BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection

Ammar Bhilwarawala; Likhamba Rongmei; Harsh Sharma; Arya Jena; Kaushal Singh; Jayashree Piri; Raghunath Dey

cs.CRApr 13, 2026

BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection

Authors: Ammar Bhilwarawala, Likhamba Rongmei, Harsh Sharma, Arya Jena, Kaushal Singh, Jayashree Piri, Raghunath Dey

Organizations: School of Computer Engineering, Kalinga Institute of Industrial Technology (KIIT), Bhubaneswar, Odisha 751024, India

Abstract

IoT botnet detection has advanced, yet most published systems are validated on a single dataset and rarely generalise across environments. Heterogeneous feature spaces make multi-dataset training practically impossible without discarding semantic interpretability or introducing data integrity violations. No prior work has addressed both problems with a formally specified, reproducible methodology. This paper does. We introduce BRIDGE (Benchmark Reference for IoT Domain Generalisation Evaluation), the first formally specified heterogeneous multi-dataset benchmark for IoT intrusion detection, unifying CICIDS-2017, CIC-IoT-2023, Bot-IoT, Edge-IIoTset, and N-BaIoT through a 46-feature semantic canonical vocabulary grounded in CICFlowMeter nomenclature, with genuine-equivalence-only feature mapping, explicit zero-filling, and per-dataset coverage from 15% to 93%. A leave-one-dataset-out (LODO) protocol makes the generalisation gap precisely measurable: all five evaluated architectures achieve mean LODO F1 between 0.39 and 0.47, and we establish the first community generalisation baseline at mean LODO F1 = 0.5577, a result that shifts the agenda from single-benchmark optimisation toward cross-environment generalisation. We propose TCH-Net, a multi-branch network fusing a three-path Temporal branch (residual convolutional-BiGRU, stride-downsampled BiGRU, pre-LayerNorm Transformer), a provenance-conditioned Contextual branch, and a Statistical branch via Cross-Branch Gated Attention Fusion (CB-GAF) with learnable sigmoid gates for dynamic feature-wise mixing. Across five random seeds, TCH-Net achieves F1 = 0.8296 +/- 0.0028, AUC = 0.9380 +/- 0.0025, and MCC = 0.6972 +/- 0.0056, outperforming all twelve baselines (p < 0.05, Wilcoxon) and recording the highest LODO F1 overall. BRIDGE and the full pipeline are at https://github.com/Ammar-ss/TCH-Net.

Figures & tables

Method	Multi- branch	Gated Fusion	Multi- dataset	IoT Focus	Full Ablation
RF / XGB [ 8 , 9 ]	—	—	—	—	—
BiLSTM [ 17 ]	—	—	—	✓	—
Transformer [ 18 ]	—	—	—	✓	—
Kitsune [ 20 ]	✓	—	—	✓	—
N-BaIoT [ 19 ]	—	—	—	✓	—
DeepDefense [ 21 ]	—	—	—	✓	—

Table 1: Qualitative comparison with representative prior work. (✓) = supported; (—) = not supported.

Dataset	Capture Tool	Year	Coverage	Tier
CICIDS-2017	CICFlowMeter	2017	93%	Primary
CIC-IoT-2023	CICFlowMeter	2023	87%	Primary
Bot-IoT	Argus	2019	39%	Primary
Edge-IIoTset ⋆	Wireshark	2022	22%	Supplementary
N-BaIoT ⋆	Kitsune	2018	15%	Supplementary

Table 2: Overview of the five BRIDGE datasets.

\star

= Supplementary; low coverage reflects non-flow-level capture.

Group	Semantic Category	Indices	Count
1	Flow rates, durations, pkt/byte counts	0–16	17
2	Packet size & IAT statistics	17–37	21
3	TCP flag indicators	38–43	6
4	Header length & window size	44–45	2
	Total		46

Table 3: 46-feature canonical vocabulary by semantic group.

Dataset	Matched / 46	Coverage	Active Groups
CICIDS-2017	43	93%	All four
CIC-IoT-2023	40	87%	All four
Bot-IoT	18	39%	Groups 1, 3, 4
Edge-IIoTset ⋆	10	22%	Groups 2–4 (partial)
N-BaIoT ⋆	7	15%	Groups 1–2 (partial)

Table 4: Canonical vocabulary coverage per dataset.

\star

= Non-flow-level capture.

Figure 1: Feature coverage of the 46-feature canonical vocabulary across five BRIDGE datasets. Blue cells indicate a genuinely matched feature; grey cells indicate explicit zero-fill (feature absent from that dataset). Column groups correspond to the four semantic categories in Table 3 . Coverage percentages are reported in Table 4 .

