Addressing Cross-Dataset Data-Drift in IoT Intrusion Detection via Replay-Guided Adaptation with Source Retention

Abstract

Deep-learning-based intrusion detection systems for Internet-of-Things (IoT) environments often achieve high performance when training and testing are performed within the same dataset. However, their performance can degrade substantially when deployed on heterogeneous datasets with different traffic characteristics, feature distributions, and attack patterns. This paper investigates cross-dataset IoT intrusion detection under severe distribution shift and proposes a replay-guided drift-adaptation framework that contributes an integrated set of adaptation components: supervised target adaptation, source-memory replay, prototype regularization, teacher–student distillation, and domain-adversarial alignment. To prevent target-data leakage, the target dataset is partitioned before adaptation into adaptation-training, adaptation-validation, and target-test-subsets. Empirical results reveal that the source-trained detector achieves 99.98% weighted F1-score on the source test set, but its performance decreases to 33.33% weighted F1-score on the target test set, confirming severe cross-dataset drift. Using the proposed replay-guided adaptation framework, the best-performing configuration improves the target test F1-score to 80.30% while maintaining 97.52% F1-score on the original source test set This indicates strong target-domain recovery with limited source-domain forgetting. The ablation results show that domain alignment improves target adaptation, while replay, distillation, and prototype regularization contribute more directly to source-domain preservation. These results show that cross-dataset adaptation involves a recovery–retention trade-off, where target-domain improvement must be balanced against source-domain preservation. Accordingly, this work evaluates adaptation using both target-test performance and source-test retention. The main contributions are a leakage-controlled source-to-target evaluation protocol, a component-level ablation study, and empirical evidence for designing drift-adaptive IoT intrusion detection models.