An MMD-weighted ensemble for multi-source cross-domain intrusion detection in heterogeneous IoT systems

Abstract Cross-domain intrusion detection is essential for securing heterogeneous Internet of Things (IoT) deployments. However, detectors trained in one environment degrade sharply under domain shift, which arises from systematic differences in protocols, device types, and network architectures across IoT domains. Existing approaches typically focus on single-domain training or require explicit feature alignment, both of which limit practical deployment. To address this, this paper presents a systematic multi-domain benchmark on a public IoT adaptation dataset comprising 7,000 labeled traffic samples with 39 features spanning six domains, and proposes the Maximum Mean Discrepancy-Weighted Ensemble (MMD-WE), a multi-source ensemble that weights per-domain XGBoost classifiers by Maximum Mean Discrepancy (MMD)-derived similarity scores without any explicit feature alignment. CORAL (Correlation Alignment), a widely used second-order domain adaptation method, serves as a baseline for comparison. In-domain detection reaches 92.86% accuracy and an area under the ROC curve (AUC) of 0.9825; single-source cross-domain transfer yields off-diagonal accuracies ranging from 89.6% to 93.7%; and in leave-one-domain-out multi-source adaptation, MMD-WE attains 92.80% average accuracy, marginally exceeding a pooled multi-source baseline of 92.69% and significantly outperforming a CORAL-aligned variant of 92.22%. Analysis with SHapley Additive exPlanations (SHAP) further shows that adaptation-aware features, led by communication reliability and payload entropy, dominate predictions, and that the dataset’s adaptation status stratifies risk: attack prevalence rises from 2.9% under low shift to 81.8% under high shift. These findings support shift-aware alert triage and label-free deployment of robust IoT intrusion detectors.