Dataset	Benign	Attack	Total	Atk%
CICIDS-2017	19,321	14,350	33,671	42.6%
CIC-IoT-2023	3,964	3,001	6,965	43.1%
Bot-IoT	22	16	38	42.1%
Edge-IIoTset	30,951	23,435	54,386	43.1%
N-BaIoT	13,557	10,055	23,612	42.6%
Combined	67,815	50,857	118,672	42.9%

Table 5: Post-balancing record counts per dataset.

Figure 2: Full TCH-Net architecture overview across five zones: inputs, shared feature projection, three parallel branches (T, C, H), CB-GAF fusion, and classification output.

Figure 3: T-branch three-path architecture detail. Path 1: Residual Conv-SE BiGRU (local and medium-range patterns). Path 2: Stride-Conv BiGRU (coarse-scale patterns). Path 3: Full-resolution pre-LayerNorm Transformer (global temporal context). All three paths merge onto a shared 8-step temporal grid before multi-head self-attention and mean-pooling to produce $\mathbf{h}^{T}\in\mathbb{R}^{512}$ .

Figure 4: CB-GAF mechanism detail for branch $T$ as a representative example. Each branch projects to a common dimension $d_{f}=128$ , queries other two branches simultaneously via cross-attention, then applies a learned vector gate $\mathbf{g}^{T}\in(0,1)^{128}$ to produce the gated residual fusion $\mathbf{t}_{\text{fused}}$ . Identical structure applied in parallel for branches C and H.

Figure 5: Classification head with residual skip connection detail. The mean-pooled input $\bar{\mathbf{x}}\in\mathbb{R}^{46}$ is projected to $\mathbf{r}\in\mathbb{R}^{64}$ and concatenated with $\mathbf{h}_{\text{fuse}}$ to form $\mathbf{z}\in\mathbb{R}^{448}$ . A two-layer MLP with a residual skip $W_{\text{skip}}:448\to 128$ provides a direct gradient highway from the full input to the output layer, preventing gradient vanishing in the deep classification pathway.

Hyperparameter	Value	Rationale
Window $W$	32	Covers short attack bursts
Stride $S$	4	Coverage vs. compute
Embed dim $d_{e}$	32	Compact context representation
Conv channels	[64, 128, 128]	Progressive feature expansion
SE reduction ratio $r$	8	Channel recalibration efficiency
GRU hidden (Path 1)	128/dir, 2 layers	Matched to baselines

Table 6: Hyperparameter Settings

Model	F1	ROC-AUC	MCC	PR-AUC	$\Delta$ F1 (sig.)
TCH-Net (Ours)	$\mathbf{0.8296\pm 0.0028}$	$\mathbf{0.9380\pm 0.0025}$	$\mathbf{0.6972\pm 0.0056}$	$\mathbf{0.8912\pm 0.0031}$	—
BiLSTM-IDS [ 17 ]	$0.7805\pm 0.0010$	$0.8975\pm 0.0001$	$0.5972\pm 0.0030$	$0.8441\pm 0.0018$	$+0.0491^{**}$
BiGRU-IDS [ 12 ]	$0.7805\pm 0.0011$	$0.8962\pm 0.0013$	$0.5987\pm 0.0034$	$0.8438\pm 0.0022$	$+0.0491^{**}$
1D-CNN-IDS	$0.7932\pm 0.0076$	$0.9076\pm 0.0062$	$0.6213\pm 0.0153$	$0.8601\pm 0.0091$	$+0.0364^{*}$
Transformer-IDS [ 18 ]	$0.7958\pm 0.0030$	$0.9147\pm 0.0012$	$0.6255\pm 0.0067$	$0.8699\pm 0.0041$	$+0.0338^{**}$
MLP-IDS	$0.7039\pm 0.0008$	$0.8152\pm 0.0005$	$0.4348\pm 0.0018$	$0.7311\pm 0.0012$	$+0.1257^{***}$

Table 7: Main comparison results. Mean

\pm

std across seeds. Best per metric in bold .

\Delta

F1: absolute F1 improvement of TCH-Net over each baseline. Significance:

{}^{***}p<0.001

{}^{**}p<0.01

{}^{*}p<0.05

(one-sided paired Wilcoxon signed-rank test).

Figure 6: Radar chart comparing TCH-Net against the five strongest baselines across all four evaluation metrics. TCH-Net (filled area) consistently extends beyond all baselines on every axis.

