arXiv CSopen access

BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection

BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection Ammar Bhilwarawalaa,∗, Likhamba Rongmeia , Harsh Sharmaa , Arya Jenaa , Kaushal Singha , Jayashree Piria , Raghunath Deya a School of Computer Engineering, Kalinga Institute of Industrial Technology (KIIT), Bhubaneswar, Odisha 751024, India

arXiv:2604.11324v1 [cs.CR] 13 Apr 2026

Abstract Despite years of progress in IoT botnet detection, the field has been quietly building on a shaky foundation: the overwhelming majority of published systems are evaluated on a single dataset, producing performance estimates that simply do not hold when the network environment changes. Compounding this, the heterogeneous feature spaces of available IoT security datasets have made principled multi-dataset training practically impossible without either discarding semantic interpretability or introducing silent data integrity violations. No prior work has addressed both problems together with a formally specified, reproducible methodology. This paper makes two primary contributions toward fixing that. First, we introduce BRIDGE (Benchmark Reference for IoT Domain Generalisation Evaluation), the first formally specified heterogeneous multi-dataset benchmark for IoT intrusion detection, unifying five structurally distinct publicly available datasets, CICIDS-2017, CIC-IoT-2023, Bot-IoT, Edge-IIoTset, and N-BaIoT, through a 46-feature semantic canonical vocabulary grounded in CICFlowMeter nomenclature, with genuine-equivalence-only feature mapping, explicit zero-filling for absent features, and full per-dataset coverage disclosure spanning 15% to 93%. A leave-one-dataset-out (LODO) evaluation protocol reveals, for the first time with a formally reproducible methodology, just how large the generalisation gap really is: all five evaluated deep learning architectures achieve mean LODO F1 in the range 0.39–0.47, and we establish the first formally quantified community generalisation baseline at mean LODO F1 = 0.5577, which is a finding that we believe will reframe the research agenda from single-benchmark optimisation toward cross-environment generalisation and domain adaptation. Second, we propose TCH-Net as a strong and well-characterised baseline for BRIDGE: a multi-branch neural architecture integrating a three-path Temporal branch with residual convolutional-BiGRU, stride-downsampled BiGRU, and full-resolution pre-LayerNorm Transformer encoders for multi-scale attack pattern capture, a provenance-conditioned Contextual branch, and an aggregate Statistical branch, fused via a novel Cross-Branch Gated Attention Fusion (CB-GAF) mechanism with learnable per-branch sigmoid gates that enable dynamic, feature-wise cross-branch information mixing. Evaluated across five independent random seeds on BRIDGE, TCH-Net achieves F1 = 0.8296 ± 0.0028, AUC = 0.9380 ± 0.0025, and MCC = 0.6972 ± 0.0056, outperforming all twelve baseline models with statistical significance (p < 0.05, paired Wilcoxon signed-rank test) and attaining the highest cross-dataset LODO F1 among all evaluated architectures. BRIDGE, its canonical vocabulary specification, and the complete experimental pipeline are publicly released at https://github.com/Ammar-ss/TCH-Net to facilitate reproducible community evaluation and progress on the cross-dataset generalisation challenge that BRIDGE makes, for the first time, precisely measurable. Keywords: IoT botnet detection, network intrusion detection, cross-dataset generalisation, heterogeneous benchmark, multi-branch neural architecture, gated attention fusion, domain shift, leave-one-dataset-out evaluation

1. Introduction The Internet of Things (IoT) has transformed how physical devices interact with digital infrastructure, extending connectivity from industrial sensors and smart-home appliances to medical monitors and autonomous vehicles [1]. This expansion is accompanied by a commensurate growth in the cyber attack surface: IoT devices are typically resource-constrained, ship with minimal security hardening, and operate across heterogeneous ∗ Corresponding author.

Email addresses: [email protected] (Ammar Bhilwarawala), [email protected] (Likhamba Rongmei), [email protected] (Harsh Sharma), [email protected] (Arya Jena), [email protected] (Kaushal Singh), [email protected] (Jayashree Piri), [email protected] (Raghunath Dey)

communication protocols that resist uniform monitoring, making them an attractive target for large-scale botnet conscription. Botnets represent one of the most operationally damaging threat classes in the contemporary threat landscape. The Mirai botnet [2], first observed in 2016, demonstrated that hundreds of thousands of misconfigured IoT devices could be marshalled into a coordinated distributed denial-of-service (DDoS) platform capable of generating traffic volumes exceeding 600 Gbps, sufficient to disrupt a major chunk of internet infrastructure for extended periods of time [3]. Subsequent variants: Satori, Okiru, and Masuta confirm that the Mirai template is iteratively refined to exploit newly discovered device classes and vulnerability surfaces. Beyond DDoS amplification, modern IoT botnets serve as infrastructure for credential stuffing, crypto-mining, spam relay, and lateral movement within enterprise and industrial networks.

Bhilwarawala et al.

The economic cost of IoT-facilitated cyberattacks is estimated to be in hundreds of billions of dollars annually [4], and results in the disruption of critical infrastructure which elevates these threats beyond financial harm to the matter of public security and privacy.

2

BRIDGE and TCH-Net

interpretability, or employ ad-hoc proxy mappings that introduce silent data integrity violations. Neither of which provides a principled, reproducible solution, which is why single-dataset evaluation still persists. 1.4. Contributions of This Work

1.1. Limitations of Conventional Detection Approaches The traditional network-level defence against these botnet activities is the Intrusion Detection System (IDS), which analyzes the traffic to distinguish malicious from benign interactions. Signature-based IDS platforms such as Snort [5] maintains a curated rule databases matching known attack patterns. While highly precise for cataloged threats, they are still unable to consistently detect zero-day exploits, polymorphic malware, or previously unseen botnet C&C protocols. Anomaly-based detection [7] circumvents the zero-day blind spots but suffers from elevated false positive rates in IoT environments where diverse device behaviour renders any single baseline inadequate [19]. Classical machine learning models achieve strong benchmark performance, yet treat flows as independent samples, discarding temporal ordering, the very structure in which coordinated attack behaviour is encoded [6]. 1.2. The Single-Dataset Evaluation Crisis Recurrent neural architectures [11, 12], convolutional networks [13], and transformer-based models [14] have enabled IDS to exploit sequential dependencies that flat feature vectors cannot capture. Despite this progress, the vast majority of published systems are evaluated on a single benchmark dataset, producing optimistic estimates tuned to one capture environment, one time period, and one attack toolkit. Ring et al. [30] surveyed 34 network IDS datasets and found that single-dataset evaluation is the dominant paradigm, with feature naming inconsistencies, labelling methodology differences, and capture tool variations identified as primary obstacles to principled multi-dataset comparison. Compounding this, widely-used benchmarks including CICIDS-2017 [24] contain systematic labelling artifact and CICFlowMeter implementation errors that artificially inflate reported metrics [29]. As Sommer and Paxson [6] demonstrated empirically, models trained in a closed-world benchmark exhibit dramatic performance degradation outside it, a limitation particularly acute in heterogeneous IoT environments where device populations and attack toolkits shift continuously. The field therefore lacks a reliable answer to a fundamental question: how well do IoT botnet detection systems actually generalize across the diverse network environments in which they must operate?

This paper addresses both the evaluation crisis and the feature heterogeneity problem through two interconnected contributions: 1. BRIDGE: A Benchmark Reference for IoT Domain Generalisation Evaluation. We introduce BRIDGE, the first formally specified evaluation benchmark unifying five structurally distinct IoT network security datasets through a principled feature alignment framework. BRIDGE comprises: • A 46-feature semantic canonical vocabulary grounded in CICFlowMeter nomenclature, with genuine-equivalence-only mapping constraints, explicit zero-filling for absent features, and full perdataset coverage disclosure spanning 15% to 93% across the five datasets. • A reproducible preprocessing pipeline including class balancing, shared RbustScaler normalisation, sliding-window sequence construction, and verified leakage-free train/test splitting. • A leave-one-dataset-out (LODO) evaluation protocol providing the first formally quantified crossdataset generalisation benchmark in heterogeneous IoT intrusion detection, establishing mean LODO F1 = 0.5577 as a rigorous BRIDGE community baseline that exposes the domain shift as a primary challenge in this sector. 2. TCH-Net: A Multi-Branch Architecture for MultiDataset Botnet Detection. We propose TCH-Net as a deep neural architecture comprising of three specialized parallel branches designed to exploit distinct modalities of network flow nformation:

1.3. The Feature Heterogeneity Problem

• Cross-Branch Gated Attention Fusion (CB-GAF): a novel fusion mechanism in which each branch queries the remaining two via scaled dot-product attention modulated by learnable per-branch sigmoid gates, enabling dynamic and asymmetric cross-branch information mixing. Component ablation using TCHNovAbl confirms CB-GAF is necessary; its removal degrades F1 by ∼0.054 relative to the full model (inclusive of proxy architectural gap).

