Exploring Robust Intrusion Detection: A Benchmark Study of Feature Transferability in IoT Botnet Attack Detection

Researchers conducted a benchmark study on IoT botnet intrusion detection systems, finding that models trained on one network domain suffer significant performance degradation when applied to different environments. The study evaluated three feature sets across four IoT datasets and provided guidelines for improving cross-domain robustness through better feature engineering and algorithm selection.

• →IoT intrusion detection models show poor transferability across different network domains due to distribution shifts.
• →Three widely-used feature sets (Argus, Zeek, CICFlowMeter) were benchmarked across heterogeneous IoT environments.
• →Classification algorithm choice and feature representations significantly impact cross-domain performance.
• →Researchers used SHAP analysis to understand feature importance in different network contexts.
• →The study provides practical guidelines for improving robustness through careful feature space design and adaptive strategies.