Deep Learning with Domain Adaptation for Cross- Dataset Generalization in Intrusion Detection Systems

In order to defend networks against cyber attacks, we require intrusion detection systems - commonly referred to as IDS. While these systems function well with common datasets, artificial intelligence (AI) based intrusion detection systems tend to fail under different scenarios. The source of these failures is reliance on certain datasets and discrepancies in the distribution of the datasets. Therefore, availability of these datasets is problematic to relying on AI for false positive and accuracy metrics in real-world situations, where the patterns of attack and traffic can vary significantly. To address this issue, we present a deep learning-based IDS using domain adaptation to improve efficiency across diverse datasets. Utilizing convolutional and recurrent neural networks for traffic feature identification, we combine domainadversarial training (DANN) with correlation alignment (CORAL) to reduce the differential between source and target domains. Experiments on ToN-IoT, UNSW-NB15, and CIC-IDS2017 show the performance of traditional deep models presented consistently lower results across categories in various datasets. Our approach provides 10-15% improvements in accuracy and reductions in false positive. This approach highlights the potential of domain adaptation for producing flexible and effective IDS for corporate, cloud, and Internet of Things settings. Regardless of parameters, the experiments demonstrate the need of domain adaptation for producing flexible and effective IDS for cloud, corporate, and IoT environments.Keywords— Intrusion Detection System (IDS), Deep Learning, Domain Adaptation, Cross-Dataset Generalization, CORAL, DANN, Cybersecurity, IoT Security.