A natural response to single-dataset fragility is multi-dataset training, but the network security dataset ecosystem is characterized by profound feature-space heterogeneity: CICFlowMeter datasets [28] export bidirectional flow statistics, Argus [26] produces session-level records, Wireshark [27] captures packetlevel attributes, and Kitsune [19] produces statistical fingerprint vectors with no flow-level correspondence. Existing multidataset approaches either apply PCA [10], discarding semantic

• Three-Path Temporal Encoding: a T-branch consisting of three parallel encoders, (i) a residual depthwise-separable convolutional stack with Squeeze-Excitation recalibration followed by a two-layer BiGRU capturing both local and medium-range sequential patterns; (ii) a stridedownsampled convolutional projection followed by a single-layer BiGRU capturing coarse-scale

Bhilwarawala et al.

dynamics; and (iii) a full-resolution two-layer preLayerNorm Transformer encoder with CLS-token classification capturing global temporal context, fused via multi-head self-attention across a shared 8-step temporal grid into hT ∈ R512 . Component ablation confirms MSTE is necessary; its removal degrades F1 by ∼0.054 relative to the full model (inclusive of proxy architectural gap). • Dual Domain Embedding: a contextual branch encoding dataset identity and device category as learned dense embeddings, conditioning CB-GAF’s fusion behaviour on input provenance and enabling the model to calibrate cross-branch information mixing based on the feature coverage profile of each source dataset. After evaluated over all five independent random seeds on BRIDGE, TCH-Net achieves F1 = 0.8296 ± 0.0028, AUC = 0.9380 ± 0.0025, and MCC = 0.6972 ± 0.0056, outperforming all twelve previously evaluated baseline models with statistical significance (p < 0.05, paired Wilcoxon signed-rank test). Paper organisation. Section 2 surveys related work. Section 3 details BRIDGE and its preprocessing pipeline. Section 4 presents the TCH-Net architecture. Section 5 reports all experimental results. Section 6 discusses findings and limitations. Section 7 concludes. 2. Related Work 2.1. Classical Machine Learning for Network IDS Decision tree ensembles, especially random forests [8], became a dominant paradigm for flow-based IDS owing to their resistance to irrelevant features, native handling of mixed-type inputs, and interpretable feature importance scores. Random forest classifiers trained on CICFlowMeter-derived features routinely achieve high accuracy on single-dataset benchmarks, largely because many exported features contain substantial discriminative redundancy that tree ensembles exploit efficiently. Gradientboosted decision trees, epitomised by XGBoost [9], extend this through sequential residual fitting and have been applied to both binary and multi-class intrusion detection with similar results [30]. These models treat flows as an independent set of samples and rely on handcrafted features, both of which limits generalization when device population or attack toolkit shifts [6]. 2.2. Recurrent and Convolutional Deep Learning for IDS LSTM networks [11] and their bidirectional [17] and GRU [12] variants model temporal dependencies across flow sequences. Applied to CICFlowMeter data, they report F1 of 0.97 to 0.99 on CICIDS-2017 [17], performance that does not transfer to held-out environments, as our LODO results confirmed. One-dimensional CNNs [13] extract local temporal motifs; CNN-LSTM hybrids extend this with a long-range memory. A consistent limitation of all single-path architectures is the absence of principled mechanisms for fusing temporal, statistical,

3

BRIDGE and TCH-Net

and provenance modalities of network flows, which TCH-Net addresses through its three-branch CB-GAF design. 2.3. Transformer-Based Approaches The transformer architecture [14], built on scaled multi-head self-attention, theoretically allows the attending of arbitrarily distant positions within a sequence window without the sequential bottleneck of recurrent computation. Recent works have applied transformer encoders to flow-level network traffic classification, consistently finding that self-attention provides modest improvements over BiLSTM baselines on single-dataset benchmarks when model capacity is held constant [18]. A critical challenge for transformer-based IDS is data volume: transformer models are notoriously data-hungry, and the effective training sets available after class-balancing can leave transformers under-trained relative to their capacity, leading to elevated variance across random seeds. In TCH-Net, the Transformer is deliberately restricted to a fixed 32-step window within the T-branch, maintaining a favourable data-to-parameter ratio while contributing global temporal context alongside the recurrent paths. 2.4. IoT-Specific Intrusion Detection Systems N-BaIoT [19] pioneered deep autoencoders for device-level IoT botnet detection, representing each device’s traffic as a highdimensional vector of sliding-window statistical features and training a per-device auto-encoder on benign traffic to detect botnet-induced reconstruction anomalies. N-BaIoT achieves near-perfect detection on trained device types but requires perdevice model training and cannot be generalized to unseen device classes. Kitsune [20] trains an ensemble of feature-group autoencoders incrementally on streaming traffic, though concept drift still elevates false alarm rates. DeepDefense [21], Diro and Chilamkurti [22], and GraphSAGE-based approaches [23] each demonstrate domain-tailored value but share a common limitation: evaluation on narrow single-dataset benchmarks that does not address the cross-capture-tool feature alignment. 2.5. Multi-Dataset Evaluation and Feature Alignment Ring et al. [30] found that single-dataset evaluation dominates the IDS literature, with naming inconsistencies and capturetool variation being the primary obstacles for principled multidataset comparison. Engelen et al. [29] audited CICIDS-2017 and catalogued labelling errors and CICFlowMeter artefacts that inflates the reported metrics, reinforcing that high single-dataset F1 does not imply real-world generalisation. To the best of our knowledge, no prior IDS work defines a formal, named canonical feature vocabulary with explicitly disclosed coverage statistics and genuine-equivalence-only mapping constraints applied simultaneously across five structurally distinct datasets. Existing multi-dataset approaches either restricts the evaluation to datasets sharing the same capture tool [30], apply PCA [10] to discard semantic interpretability, or employ ad-hoc name matching without any auditing semantic equivalence. To the best of our knowledge, BRIDGE represents

Bhilwarawala et al.

4

Table 1: Qualitative comparison with representative prior work. (✓) = supported; (—) = not supported.

Method RF / XGB [8, 9] BiLSTM [17] Transformer [18] Kitsune [20] N-BaIoT [19] DeepDefense [21] IoT-DNN [22] TCH-Net (Ours)

Multibranch

Gated Fusion

Multidataset

IoT Focus

Full Ablation

— — — ✓ — — — ✓

— — — — — — — ✓

— — — — — — — ✓

— ✓ ✓ ✓ ✓ ✓ ✓ ✓

— — — — — — — ✓

the first formally specified and fully disclosed cross-dataset feature alignment and evaluation methodology for heterogeneous IoT network security datasets. 2.6. Attention Mechanisms for Network Security Attention mechanisms have been applied in IDS to re-weight temporal steps in recurrent models [18]. CB-GAF extends crossattention in two key respects: it operates across three branches simultaneously (each querying the other two branches simultaneously), and a learnable sigmoid vector gate per branch enables feature-wise suppression of cross-branch information when it is unhelpful. It is a capability that is absent from vanilla crossattention. This gating is particularly important in the heterogeneous setting, where branch informativeness varies with the canonical vocabulary coverage of the source dataset. 2.7. Positioning of This Work Table 1 summarises the key dimensions on which TCH-Net is positioned relative to prior work. Table 1 highlights that TCH-Net evaluated on BRIDGE is the only system combining a formally named multi-dataset benchmark, principled feature alignment, gated multi-branch fusion, and comprehensive evaluation including LODO generalization. 3. BRIDGE: Datasets, Feature Alignment, and Preprocessing A principled multi-dataset benchmark demands careful attention to three interrelated problems: the selection and characterisation of constituent datasets, the alignment of their heterogeneous feature spaces into a common representation, and the construction of a preprocessing pipeline that is transparent, reproducible, and free of data leakage. This section addresses each of these problems in turn. 3.1. Dataset Selection Rationale Five publicly available network security datasets are incorporated into BRIDGE, selected to cover the widest feasible range of capture modalities, network environments, device populations, and attack categories relevant to IoT botnet detection (Table 2). Crucially, each dataset was chosen because it fills a specific gap in the evaluation space that no other selected dataset covers. This

BRIDGE and TCH-Net Table 2: Overview of the five BRIDGE datasets. ⋆ = Supplementary; low coverage reflects non-flow-level capture.

