Benchmark Accuracy Is Not Robustness: A Cross-Domain Study of ML-Based Intrusion Detection across IoT and Enterprise Traffic

Abstract

Machine learning-based intrusion detection systems often achieve strong performance on standard benchmarks, yet fail when deployed in a different environment. This paper investigates how well ML-based detectors transfer between IoT and enterprise traffic, using IoT-23 and UNSW-NB15 as two heterogeneous domains. Our experiments show that cross-domain performance drops sharply even after explicit feature alignment and limited target supervision, and that this drop is strongly asymmetric across transfer directions. Early detection experiments show that malicious signal is recoverable from partial traffic observations within a domain, but this property does not transfer equally between domains. The hybrid model that combines tabular, temporal, and prototype-based evidence provides interpretable insights into these failure modes, but does not consistently outperform simpler temporal baselines. Together our findings suggest that benchmark accuracy alone is a poor indicator of real-world robustness, and that intrusion detection system evaluation should place greater emphasis on cross-domain portability, data efficiency, and timeliness.