Model	Params (M)	Latency (ms)	Throughput ( $\times$ 10 3 sps)	Mem (MB)	F1
TCH-Net (Ours) ⋆	2.692	$6.43\pm 0.18$	20.5	10.27	0.8296
BiLSTM-IDS [ 17 ]	0.609	$0.74\pm 0.02$	34.2	2.32	0.7805
BiGRU-IDS [ 12 ]	0.465	$0.58\pm 0.03$	52.0	1.77	0.7805
1D-CNN-IDS	0.068	$0.69\pm 0.03$	406.9	0.26	0.7932
Transformer-IDS [ 18 ]	0.618	$1.22\pm 0.03$	36.8	2.36	0.7958
CNN-LSTM	0.142	$0.88\pm 0.05$	273.5	0.54	0.7919

Table 8: Computational efficiency comparison. Latency: single-sample mean

\pm

std over

n=200

runs following 20 GPU warm-up passes, CUDA event timing, NVIDIA Tesla T4. Throughput: batch-512 inference, same device. Mem: runtime GPU memory footprint. F1: canonical mean from Table 7 .

\star

= proposed model.

Variant	F1 $\pm$ std	AUC	MCC	$\Delta$ F1
TCH (Full)	$\mathbf{0.8296\pm 0.0028}$	0.9380	0.6972	—
T+C	$0.7752\pm 0.0012$	0.8883	0.5880	$-0.0544$
T+H	$0.7756\pm 0.0014$	0.8885	0.5870	$-0.0540$
C+H	$0.7061\pm 0.0003$	0.8218	0.4402	$-0.1235$
T only	$0.7753\pm 0.0013$	0.8882	0.5878	$-0.0543$
C only	$0.6000\pm 0.0000$	0.4999	0.0000	$-0.2296$

Table 9: Branch ablation results (2 seeds each, seeds {42, 123}). Full model in bold.

Figure 7: Branch ablation F1, AUC, and MCC scores for all seven branch subsets. The dashed vertical line marks the full TCH-Net F1 ( $=0.8296$ ). All-branch fusion with CB-GAF provides the highest performance on every metric.

Variant	F1 $\pm$ std	AUC	MCC	$\Delta$ F1
Full TCH-Net	$\mathbf{0.8296\pm 0.0028}$	0.9380	0.6972	—
w/o CB-GAF	$0.7759\pm 0.0011$	0.8898	0.5889	$-0.0537$
w/o MSTE (Three-Path Enc.)	$0.7760\pm 0.0019$	0.8890	0.5903	$-0.0536$
w/o Aux. Loss	$0.7755\pm 0.0024$	0.8893	0.5875	$-0.0541$
w/o All (v2)	$0.7752\pm 0.0022$	0.8901	0.5857	$-0.0544$
$\Delta$ F1 values bound individual contributions (inclusive of proxy architectural gap); refer footnote $\dagger$ .

Table 10: Novelty component ablation (2 seeds,

\{42,123\}

). Full model in bold.

Dataset	N	DetRate	FA	F1	Note
CICIDS-2017	33,671	0.9433	0.0309	0.9505	—
CIC-IoT-2023	6,965	0.8827	0.0257	0.9211	—
Bot-IoT	38	not reported			$\dagger$
Edge-IIoTset	54,386	0.6844	0.2589	0.6755	$\star$
N-BaIoT	23,612	0.9982	0.0206	0.9854	$\star$

Table 11: Per-dataset detection rate (DetRate), false alarm rate (FA), and F1.

\star

= Supplementary dataset; low canonical coverage (Table 4 ).

Split	F1	AUC	MCC	PR-AUC
Random (5 seeds)	0.8296	0.9380	0.6972	0.8912
Temporal (1 seed)	0.8203	0.9261	0.6831	0.8804
$\Delta$	$-0.0093$	$-0.0119$	$-0.0141$	$-0.0108$

Table 12: Temporal split vs. random split evaluation.

Held-Out	F1	$\pm$ std	AUC	MCC	PR-AUC
CICIDS-2017	0.3128	0.232	0.0509	$-0.545$	0.2949
CIC-IoT-2023	0.6013	0.000	0.1440	0.000	0.2725
Bot-IoT	0.5934	0.011	0.5693	0.089	0.4883
Edge-IIoTset ⋆	0.6791	0.008	0.6841	0.252	0.6688
N-BaIoT ⋆	0.6021	0.000	0.8171	0.000	0.7876
MEAN	0.5577	—	0.4531	$-0.041$	0.5024

Table 13: Leave-one-dataset-out (LODO) generalisation benchmark (2 seeds,

\{42,123\}

). These results constitute BRIDGE ’s primary cross-dataset difficulty measurement.

\star

= Supplementary dataset.

Figure 8: Leave-one-dataset-out (LODO) F1 compared to in-distribution random-split F1 per held-out dataset. The dashed line marks the LODO mean ( $=0.5577$ ). The gap annotation on CICIDS-2017 shows the worst-case generalisation shortfall ( $+0.6377$ ), attributable to dataset dominance rather than feature coverage. † Bot-IoT test set $n=38$ (unreliable). ⋆ Supplementary dataset.