Dataset

Capture Tool

Year

Coverage

Tier

CICIDS-2017 CIC-IoT-2023 Bot-IoT Edge-IIoTset⋆ N-BaIoT⋆

CICFlowMeter CICFlowMeter Argus Wireshark Kitsune

2017 2023 2019 2022 2018

93% 87% 39% 22% 15%

Primary Primary Primary Supplementary Supplementary

deliberate diversity is precisely what makes BRIDGE informative, that if all datasets shared the same capture tool and device environment, the benchmark would not stress feature alignment, and LODO results would not surface the cross-dataset domain shift that we have shown, which is a primary open challenge. Datasets split into two tiers by coverage (Table 2): three primary (≥39%) and two supplementary (≤22%), the latter stresstesting generalisation across structurally distant feature spaces. 3.2. Individual Dataset Characterisation 3.2.1. CICIDS-2017 CICIDS-2017 [24] achieves 93% canonical vocabulary coverage and contributes approximately 28% of post-balancing training records; 43 of 46 canonical slots receive genuine CICFlowMeter matches. It covers 14 attack types over a five-day testbed. Despite being well-documented labelling artefacts [29] that inflate single-dataset metrics, we retain it as a calibration anchor: the multi-dataset evaluation prevents over-reliance on a single source, and its LODO result (Section 5.9) explicitly quantifies non-transferable performance. 3.2.2. CIC-IoT-2023 CIC-IoT-2023 [25] was built around 105 physical IoT devices tested under 18 MITRE ATT&CK scenarios, producing traffic that reflects the constrained, bursty behaviour of embedded IoT firmware. CICFlowMeter capture gives 40/46 canonical matches (87%). Its 2023 collection date makes it the most temporally proximate benchmark for current IoT threats in the suite. 3.2.3. Bot-IoT Bot-IoT [26] was captured with Argus rather than CICFlowMeter, which is a session-level tool that exports byte counts, session duration, and TCP flags but not per-direction flow rates or subflow statistics, giving 39% canonical coverage (18/46). Its attack scenarios are botnet-specific (DDoS, C&C beaconing, exfiltration, reconnaissance), and the Argus/CICFlowMeter tool boundary is precisely the cross-capturetool heterogeneity the vocabulary is designed to bridge. Its 38 post-balancing test samples preclude a reliable per-dataset metrics, which are excluded accordingly; Bot-IoT’s value is structural, it is the only source imposing a 61% zero-fill regime on the canonical vocabulary. 3.2.4. Edge-IIoTset Edge-IIoTset [27] records packet-level traffic via Wireshark on Raspberry Pi IIoT nodes running MQTT, Modbus,

Bhilwarawala et al.

CoAP, DNP3, and AMQP; Wireshark operates below the flowaggregation layer, so canonical coverage falls to 22% (10/46), filled only by inter-packet times, packet lengths, TCP flags, and header size. Its value lies in traffic character: IIoT protocols impose strict timing regularity that attacks disrupt in ways that differ sharply from IT-network intrusions, stress-testing generalisation to an environment structurally unlike the CICFlowMeterdominated training corpus.

5

BRIDGE and TCH-Net

3.3.4. Alias Mapping Procedure Alignment uses a per-dataset alias map with three priority stages: exact case-insensitive match, alias exact match, and alias substring match (≥5 characters). When multiple columns match, the highest-priority match is selected and flagged for auditing. Full mapping tables have been provided as a supplementary material. 3.4. Preprocessing Pipeline

3.2.5. N-BaIoT N-BaIoT [19] contains pre-computed Kitsune statistical fingerprints [20], 115-dimensional vectors with no direct CICFlowMeter correspondence, giving the lowest canonical coverage at 15% (7/46). Despite this, it still achieves the highest per-dataset F1: Mirai and BASHLITE infections produce stereotyped, high-volume traffic separable from benign behaviour even in just seven features. It also provides confirmed ground-truth labels from physical device compromises, making it a validity anchor for the detection task. 3.3. Canonical Feature Vocabulary 3.3.1. Design Principles Three explicit constraints govern the vocabulary. Genuine equivalence only: a feature maps to a canonical slot only if it measures the same network-theoretic quantity with the same computational definition, regardless of capture tool; superficially similar but semantically distinct quantities are not mapped. Explicit zero-filling: absent features are set to zero for all records from the concerning dataset, making coverage gaps auditable. No dimensionality reduction: PCA and similar projections are excluded as they destroys the semantic interpretability. 3.3.2. Vocabulary Structure The 46 canonical features are organised into four semantically coherent groups (Table 3). Groups 1 and 2 serve as primary inputs to the Temporal and Statistical branches respectively; Groups 3 and 4 are shared across branches. Group 1 captures temporal flow dynamics: duration, forward and backward packet/byte counts, per-direction rates, total flow rates, and subflow packet counts, encoding how a session evolves over time. Group 2 captures statistical distributional structure: minimum, maximum, mean, and the standard deviation of packet lengths and inter-arrival times (IATs) in both directions, particularly informative for distinguishing device classes. Groups 3 and 4 encode protocol-level signalling: individual TCP flag counts (SYN, ACK, FIN, RST, PSH, URG), forward header length, and initial window size. 3.3.3. Per-Dataset Coverage Table 4 reports per-dataset matched feature counts and coverage percentages. A feature is counted as matched only if an authentic semantic equivalent exists and is verified by the alias mapping procedure. Figure 1 provides a visual representation of matched and zero-filled features across all five datasets.

3.4.1. Class Balancing Records are separated by label and are subsampled to a 1:1 benign-to-attack ratio. This strict balance ensures no class dominates the training loss. The 1:1 ratio was selected after pilot experiments with 3:1 and 1:3 ratios revealed class collapse in datasets with low initial attack proportions (e.g., CICIDS-2017 at 14.5%), where even a 1:3 oversampling produced window attack incidence below 10%. A minimum of 5,000 samples per class are preserved to prevent degenerate splits. 3.4.2. Semantic Vector Construction Each record is mapped to the 46-dimensional canonical vector through alias mapping. All values are parsed as 32-bit floats. Non-numeric, NaN, and infinite values are replaced with zero, producing a matrix X(d) ∈ RNd ×46 per dataset d. 3.4.3. Normalisation The five per-dataset matrices are concatenated to form Xtrain ∈ RN×46 . A RobustScaler, centring by median, scaling by the 5th to the 95th percentile interquartile range, and is fitted exclusively on Xtrain and applied to Xtest without refitting. Scaled values are clipped to [−10, 10]. A single shared scaler was deliberately used: per-dataset scaling would normalise away inter-dataset distributional differences that carry useful discriminative information and would constitute a form of data leakage in the LODO protocol. 3.4.4. Sequence Construction A sliding window of length W = 32 and stride S = 4 was applied to each dataset’s records after being sorted by flow arrival time, producing sequence tensors of shape (Nseq , 32, 46). Window labels are assigned by majority vote over constituent record labels. Training sequences are capped at 800,000 and test sequences at 200,000 for computational tractability on standard commodity hardware. 3.4.5. Context Vector Construction Each sequence window receives an integer context vector c = (cds , cdev ), where cds ∈ {0, 1, 2, 3, 4} identifies the source dataset and cdev ∈ {0, . . . , 5} identifies the inferred device category. These identifiers serve as inputs to the Contextual branch. 3.4.6. Train/Test Split and Leakage Verification The combined sequence dataset is split in a ratio of 80:20 by stratified random sampling. Splitting is performed after sequence construction which prevents label leakage from windows spanning the split boundary. Three data leakage verification

Bhilwarawala et al.

6

BRIDGE and TCH-Net

Table 3: 46-feature canonical vocabulary by semantic group.

