domain adaptation techniques, automated feature selection and representation learning ap- proaches to develop intrusion detection systems that maintain resilience across diverse and evolv- ing network environments. REFERENCES Abbas, S., Bouazzi, I., Ojo, S., et al. (2024). Evaluat- ing deep learning variants for cyber-attacks detec- tion and multi-class classification in iot networks. PeerJ Computer Science, 10:e1793. Abraham, B., Mandya, A., Bapat, R., et al. (2018). A comparison of machine learning approaches to detect botnet traļ¬ic. In 2018 IJCNN, pages 1ā8. IEEE. Alissa, K., Alyas, T., Zafar, K., et al. (2022). Bot- net attack detection in iot using machine learn- ing. Computational Intelligence and Neuroscience, 2022(1):4515642. Alshehri, M. S., Ahmad, J., Almakdi, S., et al. (2024). Skipgatenet: A lightweight cnn-lstm hybrid model with learnable skip connections for eļ¬icient botnet attack detection in iot. IEEE Access, 12:35521ā 35538. Bertino, E. and Islam, N. (2017). Botnets and inter- net of things security. Computer, 50(2):76ā79. Bitdefender (2025). The 2025 iot security land- scape report. https://blogapp.bitdefender.com/ hotforsecurity/content/files/2025/10/2025\_iot\ _security\_report.pdf. Bullard, C. (2025). Argus. https://openargus.org/. Chawla, N. V., Bowyer, K. W., Hall, L. O., et al. (2002). Smote: synthetic minority over-sampling technique. Journal of artificial intelligence re- search, 16:321ā357. Disha, R. A. and Waheed, S. (2022). Performance analysis of machine learning models for intru- sion detection system using gini impurity-based weighted random forest feature selection technique. Cybersecurity, 5(1):1. Draper-Gil, G., Lashkari, A. H., and Mamun, M. S. (2025). Cicflowmeter-v4.0. https://github.com/ ahlashkari/CICFlowMeter. Ebrahem, O., Dowaji, S., and Alhammoud, S. (2025). Towards a minimum universal features set for iot ddos attack detection. Journal of Big Data, 12(1):88. Ferrag, M. A., Friha, O., Hamouda, D., et al. (2022). Edge-iiotset: A new comprehensive realistic cy- ber security dataset of iot and iiot applications for centralized and federated learning. IEEe Access, 10:40281ā40306. Ferrag, M. A., Maglaras, L., Moschoyiannis, S., et al. (2020). Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study. Journal of Info. Sec. and App., 50:102419. Gu, J. and Lu, S. (2021). An effective intrusion detec- tion approach using svm with naĆÆve bayes feature embedding. Computers & Security, 103:102158. Guerra-Manzanares, A., Bahsi, H., and Nomm, S. (2019a). Hybrid feature selection models for ma- chine learning based botnet detection in iot net- works. In 2019 Intl. Conf. on Cyberworlds (CW), pages 324ā327. IEEE. Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., et al. (2020a). Medbiot: Generation of an iot botnet dataset in a medium-sized iot network. In ICISSP, pages 207ā218. Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., and NƵm, S. (2020b). Using medbiot dataset to build effective machine learning-based iot bot- net detection systems. In ICISSP, pages 222ā243. Springer. Guerra-Manzanares, A., NƵm, S., and Bahsi, H. (2019b). Towards the integration of a post-hoc in- terpretation step into the machine learning work- flow for iot botnet detection. In 2019 18th IEEE ICMLA, pages 1162ā1169. Hussain, F., Hussain, R., Hassan, S. A., and Hossain, E. (2020). Machine learning in iot security: Cur- rent solutions and future challenges. IEEE Com- munications Surveys & Tutorials, 22(3):1686ā1721. Keshk, M., Koroniotis, N., Pham, N., et al. (2023). An explainable deep learning-enabled intrusion de- tection framework in iot networks. Inf. Sciences, 639:119000. Koroniotis, N., Moustafa, N., Sitnikova, E., et al. (2019). Towards the development of realistic bot- net dataset in the internet of things for network forensic analytics: Bot-iot dataset. Future Gen. Comp. Systems, 100:779ā796. Li, A. S., Bertino, E., Dang, X.-H., Singla, A., Tu, Y., and Wegman, M. N. (2023). Maximal domain inde- pendent representations improve transfer learning. arXiv preprint arXiv:2306.00262. Lundberg, S. M. and Lee, S.-I. (2017). A unified ap- proach to interpreting model predictions. In Ad- vances in Neural Info. Proc. Sys., volume 30. Lypa, B., Horyn, I., Zagorodna, N., Tymoshchuk, D., and Lechachenko, T. (2025). Comparison of fea- ture extraction tools for network traļ¬ic data. arXiv preprint arXiv:2501.13004. Mims, N. A. (2025). The botnet problem. In Com- puter and Information Security Handbook, pages 261ā272. Moustafa, N. (2021). A new distributed architec- ture for evaluating ai-based security systems at the edge: Network ton_iot datasets. Sust. Cit. and Soc., 72:102994. Nazir, A., He, J., Zhu, N., et al. (2023). Advanc- ing iot security: A systematic review of machine learning approaches for the detection of iot bot- nets. J. of King Saud Univ.-Comp. and Info. Sc., 35(10):101820. Neto, E. C. P., Dadkhah, S., Ferreira, R., et al. (2023). Ciciot2023: A real-time dataset and bench- mark for large-scale attacks in iot environment. Sensors, 23(13):5941. Paxson, V., Grover, S., Sharma, A., et al. (2025). Zeek. an open source network security monitoring tool. https://zeek.org/. RodrĆguez, E., Valls, P., Otero, B., et al. (2022). Transfer-learning-based intrusion detection frame- work in iot networks. Sensors, 22(15):5621. Rozlomii, I., Yarmilko, A., and Naumenko, S. (2024). Data security of iot devices with limited resources: challenges and potential solutions. doors, 3666:85ā 96. Sinha, P., Sahu, D., Prakash, S., et al. (2025). A high performance hybrid lstm cnn secure architecture for iot environments using deep learning. Scientific Reports, 15(1):9684. Sinha, S. (2025). State of iot 2025. https:// iot-analytics.com/number-connected-iot-devices/.