Cross-Domain Behavioural Mapping for IoT Attack Detection in Educational Networks Using CICIoT-2023 Dataset

Objectives: The study develops a cross-domain behavioural intrusion-detection framework for transferring attack knowledge from CICIoT-2023 to a derived educational IoT representation. Method: The proposed Cross-Domain Behavioural Mapping Intrusion Detection System (CDBM-IDS) integrates an Educational IoT Digital Twin Layer (E-DTL), Behaviour Spectrum Encoder (BSE), Hierarchical Deviance Encoder (HDE), Tri-Context Fusion (TCF), and Sector-Transfer Consistency Loss (STC-Loss). EduTwin is generated from CICIoT-2023 through educational device-role mapping, interaction modelling, and sector-oriented behavioural transformation. Findings: Under the controlled EduTwin evaluation protocol, CDBM-IDS achieves 98.72% accuracy, 98.64% precision, 98.51% recall, 98.57% F1-score, and 99.21% AUC-ROC. Ablation analysis confirms measurable contributions from BSE, HDE, TCF, and STC-Loss. Novelty: The framework introduces educational role abstraction, frequency-domain behavioural encoding, hierarchical deviation modelling, geometric context fusion, and consistency-driven sector mapping. Keywords: IoT security, educational network, intrusion detection, cross-domain learning, behaviour modelling