{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T09:56:24Z","timestamp":1791280584238,"version":"4.1.0"},"reference-count":47,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T00:00:00Z","timestamp":1790726400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Intrusion Detection Systems (IDSs) are essential for securing Internet of Things (IoT) and Internet of Medical Things (IoMT) environments, yet most machine learning-based IDSs assume that training and testing data follow similar distributions. In practice, domain shifts arising from differences in device characteristics, communication protocols, and traffic patterns can substantially increase false positive rates (FPRs), reducing operational reliability. This study proposes DEA-IDS (Drift-aware, Explainable and Adaptive Intrusion Detection System), a unified framework integrating SHAP-based explainability, statistical drift analysis via the Kolmogorov\u2013Smirnov statistic and Wasserstein distance, drift-aware stable feature selection, and few-shot adaptation, evaluated on a CICIoT2023-to-CICIoMT2024 cross-domain transfer scenario. Under a leakage-free protocol in which drift statistics and few-shot samples are drawn exclusively from the target training split, DEA-IDS reduces FPR from 0.5468 to 0.0004 while maintaining an F1-score of 0.9944; threshold-, sample-size-, and feature-selection-control sensitivity analyses confirm this reduction reflects drift-aware stable feature selection rather than test-set leakage or dimensionality reduction alone.\u00a0A per-attack-family analysis shows this improvement is concentrated in high-volume flood-style attacks and is accompanied by reduced detection of ARP spoofing, malformed-MQTT, and reconnaissance traffic, reported here as an explicit limitation. These results demonstrate that explicitly modeling feature stability before adaptation improves operational robustness for cross-domain intrusion detection in heterogeneous IoT\u2013IoMT environments.<\/jats:p>","DOI":"10.3390\/s26196200","type":"journal-article","created":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T09:25:42Z","timestamp":1790760342000},"page":"6200","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["DEA-IDS: Drift-Aware Feature Selection and Few-Shot Adaptation for Cross-Domain IoT\u2013IoMT Intrusion Detection"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0877-8488","authenticated-orcid":false,"given":"B\u00fc\u015fra","family":"G\u00fcnay","sequence":"first","affiliation":[{"name":"Department of Computer Engineering, Faculty of Engineering and Natural Sciences, Istanbul Atlas University, 34408 Istanbul, T\u00fcrkiye"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3589-3278","authenticated-orcid":false,"given":"Mehmet Yavuz","family":"Ya\u011fc\u0131","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Faculty of Engineering, Istanbul University-Cerrahpa\u015fa, 34320 Istanbul, T\u00fcrkiye"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,30]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"126719","DOI":"10.1016\/j.neucom.2023.126719","article-title":"Internet of medical things: A systematic review","volume":"557","author":"Huang","year":"2023","journal-title":"Neurocomputing"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"110227","DOI":"10.1016\/j.asoc.2023.110227","article-title":"Survey of machine learning based intrusion detection methods for Internet of Medical Things","volume":"140","author":"Boustia","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"581","DOI":"10.1016\/j.future.2019.12.028","article-title":"Securing internet of medical things systems: Limitations, issues and recommendations","volume":"105","author":"Yaacoub","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_4","first-page":"102419","article-title":"Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study","volume":"50","author":"Ferrag","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_5","first-page":"12224","article-title":"Network intrusion detection in IoT environment based on cross-domain representation learning","volume":"8","author":"Dong","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_6","unstructured":"Alahmadi, B.A., Axon, L., and Martinovic, I. (2022, January 10\u201312). 99% False Positives: A Qualitative Study of SOC Analysts\u2019 Perspectives on Security Alarms. Proceedings of the 31st USENIX Security Symposium (USENIX Security 22), Boston, MA, USA."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"73127","DOI":"10.1109\/ACCESS.2020.2988359","article-title":"An Explainable Machine Learning Framework for Intrusion Detection Systems","volume":"8","author":"Wang","year":"2020","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"3540","DOI":"10.1109\/TIFS.2020.2991876","article-title":"A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework","volume":"15","author":"Xu","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"102899","DOI":"10.1016\/j.cose.2022.102899","article-title":"FS-IDS: A framework for intrusion detection based on few-shot learning","volume":"122","author":"Yang","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"39914","DOI":"10.1038\/s41598-025-23711-7","article-title":"Evaluating machine learning approaches for multiple attack classification with improved computational efficiency in IoT networks","volume":"15","author":"Alharby","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"36085","DOI":"10.1038\/s41598-025-20047-0","article-title":"Enhanced intrusion detection system IoT network security model by feed forward neural network and machine learning","volume":"15","author":"Alashjaee","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"20577","DOI":"10.1038\/s41598-025-06363-5","article-title":"Smart deep learning model for enhanced IoT intrusion detection","volume":"15","author":"Alsubaei","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1007\/s12083-025-02177-4","article-title":"IA-IDS: An intelligent adaptive intrusion detection system for IoT security using CNN, BiLSTM, and attention mechanism","volume":"19","author":"Logeswari","year":"2026","journal-title":"Peer-to-Peer Netw. Appl."