{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T14:37:49Z","timestamp":1791902269246,"version":"4.3.4"},"reference-count":30,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T00:00:00Z","timestamp":1770768000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Intrusion and anomaly detectors trained on Internet Protocol (IP) traffic are increasingly deployed in heterogeneous IoT environments where Bluetooth Low Energy (BLE) links coexist with IP networks. We quantify the cross-protocol domain gap in an IP \u2192 BLE transfer setting under unsupervised domain adaptation (UDA), where target labels are unavailable for training and model selection. Using 14 lightweight window-level statistics and leakage-aware splits, we benchmark classical baselines and alignment methods (CORAL and MMD) against domain-adversarial neural networks (DANNs). Under random window splits, DANNs can yield modest target gains but exhibit strong seed sensitivity and non-monotonic domain confusion. We propose R3, a domain-aware checkpoint rule that combines near-best source validation with domain discriminator accuracy as a proxy for alignment, improving the target ROC-AUC by ~+0.053 across three representative seeds and producing more consistent AP gains over 20 seeds. However, under a stricter capture-wise leave-one-capture-out (LOCO) protocol, UDA collapses to near-chance ranking and can underperform simple baselines, highlighting the risk of optimistic random splits. Finally, we show that transferring a source-tuned threshold can trigger unsafe operating points (micro-FPR = 1.0 on benign-only captures), motivating PR-based metrics and calibration\/operating-point audits. We have released derived feature tables, split definitions, and scripts to support reproducibility under restricted raw data access.<\/jats:p>","DOI":"10.3390\/s26041184","type":"journal-article","created":{"date-parts":[[2026,2,11]],"date-time":"2026-02-11T17:45:36Z","timestamp":1770831936000},"page":"1184","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Cross-Protocol Domain Gap in Internet of Things Intrusion and Anomaly Detection: An Empirical Internet Protocol-to-Bluetooth Low Energy Study of Domain-Adversarial Training"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-9709-7432","authenticated-orcid":false,"given":"Hyejin","family":"Jin","sequence":"first","affiliation":[{"name":"School of Software, College of Computer Science, Kookmin University, Seoul 02707, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,2,11]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Seranmadevi, R., Addula, S.R., Kumar, D., and Tyagi, A.K. (2026). Security and Privacy in AI: IoT-Enabled Banking and Finance Services. Monetary Dynamics and Socio-Economic Development in Emerging Economies, IGI Global.","DOI":"10.4018\/979-8-3693-9765-7.ch006"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","article-title":"TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems","volume":"8","author":"Alsaedi","year":"2020","journal-title":"IEEE Access"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE Access"},{"key":"ref_5","unstructured":"Garcia, S., Parmisano, A., and Erquiaga, M.J. (2026, January 03). IoT-23: A Labeled Dataset with Malicious and Benign IoT Network Traffic (Version 1.0.0) [Dataset]. Zenodo. Available online: https:\/\/zenodo.org\/records\/4743746."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), Funchal, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems. Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"101631","DOI":"10.1016\/j.iot.2025.101631","article-title":"Evaluating and Enhancing Intrusion Detection Systems in IoMT: The Importance of Domain-Specific Datasets","volume":"32","author":"Siddiqui","year":"2025","journal-title":"Internet Things"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Ghori, M.R., Wan, T.-C., and Sodhy, G.C. (2020). Bluetooth Low Energy Mesh Networks: Survey of Communication and Security Protocols. Sensors, 20.","DOI":"10.3390\/s20123590"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"108953","DOI":"10.1016\/j.comnet.2022.108953","article-title":"Securing Bluetooth Low Energy Networking: An Overview of Security Procedures and Threats","volume":"211","author":"Lacava","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"102041","DOI":"10.1016\/j.simpat.2019.102041","article-title":"Simulation of the Watchdog Placement for Cooperative Anomaly-Based Intrusion Detection Systems Dedicated to Bluetooth Mesh Networks","volume":"101","author":"Marks","year":"2020","journal-title":"Simul. Model. Pract. Theory"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Cayre, R., Nicomette, V., Auriol, G., Ka\u00e2niche, M., and Francillon, A. (2024, January 1\u20135). OASIS: An Intrusion Detection System Embedded in Bluetooth Low Energy Controllers. Proceedings of the ACM Asia Conference on Computer and Communications Security (AsiaCCS 2024), Singapore.","DOI":"10.1145\/3634737.3645004"},{"key":"ref_13","first-page":"723","article-title":"A Kernel Two-Sample Test","volume":"13","author":"Gretton","year":"2012","journal-title":"J. Mach. Learn. Res."