Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT

Amirmohammad Pasdar; Shabnam Kasra Kermanshahi; Nour Moustafa; Van-Thuan Pham

cs.CRFeb 18, 2026

Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT

Authors: Amirmohammad Pasdar, Shabnam Kasra Kermanshahi, Nour Moustafa, Van-Thuan Pham

Organizations: School of Computing and Information Systems, The University of Melbourne, VIC 3010, Australia · School of Systems & Computing, University of New South Wales, ACT 2612, Australia

Abstract

The Internet of Battlefield Things (IoBT) relies on heterogeneous, bandwidth-constrained, and intermittently connected tactical networks that face rapidly evolving cyber threats. In this setting, intrusion detection cannot depend on continuous central collection of raw traffic due to disrupted links, latency, operational security limits, and non-IID traffic across zones. We present Zone-Adaptive Intrusion Detection (ZAID), a collaborative detection and model-improvement framework for unseen attack types, where "zero-day" refers to previously unobserved attack families and behaviours (not vulnerability disclosure timing). ZAID combines a universal convolutional model for generalisable traffic representations, an autoencoder-based reconstruction signal as an auxiliary anomaly score, and lightweight adapter modules for parameter-efficient zone adaptation. To support cross-zone generalisation under constrained connectivity, ZAID uses federated aggregation and pseudo-labelling to leverage locally observed, weakly labelled behaviours. We evaluate ZAID on ToN_IoT using a zero-day protocol that excludes MITM, DDoS, and DoS from supervised training and introduces them during zone-level deployment and adaptation. ZAID achieves up to 83.16% accuracy on unseen attack traffic and transfers to UNSW-NB15 under the same procedure, with a best accuracy of 71.64%. These results indicate that parameter-efficient, zone-personalised collaboration can improve the detection of previously unseen attacks in contested IoBT environments.

Figures & tables

Fig. 1 : Overview of ZAID in an IoBT environment. Each zone processes traffic locally at a restricted gateway, where a universal classifier makes a baseline decision, lightweight adapters customise the classifier to local traffic, and an autoencoder-based anomaly score reliably detects unseen attack types. Zones periodically share only a small set of trainable parameters for aggregation, enabling collaborative enhancement without centralising raw traffic.

Study	Domain	No raw data sharing	Collaboration mechanism	Personalisation /Transfer	Notes
[ 38 ]	Vehicular / mobile (IoV)	Yes	Distributed CIDS	Limited	Privacy-preserving collaborative IDS under mobility
[ 27 ]	IoT gateways	Yes	Federated aggregation	Device-type models	Unsupervised/self-learning behavioural profiling with FL
[ 24 ]	IoT	Yes	Federated learning	Limited	FL-based anomaly detection on decentralised data
[ 28 ]	IoT edge	Yes	Federated learning	Limited	Zero-day botnet detection framed in FL setting
[ 8 ]	Network IDS (cross-domain)	N/A	N/A	Yes	Highlights distribution shift and transfer considerations
[ 32 ]	Network IDS (features)	N/A	N/A	Indirect	Evaluates whether standard feature sets generalise

TABLE I : Representative related work and how it connects to ZAID. “Domain” is stated explicitly to avoid over-claiming “IoBT” when a study is evaluated in civilian IoT or other distributed settings.

Panel of Figure 3 — Fig. 2 : Conceptual contrast between (a) centralised traffic analysis/training and (b) ZAID-style zone-local learning that shares model updates/parameters rather than raw traffic.

Panel of Figure 4 — Fig. 3 : Architectures used in the current ZAID implementation: (a) universal CNN classifier $\mathcal{U}$ and (b) autoencoder $\mathcal{A}$ for reconstruction-based anomaly signal.

Fig. 4 : Zone localisation: the universal backbone is reused while lightweight adapter modules and classification layers are trainable (dashed blocks).

