Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection
- 1Department of Information Technology, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia
Abstract
Machine-learning intrusion detection for the Internet of Things (IoT) routinely exceeds 99% accuracy on single datasets but fails when transferred to new networks or flow exporters. We formalize five failure modes, define a 23-feature canonical schema, and adapt three datasets (CICIoT2023, TON_IoT, Bot-IoT) to build a full six-pair transfer matrix across three classifiers, each with three random seeds. Random forest attains the highest mean AUC (0.740), yet its balanced accuracy collapses to chance (0.50–0.51) exclusively on CICFlowMeter-sourced pairs while remaining strong (0.72–0.87) on Zeek- and Argus-sourced pairs. This exporter-dependent collapse is reproduced across structurally unrelated classifiers, establishing it as our central finding. A controlled synthetic test confirms that CICFlowMeter’s directional heuristic destroys variance (up to 104 reduction) and causes a small, consistent transfer cost (+0.004 AUC), though full degradation requires compounded effects. Aggregate distributional distance does not predict transfer success (r = −0.17), ruling out a simple divergence explanation. Prior correction provides the largest ablation gain. Source-domain coverage is necessary but not sufficient for transfer, and we observed no universal sample-count threshold. Flow exporter provenance emerges as a major upstream confounder and a directly implicated contributing mechanism, though exporter identity is confounded with dataset identity and is not established as the sole determinant of cross-dataset performance.
Related
- A lightweight blockchain-inspired hybrid intrusion detection system with ensemble learning for tamper-proof auditing
- ACO-Enhanced DCNN-BiLSTM framework for intrusion detection in smart Consumer Electronics network
- Fuzzy-clustering–based multi-scale intrusion detection for the industrial internet of things
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- X-MAG-COS: Compact Evidence Messaging for Source-Partitioned Open-Set Intrusion Detection in 5G–IoT Networks
BibTeX
@article{rassam2026flow,
title = {{Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection}},
author = {Murad A. Rassam and Mahfoudh Alasaly},
journal = {Mathematics},
year = {2026},
month = sep,
doi = {10.3390/math14193549},
url = {https://www.mdpi.com/2227-7390/14/19/3549},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection
AU - Murad A. Rassam
AU - Mahfoudh Alasaly
PY - 2026
DA - 2026/09/30
JO - Mathematics
DO - 10.3390/math14193549
UR - https://www.mdpi.com/2227-7390/14/19/3549
AB - Machine-learning intrusion detection for the Internet of Things (IoT) routinely exceeds 99% accuracy on single datasets but fails when transferred to new networks or flow exporters. We formalize five failure modes, define a 23-feature canonical schema, and adapt three datasets (CICIoT2023, TON_IoT, Bot-IoT) to build a full six-pair transfer matrix across three classifiers, each with three random seeds. Random forest attains the highest mean AUC (0.740), yet its balanced accuracy collapses to chance (0.50–0.51) exclusively on CICFlowMeter-sourced pairs while remaining strong (0.72–0.87) on Zeek- and Argus-sourced pairs. This exporter-dependent collapse is reproduced across structurally unrelated classifiers, establishing it as our central finding. A controlled synthetic test confirms that CICFlowMeter’s directional heuristic destroys variance (up to 104 reduction) and causes a small, consistent transfer cost (+0.004 AUC), though full degradation requires compounded effects. Aggregate distributional distance does not predict transfer success (r = −0.17), ruling out a simple divergence explanation. Prior correction provides the largest ablation gain. Source-domain coverage is necessary but not sufficient for transfer, and we observed no universal sample-count threshold. Flow exporter provenance emerges as a major upstream confounder and a directly implicated contributing mechanism, though exporter identity is confounded with dataset identity and is not established as the sole determinant of cross-dataset performance.
SN - 2227-7390
ER -