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"28","DOI":"10.1007\/s43926-026-00288-9","article-title":"A minimalistic yet effective domain adaptation strategy for IoMT network intrusion detection","volume":"6","author":"Mahbub","year":"2026","journal-title":"Discov. Internet Things"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"5783","DOI":"10.1007\/s10115-025-02402-9","article-title":"Multi-attention DeepCRNN: An efficient and explainable intrusion detection framework for Internet of Medical Things environments","volume":"67","author":"Sharma","year":"2025","journal-title":"Knowl. Inf. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"16120","DOI":"10.1038\/s41598-026-47264-5","article-title":"Hybrid feature selection for IoMT based intrusion detection system for integrating mutual information filtering with deep learning based accelerated metaheuristic optimization","volume":"16","author":"Palaniappan","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1007\/s43926-025-00147-z","article-title":"A secure IoT-edge architecture with data-driven AI techniques for early detection of cyber threats in healthcare","volume":"5","author":"Kumari","year":"2025","journal-title":"Discov. Internet Things"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1095","DOI":"10.1007\/s12243-025-01118-9","article-title":"A versatile XAI-based framework for efficient and explainable intrusion detection systems","volume":"80","author":"Nugraha","year":"2025","journal-title":"Ann. Telecommun."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Yacoubi, M., Moussaoui, O., and Drocourt, C. (2025). Explainable AI-driven feature selection for improved intrusion detection systems in the Internet of Medical Things. Artificial Intelligence Applications and Innovations (AIAI 2025), Springer.","DOI":"10.1007\/978-3-031-96231-8_26"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Hermosilla, P., Berr\u00edos, S., and Allende-Cid, H. (2025). Explainable AI for forensic analysis: A comparative study of SHAP and LIME in intrusion detection models. Appl. Sci., 15.","DOI":"10.3390\/app15137329"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1007\/978-3-032-19105-2_9","article-title":"Can SHAP-based explanations differentiate between concept drift and scale drift in computer networks data?","volume":"Volume 2842","author":"Pawlicki","year":"2026","journal-title":"Machine Learning and Principles and Practice of Knowledge Discovery in Databases"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Pawlicki, M., Szelest, S., Kozik, R., and Chora\u015b, M. (2025). SHAP insights into domain adaptation in Netflow-based network intrusion detection powered by deep learning. Availability, Reliability and Security (ARES 2025), Springer.","DOI":"10.1007\/978-3-032-00644-8_18"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Elangovan, R., Parthasarathy, D.D., Jawahar, M., Kaliyaperumal, P., Balusamy, B., Yogarayan, S., and Venkatesan, V. (2026). Cross-dataset temporal and semantic generalization of intrusion detection models for the future Internet. Future Internet, 18.","DOI":"10.3390\/fi18040194"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1179","DOI":"10.1007\/s10489-023-05176-1","article-title":"A multi-constraint transfer approach with additional auxiliary domains for IoT intrusion detection under unbalanced samples distribution","volume":"54","author":"Liu","year":"2024","journal-title":"Appl. Intell."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"V\u0169, L., Nguyen, Q.U., Hoang, D.T., Nguyen, D.N., and Dutkiewicz, E. (2023). A novel transfer learning model for intrusion detection systems in IoT networks. Emerging Trends in Cybersecurity Applications, Springer.","DOI":"10.1007\/978-3-031-09640-2_3"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Elayni, M., and Jemili, F. (2017). Using MongoDB databases for training and combining intrusion detection datasets. Software Engineering, Artificial Intelligence, Networking and Parallel\/Distributed Computing, Springer. Studies in Computational Intelligence.","DOI":"10.1007\/978-3-319-62048-0_2"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"4589","DOI":"10.1007\/s40747-024-01388-1","article-title":"Meta learning-based few-shot intrusion detection for 5G-enabled industrial internet","volume":"10","author":"Yan","year":"2024","journal-title":"Complex Intell. Syst."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Althiyabi, T., Ahmad, I., and Alassafi, M.O. (2024). Enhancing IoT security: A few-shot learning approach for intrusion detection. Mathematics, 12.","DOI":"10.3390\/math12071055"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"862","DOI":"10.1631\/FITEE.2400556","article-title":"A subspace-based few-shot intrusion detection system for the Internet of Things","volume":"26","author":"Li","year":"2025","journal-title":"Front. Inf. Technol. Electron. Eng."