Attack	Ratio
XSS	0.695806
Injection	0.124408
Password	0.124337
Scanning	0.028964
Backdoor	0.021716
Ransomware	0.004078

TABLE II : Attack proportion in training dataset (ToN_IoT) after withholding MITM, DDoS, and DoS.

Metric	Equation
Recall	$\dfrac{TP}{TP+FN}$
Precision	$\dfrac{TP}{TP+FP}$
Accuracy	$\dfrac{TP+TN}{TP+TN+FP+FN}$
F1 Score	2 $\times$ $\dfrac{precision\times recall}{precision+recall}$

TABLE III : Performance metrics.

Fig. 5 : Feature selection ranking using RFC and RFE is on the bottom x-axis, while the mutual information score is on the top x-axis. Lower rankings and higher MI scores are preferable.

Study	Accuracy	Precision	Recall	F1 Score
ZAID	97.28	96.45	98.16	97.27
Bierbrauer et al. [ 8 ]	97.33	96.51	98.21	97.33
Mohamed et al. [ 22 ]	97.06	96.22	97.95	97.06
Popoola et al. [ 28 ]	97.35	96.48	98.27	97.35
Khan et al. [ 15 ]	96.59	94.93	97.16	96.00

TABLE IV : Single-site performance metrics comparison on ToN_IoT (universal model setting).

Panel of Figure 10 — Fig. 6 : ZAID universal model (a) confusion matrix and (b) classification report. Macro average equally weights classes in the final metric. (c) Reconstruction error distribution of the autoencoder on test datasets.

Attack	$Z_{1}$	$Z_{2}$	$Z_{3}$	$Z_{4}$
Benign	22,005	22,161	22,313	22,294
XSS	18,077	17,970	17,847	17,851
Injection	1,634	1,717	1,656	1,699
Password	2,669	2,552	2,595	2,556
MITM	29	13	12	13
DDoS	8	7	3	6

TABLE V : Attack proportion in each zone based on ToN_IoT.

Study	Accuracy	Precision	Recall	F1 Score
Bierbrauer et al. [ 8 ]	58.39	34.55	77.71	23.23
Popoola et al. [ 28 ]	39.52	33.71	37.71	31.81
ZAID (1, 0, 0) $\geq$ 1	64.27	80.76	36.27	47.66
ZAID (0, 1, 0) $\geq$ 1	82.34	97.59	66.24	78.21
ZAID (0, 0, 1) $\geq$ 1	81.80	81.37	86.14	81.95
ZAID (1, 1, 1) $\geq$ 2	81.57	97.70	64.59	77.07

TABLE VI : Average performance metrics comparison on ToN_IoT under the withheld-family zero-day protocol (protocol-aligned comparisons).

Study	Accuracy	Precision	Recall	F1 Score
Mohamed et al. [ 22 ]	50.58	2.07	16.43	1.11
Khan et al. [ 15 ]	49.55	98.35	49.76	65.62

TABLE VII : Average performance on ToN_IoT under the withheld-family zero-day protocol (reference-inspired baselines reported for context).

Attack	$Z_{1}$	$Z_{2}$	$Z_{3}$	$Z_{4}$
Benign	23,162	23,261	23,371	23,397
XSS	18,031	18,001	17,834	17,836
Injection	1,696	1,678	1,727	1,673
Password	2,606	2,548	2,553	2,583
Analysis	5	9	13	16
Backdoor	14	15	13	9

TABLE VIII : Attack proportion in each zone based on ToN_IoT & UNSW-NB15.

Study	Accuracy	Precision	Recall	F1 Score
Bierbrauer et al. [ 8 ]	64.90	63.71	68.02	65.79
Popoola et al. [ 28 ]	66.74	73.39	51.77	59.82
ZAID (1, 0, 0) $\geq$ 1	62.52	75.87	35.81	46.35
ZAID (0, 1, 0) $\geq$ 1	71.64	75.99	62.75	67.94
ZAID (0, 0, 1) $\geq$ 1	62.03	76.06	35.27	44.55
ZAID (1, 1, 1) $\geq$ 2	65.21	76.88	43.14	53.46

TABLE IX : Average performance metrics comparison under domain shift to UNSW-NB15 (protocol-aligned comparisons).