Model	LODO F1	$\pm$ std	LODO AUC	$\Delta$ F1
BiLSTM-IDS [ 17 ]	0.3881	0.3062	0.4948	$+$ 0.1696
Transformer-IDS [ 18 ]	0.3910	0.2527	0.4831	$+$ 0.1667
BiGRU-IDS [ 12 ]	0.4449	0.2607	0.4948	$+$ 0.1128
1D-CNN-IDS	0.4592	0.2380	0.4105	$+$ 0.0985
CNN-LSTM	0.4654	0.2351	0.5500	$+$ 0.0923
Baseline mean	0.4297	—	0.4866	$+$ 0.1280

Table 14: Baseline LODO generalisation benchmark (2 seeds, same protocol as Table 13 ). Only the five deep learning baselines are included; classical ML baselines (RF, XGBoost) are omitted as their inferior in-distribution F1 makes their LODO performance a lower bound of limited analytical interest.

\Delta

F1: TCH-Net LODO F1 (0.5577, from Table 13 ) minus baseline mean LODO F1. A positive

\Delta

F1 indicates TCH-Net retains superior cross-dataset generalisation.

IoT Intrusion Detection

IoT intrusion detection identifies malicious network activity targeting connected devices and industrial systems using traffic and device data.

See all 51 papers

Exploring Robust Intrusion Detection: A Benchmark Study of Feature Transferability in IoT Botnet Attack Detection
Feb 27, 2026Alejandro Guerra-Manzanares, Jialin HuangIoT Intrusion Detection Cross-Domain Generalization
School of Computer Science, University of Nottingham, Ningbo, China · School of Computer Science, University of Nottingham, Nottingham, United Kingdom
Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks
Jul 1, 2026MD Azizul Hakim, Md Shihab Uddin, Talha Ibne AnisIoT Intrusion Detection Network Intrusion Detection
Department of Computer Science and Technology, Bangladesh Sweden Polytechnic Institute Kaptai, Rangamati, Chittagong 4530, Bangladesh · Department of Electrical Engineering, Bangladesh Sweden Polytechnic Institute Kaptai, Rangamati, Chittagong 4530, Bangladesh
SE-Enhanced ViT and BiLSTM-Based Intrusion Detection for Secure IIoT and IoMT Environments
Apr 6, 2026Afrah Gueriani, Hamza Kheddar, Ahmed Cherif Mazari +2Hybrid Transformer Architectures IoT Intrusion Detection
LSEA Lab., Faculty of Technology, University of MEDEA, Medea 26000, Algeria · LSEA Lab, Faculty of Science, University of MEDEA, Medea 26000, Algeria · Department of Computer Engineering, Gazi University, Ankara, Turkey +1

Feb 27, 2026J/K move · Enter open · S save

Exploring Robust Intrusion Detection: A Benchmark Study of Feature Transferability in IoT Botnet Attack Detection

Alejandro Guerra-Manzanares, Jialin Huang

School of Computer Science, University of Nottingham, Ningbo, China · School of Computer Science, University of Nottingham, Nottingham, United Kingdom

IoT Intrusion Detection Cross-Domain Generalization Cross-Dataset Generalization Transfer Learning

Open paper AskPDF arXiv

Cross-domain intrusion detection remains a critical challenge due to significant variability in network traffic characteristics and feature distributions across environments. This study evaluates the transferability of three widely used flow-based feature sets (Argus, Zeek and CICFlowMeter) across four widely used datasets representing heterogeneous IoT and Industrial IoT network conditions. Through extensive experiments, we evaluate in- and cross-domain performance across multiple classification models and analyze feature importance using SHapley Additive exPlanations (SHAP). Our results show that models trained on one domain suffer significant performance degradation when applied to a different target domain, reflecting the sensitivity of IoT intrusion detection systems to distribution shifts. Furthermore, the results evidence that the choice of classification algorithm and feature representations significantly impact transferability. Beyond reporting performance differences and thorough analysis of the transferability of features and feature spaces, we provide practical guidelines for feature engineering to improve robustness under domain variability. Our findings suggest that effective intrusion detection requires both high in-domain performance and resilience to cross-domain variability, achievable through careful feature space design, appropriate algorithm selection and adaptive strategies.

Abstract

IoT Intrusion Detection

Explore similar work

Exploring Robust Intrusion Detection: A Benchmark Study of Feature Transferability in IoT Botnet Attack Detection

Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks

SE-Enhanced ViT and BiLSTM-Based Intrusion Detection for Secure IIoT and IoMT Environments