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"108692","DOI":"10.1016\/j.compeleceng.2023.108692","article-title":"Explainable cross-domain evaluation of ML-based network intrusion detection systems","volume":"108","author":"Layeghy","year":"2023","journal-title":"Comput. Electr. Eng."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"109143","DOI":"10.1016\/j.engappai.2024.109143","article-title":"Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems","volume":"137","author":"Shyaa","year":"2024","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"109692","DOI":"10.1016\/j.comnet.2023.109692","article-title":"Cross-domain network attack detection enabled by heterogeneous transfer learning","volume":"227","author":"Zhang","year":"2023","journal-title":"Comput. Netw."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"101589","DOI":"10.1016\/j.iot.2025.101589","article-title":"Explainable AI-based intrusion detection in IoT systems","volume":"31","author":"Hulayyil","year":"2025","journal-title":"Internet Things"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"102856","DOI":"10.1016\/j.cose.2022.102856","article-title":"Few-shot IoT attack detection based on RFP-CNN and adversarial unsupervised domain-adaptive regularization","volume":"121","author":"Li","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_35","unstructured":"Canadian Institute for Cybersecurity (2026, April 06). CICIoT2023: IoT Network Traffic Dataset. Available online: https:\/\/www.kaggle.com\/datasets\/himadri07\/ciciot2023\/data."},{"key":"ref_36","unstructured":"Canadian Institute for Cybersecurity (2026, April 06). CICIoMT2024: Internet of Medical Things Network Traffic Dataset. Available online: https:\/\/www.kaggle.com\/datasets\/limamateus\/cic-iomt-2024-wifi-mqtt."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Shon, H.g., Lee, Y., and Yoon, M. (2023). Semi-Supervised Alert Filtering for Network Security. Electronics, 12.","DOI":"10.3390\/electronics12234755"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"101631","DOI":"10.1016\/j.iot.2025.101631","article-title":"Evaluating and enhancing intrusion detection systems in IoMT: The importance of domain-specific datasets","volume":"32","author":"Siddiqui","year":"2025","journal-title":"Internet Things"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Shebl, A., Elsedimy, E.I., Ismail, A., Salama, A.A., and Herajy, M. (2024). DCNN: A novel binary and multi-class network intrusion detection model via deep convolutional neural network. EURASIP J. Inf. Secur., 2024.","DOI":"10.1186\/s13635-024-00184-1"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Benahmed, H., M\u2019hamedi, M., Merzoug, M., Hadjila, M., Bekkouche, A., Etchiali, A., and Mahmoudi, S. (2025). HBiLD-IDS: An efficient hybrid BiLSTM-DNN model for real-time intrusion detection in IoMT networks. Information, 16.","DOI":"10.3390\/info16080669"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Shaikh, J.A., Wang, C., Sima, M.W.U., Arshad, M., Owais, M., Hassan, D.S.M., Alkanhel, R., and Muthanna, M.S.A. (2025). A deep reinforcement learning-based robust intrusion detection system for securing IoMT healthcare networks. Front. Med., 12.","DOI":"10.3389\/fmed.2025.1524286"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"6399","DOI":"10.1007\/s13042-025-02628-7","article-title":"Multi-layered security architecture for IoMT systems: Integrating dynamic key management, decentralized storage, and dependable intrusion detection framework","volume":"16","author":"Sharma","year":"2025","journal-title":"Int. J. Mach. Learn. Cybern."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Sun, B., and Saenko, K. (2016). Deep CORAL: Correlation Alignment for Deep Domain Adaptation. Computer Vision\u2014ECCV 2016 Workshops, Springer.","DOI":"10.1007\/978-3-319-49409-8_35"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Mahbub, M., Riasat, M.T., Hamid, T., Sutradhar, S.C., and Khan, M.S.A. (2026, August 26). A Minimalistic Yet Effective Domain Adaptation Strategy for IoMT Network Intrusion Detection [Code Repository]. Available online: https:\/\/github.com\/QuantSec-Lab\/A-Minimalistic-Yet-Effective-Domain-Adaptation-Strategy-for-IoMT-Network-Intrusion-Detection.","DOI":"10.1007\/s43926-026-00288-9"},{"key":"ref_45","unstructured":"Snell, J., Swersky, K., and Zemel, R.S. (2017). Prototypical Networks for Few-shot Learning. Advances in Neural Information Processing Systems 30 (NeurIPS 2017), Curran Associates Inc."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Guida, C., Nascita, A., Montieri, A., and Pescap\u00e9, A. (2023). Cross-evaluation of deep learning-based network intrusion detection systems. Proceedings of the 2023 10th International Conference on Future Internet of Things and Cloud (FiCloud), IEEE.","DOI":"10.1109\/FiCloud58648.2023.00055"},{"key":"ref_47","first-page":"513","article-title":"Distributed deep learning approach for intrusion detection system in industrial control systems based on big data technique and transfer learning","volume":"7","author":"Abid","year":"2023","journal-title":"J. Inf. Telecommun."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6200\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T09:35:14Z","timestamp":1791279314000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6200"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,30]]},"references-count":47,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2026,10]]}},"alternative-id":["s26196200"],"URL":"https:\/\/doi.org\/10.3390\/s26196200","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,30]]}}}