Group 1 2 3 4

Semantic Category

Indices

Count

Flow rates, durations, pkt/byte counts Packet size & IAT statistics TCP flag indicators Header length & window size

0–16 17–37 38–43 44–45

17 21 6 2

Total

46

Table 4: Canonical vocabulary coverage per dataset. ⋆ = Non-flow-level capture.

Dataset

Matched / 46

Coverage

43 40 18 10 7

93% 87% 39% 22% 15%

CICIDS-2017 CIC-IoT-2023 Bot-IoT Edge-IIoTset⋆ N-BaIoT⋆

Active Groups All four All four Groups 1, 3, 4 Groups 2–4 (partial) Groups 1–2 (partial)

Figure 1: Feature coverage of the 46-feature canonical vocabulary across five BRIDGE datasets. Blue cells indicate a genuinely matched feature; grey cells indicate explicit zero-fill (feature absent from that dataset). Column groups correspond to the four semantic categories in Table 3. Coverage percentages are reported in Table 4.

Table 5: Post-balancing record counts per dataset.

4. Proposed Architecture: TCH-Net

Dataset

Benign

Attack

Total

Atk%

CICIDS-2017 CIC-IoT-2023 Bot-IoT Edge-IIoTset N-BaIoT

19,321 3,964 22 30,951 13,557

14,350 3,001 16 23,435 10,055

33,671 6,965 38 54,386 23,612

42.6% 43.1% 42.1% 43.1% 42.6%

Combined

67,815

50,857

118,672

42.9%

checks were applied and all passed: (i) scaler fitted before any test-set access; (ii) hash-based overlap detection confirming zero identical feature vectors between train and test partitions; (iii) benign/attack ratio consistent between train (0.758) and test (0.750). Table 5 reports post-balancing record counts.

TCH-Net is a multi-branch neural architecture that processes a sequences of canonical network flow feature vectors to produce a binary intrusion detection decisions. Three specialised parallel branches, the Temporal (T), Contextual (C), and Statistical (H) branches are preceded by a shared residual feature projection module and integrated by the Cross-Branch Gated Attention Fusion (CB-GAF) mechanism. A residual classification head and an auxiliary reconstruction decoder complete the model. The complete architecture is illustrated in Figure 2. 4.1. Problem Formulation Let X = [x1 , . . . , xW ] ∈ RW×F denote a sequence of W = 32 consecutive canonical flow feature vectors, each of dimension F = 46. Let c = (cds , cdev ) ∈ Z2 denote the context vector, where cds ∈ {0, 1, 2, 3, 4} identifies the source dataset and cdev ∈ {0, . . . , 5} identifies the inferred device category. The task is to

Bhilwarawala et al.

7

BRIDGE and TCH-Net

Figure 2: Full TCH-Net architecture overview across five zones: inputs, shared feature projection, three parallel branches (T, C, H), CB-GAF fusion, and classification output.

learn fθ : (X, c) 7→ ŷ ∈ {0, 1}, where ŷ = 0 (benign) and ŷ = 1 (attack). 4.2. Shared Input Feature Projection Before branching, the raw canonical input X is passed through a shared residual feature projection module that learns the nonlinear interactions among the 46 canonical features. Many discriminative signals in the network flow data are either ratios or products of raw statistics. For instance, bytes-per-packet or forward-to-backward rate ratios, that are not explicitly present in the canonical vocabulary. The feature projection module discovers such cross-feature relationships by applying a two-layered feed-forward network with a residual connection: X̃ = X + fproj (X),

fproj (X) = W2 · GELU(LN(W1 X⊤ ))⊤ (1)

Specifically, fproj consists of: Linear(46 → 92) → LayerNorm(92) → GELU → Dropout(δ/2) → Linear(92 → 46) → LayerNorm(46), applied independently at each time step. The residual connection X̃ = X + fproj (X) preserves the original feature magnitudes while augmenting them with learned interaction terms. All three branches receive X̃ as an input.

The central architectural motivation is that different botnet attack categories manifest at qualitatively distinct temporal scales: DDoS flooding produces discriminative burst-level signatures detectable within a few consecutive flows; C&C beaconing produces medium-scale periodic patterns spanning tens of flows; and coordinated scan-then-exploit sequences produce a global ordering constraints across the entire 32-step window. A singleresolution encoder must trade sensitivity at one scale against the others. The T-branch resolves this by routing the input through three specialised parallel paths whose outputs are subsequently unified via multi-head self-attention over a shared temporal grid of 8 steps. 4.3.1. Path 1: Residual Depthwise-Separable Convolutional BiGRU (Local and Medium-Range Patterns) Path 1 applies a three-stage convolutional frontend which is implemented as a stack of Residual Depthwise-Separable Convolutional blocks with Squeeze-Excitation recalibration (ResConvSE) and then followed by a two-layer bidirectional GRU. Depthwise-Separable Convolution.. Each convolutional layer applies a depthwise convolution (one filter per input channel) followed by a pointwise convolution (1×1 cross-channel mixing), reducing parameter count relative to standard convolution while preserving expressive capacity:

4.3. Temporal Branch (T): Three-Path Multi-Scale Temporal Encoding (MSTE)

DSConv(u) = ReLU(BN(Wpw ⋆ (Wdw ⋆ u)))

The T-branch captures the sequential dependencies across all three distinct temporal and temporal scales simultaneously.

where ⋆ denotes convolution, Wdw ∈ R is the depthwise filter (kernel width k = 3), and Wpw ∈ RCout ×Cin ×1 is the Cin ×1×k

(2)

Bhilwarawala et al.

8

BRIDGE and TCH-Net

Figure 3: T-branch three-path architecture detail. Path 1: Residual Conv-SE BiGRU (local and medium-range patterns). Path 2: Stride-Conv BiGRU (coarse-scale patterns). Path 3: Full-resolution pre-LayerNorm Transformer (global temporal context). All three paths merge onto a shared 8-step temporal grid before multi-head self-attention and mean-pooling to produce hT ∈ R512 .

pointwise filter. Squeeze-Excitation Recalibration.. Each ResConvSE block applies channel-wise attention after the two DSConv layers to reweight feature maps by their global importance: SE(u) = u ⊙ σ(W2 · ReLU(W1 · GAP(u)))

(3)

where GAP denotes global average pooling over the time dimension, W1 ∈ R⌊C/r⌋×C and W2 ∈ RC×⌊C/r⌋ with reduction ratio r = 8, and σ is the sigmoid function. ResConvSE Block.. The full residual block composes the two DSConv layers, SE recalibration, and a skip connection: ResConvSE(u) = ReLU SE(DSConv2 (DSConv1 (u)))+
BN(Wskip u)

(4)

where Wskip is a 1 × 1 projection (with batch normalisation) when input and output channel counts differ, and the identity otherwise. Three-Stage Convolutional Frontend.. Three ResConvSE blocks are stacked with intermediate MaxPool1d(2) operations to progressively compress the temporal dimension: U1 = MaxPool(ResConvSE46→64 (X̃⊤ )) ∈ R64×16 U2 = MaxPool(ResConvSE64→128 (U1 )) ∈ R128×8 U3 = AdaptiveAvgPool(ResConvSE128→128 (U2 ), 8) ∈ R

(5) (6) 128×8

(7)

where the input X̃ is transposed to channel-first format (F ×W) for convolutional processing. Two-Layer BiGRU.. The compressed temporal representation U⊤3 ∈ R8×128 is processed by a two-layer bidirectional GRU with dgru = 128 units per direction: G1 = BiGRU1 (U⊤3 ) ∈ R8×256

(8)

4.3.2. Path 2: Stride-Downsampled Convolutional BiGRU (Coarse-Scale Patterns) Path 2 applies a single strided convolution to produce a coarser temporal representation, then encodes it with a single-layer BiGRU. The stride-2 convolution performs both feature projection and temporal downsampling in one step, halving the sequence length from 32 to 16: V = ReLU(BN(Wdown ⋆2 X̃⊤ )) ∈ R64×16

(9)

where Wdown ∈ R64×46×3 is a strided convolution (kernel width 3, stride 2, padding 1). A single-layer BiGRU with dgru /2 = 64 units per direction encodes the downsampled sequence: G2 = BiGRU2 (V⊤ ) ∈ R16×128

(10)

To align Path 2 to the shared 8-step temporal grid established by Path 1, adaptive average pooling is applied over the time dimension: ⊤ ⊤ 8×128 G(8) 2 = AdaptiveAvgPool(G2 , 8) ∈ R

(11)

Bhilwarawala et al.

