{
  "abstract": "Machine-learning intrusion detection for the Internet of Things (IoT) routinely exceeds 99% accuracy on single datasets but fails when transferred to new networks or flow exporters. We formalize five failure modes, define a 23-feature canonical schema, and adapt three datasets (CICIoT2023, TON_IoT, Bot-IoT) to build a full six-pair transfer matrix across three classifiers, each with three random seeds. Random forest attains the highest mean AUC (0.740), yet its balanced accuracy collapses to chance (0.50–0.51) exclusively on CICFlowMeter-sourced pairs while remaining strong (0.72–0.87) on Zeek- and Argus-sourced pairs. This exporter-dependent collapse is reproduced across structurally unrelated classifiers, establishing it as our central finding. A controlled synthetic test confirms that CICFlowMeter’s directional heuristic destroys variance (up to 104 reduction) and causes a small, consistent transfer cost (+0.004 AUC), though full degradation requires compounded effects. Aggregate distributional distance does not predict transfer success (r = −0.17), ruling out a simple divergence explanation. Prior correction provides the largest ablation gain. Source-domain coverage is necessary but not sufficient for transfer, and we observed no universal sample-count threshold. Flow exporter provenance emerges as a major upstream confounder and a directly implicated contributing mechanism, though exporter identity is confounded with dataset identity and is not established as the sole determinant of cross-dataset performance.",
  "abstract_shown": true,
  "affiliations": [
    "Department of Information Technology, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia"
  ],
  "article_type": null,
  "arxiv": null,
  "author_total": 2,
  "authors": [
    {
      "affs": [
        0
      ],
      "name": "Murad A. Rassam",
      "orcid": "0000-0003-3558-6737"
    },
    {
      "affs": [
        0
      ],
      "name": "Mahfoudh Alasaly",
      "orcid": "0000-0002-4558-5394"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/fegwwtqqbazmy.bib",
  "cited_by": 0,
  "doi": "10.3390/math14193549",
  "fulltext_url": null,
  "id": "fegwwtqqbazmy",
  "issns": [
    "2227-7390"
  ],
  "landing_url": "https://www.mdpi.com/2227-7390/14/19/3549",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "openalex",
      "1705|Network Security and Intrusion Detection"
    ]
  ],
  "openalex": "W7214940005",
  "pdf_url": null,
  "pmcid": null,
  "pmid": null,
  "published": "2026-09-30",
  "publisher": "MDPI AG",
  "ris": "https://research.draconitic.com/paper/fegwwtqqbazmy.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:18:29Z",
      "native_id": "10.3390/math14193549",
      "source": "crossref",
      "url": "https://www.mdpi.com/2227-7390/14/19/3549"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "issn:2227-7390",
      "subfield": "general"
    }
  ],
  "title": "Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection",
  "title_text": "Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T12:18:29Z",
  "url": "https://research.draconitic.com/paper/fegwwtqqbazmy",
  "venue": "Mathematics",
  "versions": []
}