Cross-domain intrusion detection remains a critical challenge due to significant variability in network traffic characteristics and feature distributions across environments. This study evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter) across four widely used datasets representing heterogeneous IoT and Industrial IoT network conditions. Through extensive experiments, we evaluate in- and cross-domain performance across multiple classification models and analyze feature importance using SHapley Additive exPlanations (SHAP). Our results show that models trained on one domain suffer significant performance degradation when applied to a different target domain, reflecting the sensitivity of IoT intrusion detection systems to distribution shifts. Furthermore, the results evidence that the choice of classification algorithm and feature representations significantly impact transferability. Beyond reporting performance differences and thorough analysis of the transferability of features and feature spaces, we provide practical guidelines for feature engineering to improve robustness under domain variability. Our findings suggest that effective intrusion detection requires both high in-domain performance and resilience to cross-domain variability, achievable through careful feature space design, appropriate algorithm selection and adaptive strategies.

翻译：跨领域入侵检测由于网络流量特征和特征分布在环境间的显著差异而持续面临严峻挑战。本研究评估了三种广泛使用的基于流的特征集（Argus、Zeek和CICFlowMeter）在四个代表异构物联网和工业物联网网络条件的常用数据集上的可迁移性。通过大量实验，我们评估了多个分类模型在领域内和跨领域的性能，并使用SHapley Additive exPlanations（SHAP）分析了特征重要性。结果表明，在一个领域训练的模型应用于不同目标领域时性能显著下降，这反映了物联网入侵检测系统对分布偏移的敏感性。此外，结果证明分类算法和特征表示的选择对可迁移性有显著影响。除了报告性能差异以及对特征和特征空间可迁移性的深入分析外，我们还为特征工程提供了实用指南，以提高领域变异下的鲁棒性。我们的研究结果表明，有效的入侵检测既需要高的领域内性能，也需要对跨领域变异具有韧性，这可以通过精心设计特征空间、选择合适的算法以及采用自适应策略来实现。