9

4.3.3. Path 3: Full-Resolution Pre-LayerNorm Transformer (Global Temporal Context) Path 3 processes all 32 steps of X̃ through a two-layer Transformer encoder, giving the T-branch the same global temporal receptive field as the Transformer-IDS baseline while complementing it with the local and coarse-scale representations from Paths 1 and 2. A linear projection and learnable positional encoding map the canonical features to a Transformer embedding dimension dT = 128: Ttok = X̃W⊤proj + P ∈ R32×128

(12)

where Wproj ∈ R128×46 and P ∈ R32×128 is a learnable positional encoding matrix. A classification CLS token τ ∈ R1×128 is prepended: Tin = [τ ∥ Ttok ] ∈ R33×128

(13)

A two-layer TransformerEncoder with pre-LayerNorm (norm_first), 8 attention heads, feed-forward dimension 512, and dropout δ processes Tin : Tout = TransEnc(Tin ) ∈ R33×128

(14)

Pre-LayerNorm normalises inputs to each sub-layer before the sub-layer computation, which empirically accelerates convergence and reduces gradient variance compared to the postLayerNorm formulation used in the Transformer-IDS baseline. The CLS token output is discarded and the remaining 32 token representations are aligned to the shared 8-step grid: ⊤ ⊤ 8×128 G(8) 3 = AdaptiveAvgPool(Tout [1 :, :] , 8) ∈ R

(15)

BRIDGE and TCH-Net

4.4. Statistical Branch (H): Aggregate Flow MLP The H-branch encodes the aggregate distributional profile of each input window via mean-pooling over the time dimension, collapsing temporal structure to expose the window-level statistical character: W

x̄ =

1 X x̃t ∈ R46 W t=1

A two-layer MLP with GELU activations, batch normalisation, and dropout processes x̄: hH = Dropout(GELU(BN(WH2 ·Dropout(GELU(BN(WH1 x̄)))))) ∈ R64 (20) where WH1 ∈ R128×46 and WH2 ∈ R64×128 . The H-branch captures information that is invariant to temporal ordering exactly what the T-branch is least suited to encode. The mean-pooled representation is particularly informative for distinguishing device classes through Group 2 packet size and IAT statistics, and for detecting high-volume botnet floods that produce sustained distributional shifts regardless of their temporal pattern. 4.5. Contextual Branch (C): Provenance-Conditioned Domain Embedding The Contextual branch provides CB-GAF with explicit structural context about the source of each input window, specifically, which dataset it originated from and what device category it represents. This branch does not independently classify network flows; its value emerges exclusively within the CB-GAF fusion module. Dataset and device category identifiers are mapped to dense embeddings of dimension de = 32: eds = Eds [cds ] ∈ R32 ,

4.3.4. Multi-Path Merge and Self-Attention Refinement The three path outputs, all sharing the 8-step temporal grid are concatenated along the feature dimension to form the joint multi-scale representation:

5×32

edev = Edev [cdev ] ∈ R32

(16)

where dT∗ = s1 + s2 + s3 = 256 + 128 + 128 = 512. Multi-head self-attention with nheads = 8 is applied to Gcat after layer normalisation, enabling the three paths to attend to and reweight each other’s temporal representations at each of the 8 shared time steps: A, _ = MHA(LN(Gcat ), LN(Gcat ), LN(Gcat )) ∈ R8×512

(17)

Mean-pooling over the 8 time steps yields the final T-branch representation: 8

hT =

1X At ∈ R512 8 t=1

(18)

(21)

6×32

where Eds ∈ R and Edev ∈ R are learned embedding matrices. The two embeddings are concatenated directly to form the C-branch representation: hC = [eds ∥ edev ] ∈ R64

(8) 8×dT∗ Gcat = [G1 ∥ G(8) 2 ∥ G3 ] ∈ R

(19)

(22)

No MLP is applied; the raw concatenated embedding is passed directly to CB-GAF. The C-branch alone achieves near-random classification performance (F1 ≈ 0.60, AUC ≈ 0.50), confirming that dataset and device identifiers do not independently predict attack labels. Its role is to condition CB-GAF’s vector gates on the canonical vocabulary coverage profile of the source dataset, enabling the fusion mechanism to calibrate cross-branch information mixing accordingly. 4.6. Cross-Branch Gated Attention Fusion (CB-GAF) CB-GAF integrates the three branch representations hT ∈ 512 R , hC ∈ R64 , and hH ∈ R64 through a mechanism that allows each branch to selectively incorporate information from the other two. The degree of cross-branch information flow is controlled by a learned vector gate per branch, enabling fine-grained, feature-wise modulation.

Bhilwarawala et al.

10

BRIDGE and TCH-Net

Figure 4: CB-GAF mechanism detail for branch T as a representative example. Each branch projects to a common dimension d f = 128, queries other two branches simultaneously via cross-attention, then applies a learned vector gate gT ∈ (0, 1)128 to produce the gated residual fusion tfused . Identical structure applied in parallel for branches C and H.

4.6.1. Branch Projection to Common Dimension Because the three branch representations have heterogeneous dimensionalities (dT∗ = 512, dC = dH = 64), each is first projected to a common fusion dimension d f = 128 via learned linear maps: t = WT hT ∈ R128 ,

c = WC hC ∈ R128 ,

h = WH hH ∈ R128 (23) where WT ∈ R128×512 , WC ∈ R128×64 , WH ∈ R128×64 .

4.6.2. Cross-Branch Attention Each projected branch representation serves as a query attending simultaneously to the key-value pairs of the other two branches. For branch T querying branches C and H: qT = WTQ t,

⊤ 2×128 KT = [WCK c ∥ WH , K h] ∈ R

(24) V

T

= [WCV c ∥ WVH h]⊤

   (qT )⊤ KT  T  V ∈ R128 t̃ = softmax p df

(25)

The analogous operations for branches C and H are: 128 c̃ = Attn(qC ; KC = [WTK t, WH K h]) ∈ R

(26)

h̃ = Attn(qH ; KH = [WTK t, WCK c]) ∈ R128

(27)

where WiQ , WiK , WiV ∈ R128×128 for each branch i ∈ {T, C, H}.

4.6.3. Learned Vector Gate and Residual Fusion A learnable sigmoid gate per branch controls the balance between the branch’s own projected representation and the crossattended signal. Crucially, the gate is a vector gi ∈ (0, 1)128 enabling feature-wise modulation of the fusion at each dimension independently. The gate is computed from the concatenation of the self-representation and the cross-attended output, allowing the gate to condition on both: gT = σ(WTg [t ∥ t̃] + bTg ) ∈ (0, 1)128 C

H

(28)

, with Wig ∈ R128×256 .

and analogously for g and g The gated residual fusion for each branch is:

tfused = gT ⊙ t + (1 − gT ) ⊙ t̃ ∈ R128

(29)

and analogously for cfused and hfused . When gi → 1, branch i retains its own representation; when gi → 0, it replaces its representation entirely with the cross-attended signal. This formulation is particularly critical in the heterogeneous multi-dataset setting: for inputs from low-coverage datasets (e.g., N-BaIoT at 15% coverage), the H-branch is largely zero-padded; the gates on T and C can learn to down-weight H’s contribution at the specific dimensions that are most affected, without hard-coding this decision and without sacrificing information from the remaining informative dimensions. 4.6.4. Concatenation and Layer Normalisation The three gated branch outputs are concatenated and passed through a LayerNorm layer: hfuse = LN([tfused ∥ cfused ∥ hfused ]) ∈ R384

(30)

Bhilwarawala et al.

