Mahfoudh Alasaly

Flow Exporter Provenance as a Major Confounder in Cross-Dataset IoT Intrusion Detection

Machine-learning intrusion detection for the Internet of Things (IoT) routinely exceeds 99% accuracy on single datasets but fails when transferred to new networks or flow exporters. We formalize five failure modes, define a 23-feature canonical schema, and adapt three datasets (CICIoT2023, TON_IoT, Bot-IoT) to build a...