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Sun, B., and Saenko, K. (2016). Deep CORAL: Correlation Alignment for Deep Domain Adaptation. arXiv.","DOI":"10.1007\/978-3-319-49409-8_35"},{"key":"ref_15","first-page":"1","article-title":"Domain-Adversarial Training of Neural Networks","volume":"17","author":"Ganin","year":"2016","journal-title":"J. Mach. Learn. Res."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Rodr\u00edguez, E., Hinostroza, J., Jim\u00e9nez, L., and Soria, E. (2022). A Transfer-Learning-Based Intrusion Detection Framework for 5G IoT Networks. Sensors, 22.","DOI":"10.3390\/s22155621"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Ullah, F., Turab, A., Ullah, S., Cacciagrano, D., and Zhao, Y. (2024). Enhanced Network Intrusion Detection System for Internet of Things Security Using Multimodal Big Data Representation with Transfer Learning and Game Theory. Sensors, 24.","DOI":"10.3390\/s24134152"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Qu, Y., Ma, H., Jiang, Y., and Bu, Y. (2023). A Network Intrusion Detection Method Based on Domain Confusion. Electronics, 12.","DOI":"10.3390\/electronics12051255"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Ben-David, S., Blitzer, J., Crammer, K., and Pereira, F. (2006, January 4\u20137). Analysis of Representations for Domain Adaptation. Proceedings of the Advances in Neural Information Processing Systems 19 (NIPS 2006), Vancouver, BC, Canada. Available online: https:\/\/papers.nips.cc\/paper\/2983-analysis-of-representations-for-domain-adaptation.","DOI":"10.7551\/mitpress\/7503.003.0022"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1007\/s10994-009-5152-4","article-title":"A Theory of Learning from Different Domains","volume":"79","author":"Blitzer","year":"2010","journal-title":"Mach. Learn."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Davis, J., and Goadrich, M. (2006, January 25\u201329). The Relationship Between Precision\u2013Recall and ROC Curves. Proceedings of the 23rd International Conference on Machine Learning (ICML 2006), Pittsburgh, PA, USA.","DOI":"10.1145\/1143844.1143874"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Saito, T., and Rehmsmeier, M. (2015). The Precision\u2013Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets. PLoS ONE, 10.","DOI":"10.1371\/journal.pone.0118432"},{"key":"ref_23","unstructured":"Guo, C., Pleiss, G., Sun, Y., and Weinberger, K.Q. (2017, January 6\u201311). On Calibration of Modern Neural Networks. Proceedings of the 34th International Conference on Machine Learning (ICML 2017), Sydney, Australia. Available online: https:\/\/proceedings.mlr.press\/v70\/guo17a.html."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Efron, B., and Tibshirani, R.J. (1994). An Introduction to the Bootstrap, Chapman and Hall\/CRC.","DOI":"10.1201\/9780429246593"},{"key":"ref_25","unstructured":"Kolouri, S., Nadjahi, K., Simsekli, U., Badeau, R., and Rohde, G.K. (2019, January 8\u201314). Generalized Sliced Wasserstein Distances. Proceedings of the Advances in Neural Information Processing Systems 32 (NeurIPS 2019), Vancouver, BC, Canada. Available online: https:\/\/papers.nips.cc\/paper_files\/paper\/2019\/hash\/f0935e4cd5920aa6c7c996a5ee53a70f-Abstract.html."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"18951","DOI":"10.1109\/JIOT.2024.3349381","article-title":"Vulnerability of Machine Learning Approaches Applied in IoT-Based Smart Grid: A Review","volume":"11","author":"Zhang","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"3066","DOI":"10.1109\/TSMC.2022.3222793","article-title":"Security Enhancement of Power System State Estimation with an Effective and Low-Cost Moving Target Defense","volume":"53","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Syst. Man Cybern. Syst."},{"key":"ref_28","unstructured":"You, K., Wang, X., Long, M., and Jordan, M.I. (2019, January 9\u201315). Towards Accurate Model Selection in Deep Unsupervised Domain Adaptation. Proceedings of the 36th International Conference on Machine Learning (ICML), Long Beach, CA, USA. Available online: https:\/\/proceedings.mlr.press\/v97\/you19a.html."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Saito, K., Kim, D., Sclaroff, S., Saenko, K., and Plummer, B.A. (2021, January 10\u201317). Tune It the Right Way: Unsupervised Validation of Domain Adaptation via Soft Neighborhood Density. Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada.","DOI":"10.1109\/ICCV48922.2021.00905"},{"key":"ref_30","unstructured":"Hu, D., Luo, M., Liang, J., and Foo, C.-S. (2024, January 10\u201315). Towards Reliable Model Selection for Unsupervised Domain Adaptation: An Empirical Study and A Certified Baseline. Proceedings of the Thirty-Eighth Conference on Neural Information Processing Systems (NeurIPS 2024) Datasets and Benchmarks Track, Vancouver, BC, Canada."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/4\/1184\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,14]],"date-time":"2026-02-14T05:27:03Z","timestamp":1771046823000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/4\/1184"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,11]]},"references-count":30,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2026,2]]}},"alternative-id":["s26041184"],"URL":"https:\/\/doi.org\/10.3390\/s26041184","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,11]]}}}