11

4.7. Auxiliary Feature Reconstruction An auxiliary reconstruction objective prevents information collapse in CB-GAF during early training: a two-layer MLP decoder maps hfuse back to the 46-dimensional canonical feature space: x̂ = Wdec,2 · GELU(Wdec,1 hfuse ) ∈ R46

(31)

1 ∥x̂ − x̄∥22 F

Laux =

(32)

where Wdec,1 ∈ R64×384 and Wdec,2 ∈ R46×64 . The decoder is discarded at inference time. 4.8. Classification Head and Training Objective 4.8.1. Residual Classification Head A residual shortcut in the classification head improves the gradient flow. A raw feature projection from x̄ provides a direct low-level pathway: r = GELU(BN(Wraw x̄)) ∈ R64

(33)

where Wraw ∈ R64×46 . The raw projection and the fused representation are concatenated to form the classifier input: z = [hfuse ∥ r] ∈ R448

(34)

A two-layer MLP with a residual skip connection processes z: z1 = Dropout(GELU(BN(W1 z))) ∈ R256

(35)

z2 = Dropout(GELU(BN(W2 z1 ))) + Wskip z ∈ R

(36)

ŷ = softmax(Wout z2 ) ∈ ∆

(37)

128

2

where W1 ∈ R256×448 , W2 ∈ R128×256 , Wskip ∈ R128×448 (the residual skip from input z directly to the second layer output), and Wout ∈ R2×128 . 4.8.2. Training Objective The total training loss combines focal classification loss with the auxiliary reconstruction term: L = Lcls + λLaux ,

λ = 0.05

(38)

where Lcls is class-weighted focal loss with focusing parameter γ = 2.0 and label smoothing ε = 0.05: Lcls = −

X

αi (1 − pt,i )γ log pt,i

(39)

i

Class weights αi are set inversely proportional to class frequency in each training batch, normalised so that the mean weight equals 1. Label smoothing distributes ε/2 probability mass from each true class to the other, improving calibration.

BRIDGE and TCH-Net

Online Input Augmentation.. During training, zero-mean Gaussian noise with standard deviation σaug = 0.010 is added to each input sequence with probability paug = 0.30, after which values are clipped to [−10, 10]. This augmentation is applied exclusively during training and simulates sensor measurement noise, improving robustness to feature perturbation. 4.9. Optimisation and Hyperparameters All models use AdamW with initial learning rate η = 5 × 10−4 and weight decay λw = 5 × 10−5 . A cosine annealing schedule with 2-epoch linear warm-up is applied over a maximum of 30 epochs; early stopping is triggered after 5 epochs without validation F1 improvement. Table 6 provides full hyperparameter details. TCH-Net has 2.692M trainable parameters (2,691,696; verified programmatically from the released experimental pipeline). The approximate distribution across principal components is as follows: T-branch ≈1.98M (ResConvSE frontend ≈0.21M; BiGRU Path 1 ≈0.57M; Stride-BiGRU Path 2 ≈0.14M; Transformer Path 3 ≈0.43M; feat_proj ≈0.035M; merge MHA ≈0.57M); C-branch ≈0.01M (embedding tables); H-branch ≈0.02M; CB-GAF ≈0.43M; classification head ≈0.18M; auxiliary decoder ≈0.02M. Per-component figures are approximate proportional estimates; the programmatically verified total is 2.692M, reported alongside the complete efficiency analysis in Section 5.4. TCH-Net’s parameter count of 2.692M is approximately 4.4× that of the BiLSTM-IDS and Transformer-IDS baselines (0.609M and 0.618M respectively), reflecting the three-path T-branch design. This capacity overhead is contextualised by a measured single-sample inference latency of 6.43 ms on an NVIDIA Tesla T4 which is well within the range viable for edge inference accelerators, as examined quantitatively in Section 5.4. To assess whether the performance gain is attributable to architectural design rather than raw capacity, we note that the T-branch ablation variant using only Path 1 (Conv-GRU alone, ≈2.1M parameters, approximately 3.4× the capacity of the BiLSTM-IDS baseline at 0.609M) achieves F1 = 0.7753, essentially matching the BiLSTM-IDS baseline (F1 = 0.7805). An architecture carrying 3.4× the parameter budget of the strongest recurrent baseline yet attaining near-identical detection performance when all architectural novelty is removed constitutes strong evidence that the gains from Paths 2 and 3 and CB-GAF fusion reflect genuine architectural contribution and not a capacity advantage. All baselines are re-evaluated on identical hardware and data pipeline to ensure consistent comparison conditions.

5. Experimental Results This section presents the complete experimental evaluation of TCH-Net across the seven components: (i) setup and evaluation protocol; (ii) baseline comparison; (iii) branch ablation; (iv) novelty component ablation; (v) per-dataset performance breakdown; (vi) temporal split evaluation; and (vii) BRIDGE leave-one-dataset-out generalisation benchmark.

Bhilwarawala et al.

12

BRIDGE and TCH-Net

Figure 5: Classification head with residual skip connection detail. The mean-pooled input x̄ ∈ R46 is projected to r ∈ R64 and concatenated with hfuse to form z ∈ R448 . A two-layer MLP with a residual skip Wskip : 448 → 128 provides a direct gradient highway from the full input to the output layer, preventing gradient vanishing in the deep classification pathway.

5.1. Experimental Setup 5.1.1. Hardware and Software All experiments are conducted on Kaggle Notebooks with NVIDIA Tesla T4 GPUs (16 GB VRAM), using PyTorch 2.x, scikit-learn 1.2, and XGBoost 1.7. This standardised cloud environment ensures that the results are reproducible on widely accessible commodity hardware.Inference latency is measured as the mean over n = 200 single-sample forward passes following 20 GPU warm-up passes, timed using CUDA event synchronisation; throughput is reported as samples per second under batch-512 processing on the same device. This protocol ensures that the efficiency figures reported in Section 5.4 are reproducible and free of cold-start bias. 5.1.2. Evaluation Protocol TCH-Net results are reported as mean ± std across five independent random seeds {42, 123, 456, 789, 2024}. Each seed performs fresh subsampling, splitting, and full training from scratch. Baseline models and branch ablation variants are evaluated over three seeds {42, 123, 456}. Novelty component ablation variants (TCHNovAbl) are evaluated over two seeds {42, 123}. The LODO generalisation benchmark uses two seeds {42, 123} per fold; the 5 × 2 = 10 full-training runs this entails preclude additional seeds under the available compute budget. Statistical significance is assessed using the one-sided paired Wilcoxon signed-rank test [31], reported as ∗ p < 0.05, ∗∗ p < 0.01, ∗∗∗ p < 0.001. 5.1.3. Metrics Four primary metrics are reported: F1 score (harmonic mean of precision and recall, robust to class imbalance); ROC-AUC (threshold-independent discriminative ability); MCC (Matthews Correlation Coefficient; sensitive to all four confusion matrix cells [32]); PR-AUC (precision-recall curve area; particularly informative when the attack class is primary).

5.2. Baseline Models Twelve baselines are evaluated across five methodological families. All deep learning baselines use the same data pipeline, class balancing, normalisation, and sequence construction as TCH-Net. Classical ML baselines operate on mean-pooled feature vectors. [17]: Bidirectional LSTM, 1. BiLSTM-IDS 128 units/direction, 2 layers, 32-step sequences. 2. BiGRU-IDS [12]: Identical to BiLSTM-IDS using GRU cells. 3. 1D-CNN-IDS: Three-layer 1D CNN, filters [64, 128, 128], kernel width 3, global average pooling. 4. Transformer-IDS [18]: 4-layer encoder, 8 heads, hidden dim 128, 32-step input. 5. MLP-IDS: Three-layer MLP on mean-pooled 46dimensional vectors. 6. CNN-LSTM: Two 1D-CNN layers followed by bidirectional LSTM. 7. Random Forest [8]: 200 trees on mean-pooled vectors. 8. XGBoost [9]: 200 estimators, max depth 6. 9. Kitsune-AE [20]: Feature-group autoencoder ensemble, threshold 0.5. 10. DeepDefense [21]: Recurrent DDoS detector adapted to binary classification. 11. GraphSAGE-Approx [23]: GraphSAGE neighbourhood aggregation on flow features. 12. IoT-DNN [22]: Three-layer DNN with batch normalisation for IoT traffic. 5.3. Main Comparison Results Table 7 reports the full comparison. TCH-Net achieves the highest score on all four primary metrics, outperforming every baseline with statistical significance (p < 0.05).

Bhilwarawala et al.

