Bridging Training–Deployment Gap in Intrusion Detection With Source-Free Domain Adaptation

SmartVille: A Framework for Realistic Deep Learning-Based Online Network Intrusion Detection

SmartVille is introduced, a framework for formulating and studying deep learning-based NID under online, open-world, and multi-modal assumptions, and providing a principled way to design, train, and benchmark adaptive NID models under realistic assumptions while separating the theoretical contribution from its open-source implementation.

Prototype Retrieval-Augmented Federated Learning System for Robust Intrusion Detection

Adaptive Intrusion Detection System using Transformer-Based Neural Networks and Continual Learning Approach with Adversarial Investigation

This work presents an adaptive IDS framework coupling a tabular transformer encoder with a class balanced experience replay buffer that replays benign traffic at every update to stabilize decision boundaries, and investigates the buffer with overt label flipping and stealthy backdoor poisoning attacks.

ShallowNet: A Lightweight Neural Network Approach for Efficient Flow-Level DDoS Detection

Distributed Denial-of-Service (DDoS) attacks across cloud, edge, and Internet-of-Things infrastructures have intensified the need for detectors that are accurate, computationally efficient, and deployable at resource-constrained monitoring points. Much of the intrusion-detection literature implicitly links detection quality to architectural depth, larger parameter spaces, and richer learned representations. This paper examines a narrower hypothesis: for binary flow-level DDoS detection, a carefully engineered shallow pipeline can retain high detection quality while maintaining a compact computational footprint. We propose ShallowNet, a single-hidden-layer neural detector integrated with leakage-aware data partitioning, training-only normalization, principled feature selection, class-imbalance-aware optimization, early stopping, and calibration-guided threshold selection. The evaluation extends beyond standard held-out accuracy by incorporating cross-day temporal transfer, leave-one-attack-family-out robustness testing, controlled baseline comparison, systematic pipeline ablation, and probability-calibration analysis. The results show both the empirical utility and the limits of the approach: class concentration in widely used benchmark datasets can make aggregate metrics overly optimistic, and generalization degrades most sharply when the test traffic contains attack signatures absent from training. These findings suggest that, in lightweight binary flow-level DDoS detection, disciplined pipeline design can be as important as model depth and that stress-tested evaluation should accompany high benchmark accuracy claims.

Detection of DDoS Attacks in Networks Using Deep Learning Based on Long Short-Term Memory (LSTM)

HTTP Flood attacks remain difficult to detect because they operate at the application layer, resemble legitimate user requests, and generate burst-based temporal traffic patterns. Previous DDoS detection studies often rely on outdated datasets, process network flows as independent records, insufficiently address class imbalance, and provide limited interpretability for security analysts. This study proposes a sequence-aware and explainable deep learning framework for HTTP Flood detection using Long Short-Term Memory (LSTM). Reconstructed HTTP traffic from the UNSW-NB15 dataset was processed through proxy labeling, data cleaning, feature normalization, and sliding-window transformation to convert flow-level records into temporal sequences. Class weighting and SMOTE oversampling were evaluated to mitigate imbalance, while SHAP and LIME were used to explain model decisions. The proposed LSTM model achieved an attack recall of 94.8%, a false negative rate of 5.2%, balanced accuracy of 94.3%, MCC of 0.824, and ROC-AUC of 0.975. The results show that temporal representation improves detection of bursty HTTP Flood behavior, whereas class weighting provides a better balance between attack sensitivity and false-alarm control. Explainability analysis further confirms that the model relies on technically meaningful indicators, including packet rate, flow duration, traffic asymmetry, and service concentration. This framework supports interpretable early-warning detection for application-layer DDoS attacks.

Prototype-Based Transferability Analysis for Few-Shot Domain Adaptation in Cross-Domain Intrusion Detection

Few-shot domain adaptation (FSDA) has become an important approach for cross-domain intrusion detection by enabling models to leverage limited labeled target data under distribution shifts. Although numerous adaptation methods have been proposed, their effectiveness often varies considerably across transfer scenarios, leading to inconsistent performance across domains. This study investigates how prototype-based transferability can be used to characterize source–target compatibility prior to adaptation. To this end, a transferability-aware perspective on FSDA is presented by distinguishing between intra-domain separability, which characterizes the internal class structure of a domain, and cross-domain transferability, which reflects how effectively source-derived representations generalize to a target domain. Based on this distinction, a set of asymmetric transferability metrics is introduced to characterize prototype-based transferability from complementary perspectives. Across the evaluated transfer scenarios, stronger intra-domain separability did not necessarily coincide with better cross-domain transferability. Furthermore, the empirical results indicate that different adaptation strategies exhibit different behaviors across the examined transfer directions. Across the two evaluated transfer directions, the prototype-based transferability analysis and the few-shot adaptation results exhibit different behaviors. While target-only few-shot learning performs competitively in one transfer direction, prototype-based alignment methods provide larger improvements in the other, illustrating that adaptation performance reflects not only source–target compatibility but also intrinsic target-domain separability and the adaptation process itself. These observations provide an empirical perspective for interpreting the varying performance of existing FSDA methods and highlight the importance of considering transfer conditions when selecting adaptation strategies for cross-domain intrusion detection.