Study	Accuracy	Precision	Recall	F1 Score
Mohamed et al. [ 22 ]	66.07	76.01	46.34	56.57
Khan et al. [ 15 ]	65.38	69.69	54.34	59.73

TABLE X : Average performance under domain shift to UNSW-NB15 (reference-inspired baselines reported for context).

Explore similar work

ThreatFormer-IDS: Robust Transformer Intrusion Detection with Zero-Day Generalization and Explainable Attribution
Feb 26, 2026Srikumar NayakIoT Intrusion Detection Network Intrusion Detection
Incedo Inc, USA
FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks
Aug 4, 2026An Khanh Bui, Cong Thanh Nguyen, Hoang-Anh Pham +2Network Intrusion Detection Internet of Things
UTS-HCMUT JTIRC, Ho Chi Minh City University of Technology (HCMUT), Ho Chi Minh City 700000, Vietnam. · Vietnam National University Ho Chi Minh City (VNU-HCM), Ho Chi Minh City 700000, Vietnam. · School of Electrical and Data Engineering, University of Technology Sydney, Sydney, NSW 2007, Australia.
UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection
May 21, 2026Saif Alzubi, Frederic StahlNetwork Intrusion Detection Unsupervised Anomaly Detection
Department of Computer Science, University of Exeter, Exeter, UK · German Research Center for Artificial Intelligence GmbH (DFKI), Marine Perception, Marie-Curie-Straße 1, 26129 Oldenburg, Germany

Feb 26, 2026J/K move · Enter open · S save

ThreatFormer-IDS: Robust Transformer Intrusion Detection with Zero-Day Generalization and Explainable Attribution

Srikumar Nayak

Incedo Inc, USA

IoT Intrusion Detection Network Intrusion Detection Adversarial Robustness Internet of Things Transformer

Open paper AskPDF arXiv

Intrusion detection in IoT and industrial networks requires models that can detect rare attacks at low false-positive rates while remaining reliable under evolving traffic and limited labels. Existing IDS solutions often report strong in-distribution accuracy, but they may degrade when evaluated on future traffic, unseen (zero-day) attack families, or adversarial feature manipulations, and many systems provide limited evidence to support analyst triage. To address these gaps, we propose ThreatFormer- IDS, a Transformer-based sequence modeling framework that converts flow records into time-ordered windows and learns contextual representations for robust intrusion screening. The method combines (i) weighted supervised learning for imbalanced detection, (ii) masked self-supervised learning to improve representation stability under drift and sparse labels, (iii) PGDbased adversarial training with scale-normalized perturbations to strengthen resilience against feature-level evasion, and (iv) Integrated Gradients attribution to highlight influential time steps and features for each alert. On the ToN IoT benchmark with chronological evaluation, ThreatFormer-IDS achieves AUCROC 0.994, AUC-PR 0.956, and Recall@1%FPR 0.910, outperforming strong tree-based and sequence baselines. Under a zero-day protocol with held-out attack families, it maintains superior generalization (AUC-PR 0.721, Recall@1%FPR 0.783). Robustness tests further show slower degradation in AUCPR as the adversarial budget increases, confirming improved stability under bounded perturbations. Overall, ThreatFormer- IDS provides a unified, deployment-oriented IDS pipeline that balances detection quality, zero-day behavior, robustness, and explainability.

Abstract

Explore similar work

ThreatFormer-IDS: Robust Transformer Intrusion Detection with Zero-Day Generalization and Explainable Attribution

FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks

UNAD+: An Explainable Hybrid Framework for Unknown Network Attack Detection