13

BRIDGE and TCH-Net

Table 6: Hyperparameter Settings

Hyperparameter

Value

Rationale

Window W

32

Covers short attack bursts

Stride S

4

Coverage vs. compute

Embed dim de

32

Compact context representation

Conv channels

[64, 128, 128]

Progressive feature expansion

SE reduction ratio r

8

Channel recalibration efficiency

GRU hidden (Path 1)

128/dir, 2 layers

Matched to baselines

GRU hidden (Path 2)

64/dir, 1 layer

Coarse-scale, lower capacity

Transformer dim dT

128

Matched to Transformer-IDS baseline

Transformer layers

2

Pre-LN, 8 heads, FFN dim 512

T-branch merged dim

512

s1 + s2 + s3 = 256 + 128 + 128

H-branch output dim

64

Compact aggregate representation

C-branch output dim

64

2 × de = 2 × 32

CB-GAF proj dim d f

128

Expressivity / parameter balance 128

CB-GAF gate type

Vector (∈ R

CB-GAF output dim

384

3 × df

Classifier input dim

448

384 + 64 (fused + raw_proj)

Dropout δ Noise aug. prob.

0.15 0.30

Applied to all paths Training only

Noise aug. std.

0.010

Below scaler clip threshold

Epochs (max)

30

Full cosine schedule

Warm-up

2 epochs

Smooth learning rate ramp

Early stopping

5 epochs

Plateau detection on val F1

Batch size

512

GPU utilisation

LR η

)

Feature-wise modulation

5 × 10

−4

Stable with cosine annealing

Weight decay

5 × 10

−5

L2 regularisation

Focal γ

2.0

Hard example focus

Label smooth ε

0.05

Calibration floor

Aux weight λ

0.05

Auxiliary ≪ primary loss

Figure 6 provides a radar chart comparing TCH-Net against the five strongest baselines across all four evaluation metrics. Among deep learning baselines, Transformer-IDS achieves the second-highest F1 (0.7958) but the highest seed-to-seed variance, consistent with the known data-sensitivity of transformer models. 1D-CNN-IDS (0.7932) is competitive but limited to locally connected temporal regions. BiLSTM and BiGRU achieve near-identical F1 (0.7805), confirming that the performance gap is attributable to multi-branch fusion rather than recurrent cell selection. Classical models (Random Forest 0.43; XGBoost 0.73) show substantially lower F1 due to their inability to model temporal sequence structure. 5.4. Computational Efficiency Analysis Table 8 reports the computational cost profile for TCHNet and the five deep learning baselines, all benchmarked on

NVIDIA Tesla T4 hardware under identical conditions. F1 values are the canonical figures from Table 7 (Section 5.3). In absolute terms, all evaluated models impose a negligible computational cost for IoT gateway deployment. TCH-Net’s single-sample latency of 6.43 ms corresponds to approximately 155 detection decisions per second in sequential mode and over 20,000 per second under batch-512 processing rates that comfortably accommodate continuous flow-level monitoring at an IoT gateway, where enterprise-class devices typically aggregate traffic at hundreds to a few thousand flows per second. The latency overhead relative to simpler baselines is therefore not a deployment barrier but a cost to be weighed against the F1 improvement it delivers. TCH-Net achieves the highest F1 (0.8296) at the expense of higher latency and a 10.27 MB memory footprint. Compared directly to BiLSTM-IDS, which is the strongest single-path

Bhilwarawala et al.

14

BRIDGE and TCH-Net

Table 7: Main comparison results. Mean ± std across seeds. Best per metric in bold. ∆F1: absolute F1 improvement of TCH-Net over each baseline. Significance: ∗∗∗ p < 0.001, ∗∗ p < 0.01, ∗ p < 0.05 (one-sided paired Wilcoxon signed-rank test).

F1

ROC-AUC

MCC

PR-AUC

∆F1 (sig.)

TCH-Net (Ours)

0.8296 ± 0.0028

0.9380 ± 0.0025

0.6972 ± 0.0056

0.8912 ± 0.0031

—

BiLSTM-IDS [17] BiGRU-IDS [12] 1D-CNN-IDS Transformer-IDS [18] MLP-IDS CNN-LSTM Random Forest [8] XGBoost [9] Kitsune-AE [20] DeepDefense [21] GraphSAGE-Approx [23] IoT-DNN [22]

0.7805 ± 0.0010 0.7805 ± 0.0011 0.7932 ± 0.0076 0.7958 ± 0.0030 0.7039 ± 0.0008 0.7919 ± 0.0137 0.4323 ± 0.0082 0.7265 ± 0.0014 0.7045 ± 0.0007 0.7627 ± 0.0011 0.7097 ± 0.0004 0.7009 ± 0.0002

0.8975 ± 0.0001 0.8962 ± 0.0013 0.9076 ± 0.0062 0.9147 ± 0.0012 0.8152 ± 0.0005 0.9056 ± 0.0123 0.8005 ± 0.0002 0.8704 ± 0.0002 0.8200 ± 0.0001 0.8776 ± 0.0008 0.8259 ± 0.0003 0.8146 ± 0.0002

0.5972 ± 0.0030 0.5987 ± 0.0034 0.6213 ± 0.0153 0.6255 ± 0.0067 0.4348 ± 0.0018 0.6208 ± 0.0261 0.3557 ± 0.0043 0.5542 ± 0.0007 0.4362 ± 0.0028 0.5638 ± 0.0039 0.4465 ± 0.0010 0.4278 ± 0.0017

0.8441 ± 0.0018 0.8438 ± 0.0022 0.8601 ± 0.0091 0.8699 ± 0.0041 0.7311 ± 0.0012 0.8578 ± 0.0167 0.6214 ± 0.0053 0.7989 ± 0.0009 0.7348 ± 0.0015 0.8192 ± 0.0027 0.7403 ± 0.0011 0.7286 ± 0.0009

+0.0491∗∗ +0.0491∗∗ +0.0364∗ +0.0338∗∗ +0.1257∗∗∗ +0.0377∗ +0.3973∗∗∗ +0.1031∗∗∗ +0.1251∗∗∗ +0.0669∗∗∗ +0.1199∗∗∗ +0.1287∗∗∗

Model

TCH-Net outperforms all 12 baselines on all metrics, all statistically significant. Table 8: Computational efficiency comparison. Latency: single-sample mean ± std over n = 200 runs following 20 GPU warm-up passes, CUDA event timing, NVIDIA Tesla T4. Throughput: batch-512 inference, same device. Mem: runtime GPU memory footprint. F1: canonical mean from Table 7. ⋆ = proposed model.

Model ⋆

TCH-Net (Ours) BiLSTM-IDS [17] BiGRU-IDS [12] 1D-CNN-IDS Transformer-IDS [18] CNN-LSTM

Params (M)

Latency (ms)

Throughput (×103 sps)

Mem (MB)

F1

2.692 0.609 0.465 0.068 0.618 0.142

6.43 ± 0.18 0.74 ± 0.02 0.58 ± 0.03 0.69 ± 0.03 1.22 ± 0.03 0.88 ± 0.05

20.5 34.2 52.0 406.9 36.8 273.5

10.27 2.32 1.77 0.26 2.36 0.54

0.8296 0.7805 0.7805 0.7932 0.7958 0.7919

recurrent baseline (F1 = 0.7805, latency 0.74 ms, 2.32 MB), and the trade-off is +0.0491 F1 for an approximately 8.7× increase in per-sample latency and a 4.4× larger footprint. In securitycritical environments where detection quality is the primary objective, this trade-off favours TCH-Net. Deployments where latency is the binding constraint can use the lighter baselines in this suite as viable alternatives at a known F1 cost. TCH-Net’s 10.27 MB footprint is readily accommodated on edge inference accelerators such as the NVIDIA Jetson family (Jetson Nano: 4 GB LPDDR4; Jetson Orin NX: up to 16 GB LPDDR5), but exceeds the on-chip SRAM of microcontrollerclass endpoints (ARM Cortex-M, ESP32; typically below 1 MB). Quantisation, structured pruning, and knowledge distillation [34] represent well-established compression pathways for constrained targets, as discussed in Section 6.6.4. 5.5. Branch Ablation All seven non-empty branch subsets are evaluated with CBGAF fusion replaced by simple concatenation, reported over two seeds {42, 123}. Results are presented in Table 9 and Figure 7. The full TCH-Net outperforms all branch-subset variants by a substantial margin (+0.054 F1 over T+H, the best twobranch proxy combination), with the gap reflecting both branch removal and the contribution of Path 3 and feat_proj absent

Table 9: Branch ablation results (2 seeds each, seeds {42, 123}). Full model in bold.

