An MMD-weighted ensemble for multi-source cross-domain intrusion detection in heterogeneous IoT systems
Abstract
Cross-domain intrusion detection is essential for securing heterogeneous Internet of Things (IoT) deployments. However, detectors trained in one environment degrade sharply under domain shift, which arises from systematic differences in protocols, device types, and network architectures across IoT domains. Existing approaches typically focus on single-domain training or require explicit feature alignment, both of which limit practical deployment. To address this, this paper presents a systematic multi-domain benchmark on a public IoT adaptation dataset comprising 7,000 labeled traffic samples with 39 features spanning six domains, and proposes the Maximum Mean Discrepancy-Weighted Ensemble (MMD-WE), a multi-source ensemble that weights per-domain XGBoost classifiers by Maximum Mean Discrepancy (MMD)-derived similarity scores without any explicit feature alignment. CORAL (Correlation Alignment), a widely used second-order domain adaptation method, serves as a baseline for comparison. In-domain detection reaches 92.86% accuracy and an area under the ROC curve (AUC) of 0.9825; single-source cross-domain transfer yields off-diagonal accuracies ranging from 89.6% to 93.7%; and in leave-one-domain-out multi-source adaptation, MMD-WE attains 92.80% average accuracy, marginally exceeding a pooled multi-source baseline of 92.69% and significantly outperforming a CORAL-aligned variant of 92.22%. Analysis with SHapley Additive exPlanations (SHAP) further shows that adaptation-aware features, led by communication reliability and payload entropy, dominate predictions, and that the dataset’s adaptation status stratifies risk: attack prevalence rises from 2.9% under low shift to 81.8% under high shift. These findings support shift-aware alert triage and label-free deployment of robust IoT intrusion detectors.
Related
- Hybrid post-quantum explainable AI intrusion detection with SDN for heterogeneous IoT networks
- A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing
- Toward deployment-oriented benchmarking of intrusion detection systems: integrating threshold dynamics, distribution shift, and interpretability into comparative model evaluation
- Green-aware intrusion detection systems: A sustainability-driven approach to network security
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
BibTeX
@article{liu2026mmdweighted,
title = {{An MMD-weighted ensemble for multi-source cross-domain intrusion detection in heterogeneous IoT systems}},
author = {Cheng Liu and Tongqiang Yi and Xiangnan Jing and Yuewei Ling},
journal = {Scientific Reports},
year = {2026},
month = oct,
doi = {10.1038/s41598-026-75843-z},
url = {https://www.nature.com/articles/s41598-026-75843-z},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - An MMD-weighted ensemble for multi-source cross-domain intrusion detection in heterogeneous IoT systems
AU - Cheng Liu
AU - Tongqiang Yi
AU - Xiangnan Jing
AU - Yuewei Ling
PY - 2026
DA - 2026/10/26
JO - Scientific Reports
DO - 10.1038/s41598-026-75843-z
UR - https://www.nature.com/articles/s41598-026-75843-z
AB - Cross-domain intrusion detection is essential for securing heterogeneous Internet of Things (IoT) deployments. However, detectors trained in one environment degrade sharply under domain shift, which arises from systematic differences in protocols, device types, and network architectures across IoT domains. Existing approaches typically focus on single-domain training or require explicit feature alignment, both of which limit practical deployment. To address this, this paper presents a systematic multi-domain benchmark on a public IoT adaptation dataset comprising 7,000 labeled traffic samples with 39 features spanning six domains, and proposes the Maximum Mean Discrepancy-Weighted Ensemble (MMD-WE), a multi-source ensemble that weights per-domain XGBoost classifiers by Maximum Mean Discrepancy (MMD)-derived similarity scores without any explicit feature alignment. CORAL (Correlation Alignment), a widely used second-order domain adaptation method, serves as a baseline for comparison. In-domain detection reaches 92.86% accuracy and an area under the ROC curve (AUC) of 0.9825; single-source cross-domain transfer yields off-diagonal accuracies ranging from 89.6% to 93.7%; and in leave-one-domain-out multi-source adaptation, MMD-WE attains 92.80% average accuracy, marginally exceeding a pooled multi-source baseline of 92.69% and significantly outperforming a CORAL-aligned variant of 92.22%. Analysis with SHapley Additive exPlanations (SHAP) further shows that adaptation-aware features, led by communication reliability and payload entropy, dominate predictions, and that the dataset’s adaptation status stratifies risk: attack prevalence rises from 2.9% under low shift to 81.8% under high shift. These findings support shift-aware alert triage and label-free deployment of robust IoT intrusion detectors.
SN - 2045-2322
ER -