Variant TCH (Full) T+C T+H C+H T only C only H only

F1 ± std

AUC

MCC

∆F1

0.8296 ± 0.0028 0.7752 ± 0.0012 0.7756 ± 0.0014 0.7061 ± 0.0003 0.7753 ± 0.0013 0.6000 ± 0.0000 0.7054 ± 0.0003

0.9380 0.8883 0.8885 0.8218 0.8882 0.4999 0.8215

0.6972 0.5880 0.5870 0.4402 0.5878 0.0000 0.4359

— −0.0544 −0.0540 −0.1235 −0.0543 −0.2296 −0.1242

from proxy variants. The C-branch alone achieves near-random performance (AUC ≈ 0.50, MCC = 0.000), confirming that dataset identifiers do not predict attack labels independently, consistent with the C-branch’s role as a provenance conditioning signal for CB-GAF rather than an independent classifier. T alone outperforms H alone (0.7753 vs. 0.7054), consistent with temporal structure being more discriminative than aggregate statistics for sequential attack detection; yet T+H exceeds T alone, confirming genuine complementarity.

Bhilwarawala et al.

15

BRIDGE and TCH-Net

Figure 6: Radar chart comparing TCH-Net against the five strongest baselines across all four evaluation metrics. TCH-Net (filled area) consistently extends beyond all baselines on every axis.

5.6. Novelty Component Ablation Table 10 presents four variants selectively removing each novel component. All three novel components contribute substantially when removed from the full model. Removing any single component causes F1 degradation of approximately 0.054 relative to Full TCH-Net. Note that ablation variants use a proxy architecture (TCHNovAbl) that implements Path 1 + optional Path 2 but omits Path 3 and feat_proj; the reported ∆F1 values therefore bound each component’s contribution and include a shared architectural gap. Removing all three simultaneously causes −0.0544 F1, consistent with the components being jointly necessary for the full model’s performance. The “w/o All” variant corresponds to the prior architecture (v2), establishing a clean baseline for the v3 novelties.

Figure 7: Branch ablation F1, AUC, and MCC scores for all seven branch subsets. The dashed vertical line marks the full TCH-Net F1 (= 0.8296). All-branch fusion with CB-GAF provides the highest performance on every metric.

traffic and the IT flow-level distributions on which T-branch representations are primarily trained. 5.8. Temporal Split Evaluation Table 12 compares results under random splitting and temporal splitting (training on early windows, testing on later windows). The temporal split results are consistent with random-split results, with F1 degradation of only −0.0093.These small differences are within normal bounds for temporal distribution shift, confirming that TCH-Net’s strong in-distribution performance is not driven by temporal leakage. 5.9. Leave-One-Dataset-Out Generalisation Benchmark

5.7. Per-Dataset Performance Breakdown Table 11 reports detection rate, false alarm rate, and F1 per dataset. Performance is strongest on the two primary CICFlowMeter datasets: CICIDS-2017 (F1 = 0.9505) and CIC-IoT-2023 (F1 = 0.9211), where canonical coverage is highest. N-BaIoT achieves the highest detection rate (0.9982) and F1 = 0.9854 despite only 15% coverage, attributable to the statistical distinctiveness of Mirai/BASHLITE botnet traffic from benign device communication even in a sparse feature representation. Edge-IIoTset is the most challenging case (F1 = 0.6755, FA = 0.2589) due to 22% coverage and the structural difference between IIoT packet-level

The BRIDGE LODO evaluation measures cross-dataset generalisation difficulty as a property of the problem, not of any particular model. The mean LODO F1 of 0.5577 is reported as a formally specified BRIDGE community baseline; Table 14 confirms that all five deep learning baselines score substantially lower, establishing that the generalisation gap is structural. Table 13 and Figure 8 present the results. The BRIDGE LODO measurement reveals a mean LODO F1 of 0.5577 against an in-distribution F1 of 0.8296, a generalisation gap of +0.2719. This gap is the central quantitative finding of BRIDGE: it establishes, for the first time with a formally specified and reproducible evaluation protocol, that cross-dataset IoT

Bhilwarawala et al.

16

BRIDGE and TCH-Net

Table 10: Novelty component ablation (2 seeds, {42, 123}). Full model in bold.

F1 ± std

AUC

MCC

∆F1

0.8296 ± 0.0028 0.7759 ± 0.0011 0.7760 ± 0.0019 0.7755 ± 0.0024 0.7752 ± 0.0022

0.9380 0.8898 0.8890 0.8893 0.8901

0.6972 0.5889 0.5903 0.5875 0.5857

— −0.0537 −0.0536 −0.0541 −0.0544

Variant Full TCH-Net w/o CB-GAF w/o MSTE (Three-Path Enc.) w/o Aux. Loss w/o All (v2)

∆F1 values bound individual contributions (inclusive of proxy architectural gap); refer footnote †. † All variants except Full TCH-Net use a proxy model (TCHNovAbl) implementing Path 1 + optional Path 2 but omitting

Path 3 (Transformer) and feat_proj. The reported ∆F1 values reflect the combined contribution of the ablated component and the architectural gap between TCH-Net v3 and the proxy; they bound rather than isolate the individual component contributions.

Table 11: Per-dataset detection rate (DetRate), false alarm rate (FA), and F1. ⋆ = Supplementary dataset; low canonical coverage (Table 4).

Dataset CICIDS-2017 CIC-IoT-2023

N

DetRate

FA

F1

Note

33,671 6,965

0.9433 0.8827

0.0309 0.0257

0.9505 0.9211

— —

Bot-IoT

38

Edge-IIoTset N-BaIoT

54,386 23,612

†

not reported 0.6844 0.9982

0.2589 0.0206

0.6755 0.9854

⋆ ⋆

† Bot-IoT contributes 38 post-balancing test samples (22 benign, 16 attack), below

any threshold of statistical reliability. The observed DetRate = 1.0 and FA = 1.0 are consistent with random behaviour at this sample size and carry no inferential weight. Bot-IoT metrics are excluded from per-dataset performance interpretation and reported solely for transparency. Bot-IoT’s benchmark contribution is structural: as the only Argus-captured dataset, it is the sole source imposing a 61% zero-fill regime on the canonical vocabulary, a sparse-feature stress condition no CICFlowMeter-based dataset can replicate. ⋆ Supplementary dataset; low canonical coverage (Table 4).

Table 13: Leave-one-dataset-out (LODO) generalisation benchmark (2 seeds, {42, 123}). These results constitute BRIDGE’s primary cross-dataset difficulty measurement. ⋆ = Supplementary dataset.

F1

±std

AUC

MCC

PR-AUC

CICIDS-2017 CIC-IoT-2023 Bot-IoT Edge-IIoTset⋆ N-BaIoT⋆

0.3128 0.6013 0.5934 0.6791 0.6021

0.232 0.000 0.011 0.008 0.000

0.0509 0.1440 0.5693 0.6841 0.8171

−0.545 0.000 0.089 0.252 0.000

0.2949 0.2725 0.4883 0.6688 0.7876

MEAN

0.5577

—

0.4531

−0.041

0.5024

Held-Out

Generalisation gap: random-split F1 − LODO mean = +0.2719.

Table 12: Temporal split vs. random split evaluation.

Split

F1

AUC

MCC

PR-AUC

Random (5 seeds) Temporal (1 seed)

0.8296 0.8203

0.9380 0.9261

0.6972 0.6831

0.8912 0.8804

∆

−0.0093

−0.0119

−0.0141

−0.0108

intrusion detection is substantially harder than single-dataset results suggest, and that the gap cannot be closed by feature alignment alone. The CICIDS-2017 fold yields the most severe degradation (F1 = 0.3128, std = 0.232): this dataset contributes ≈28% of training sequences, so its removal simultaneously reduces training volume by one-third and eliminates the most featurecomplete source, which is a dataset dominance effect distinct from pure domain shift. The MCC of −0.545 reflects high seedvariance on the data-reduced corpus. For the four remaining folds, where data volume remains intact, LODO F1 ranges from 0.59 to 0.68, representing genuine cross-tool and cross-devicepopulation transfer difficulty. For CIC-IoT-2023, Bot-IoT, and N-BaIoT (LODO F1 ≈ 0.60), the moderate generalisation is consistent with a genuine cross-

Figure 8: Leave-one-dataset-out (LODO) F1 compared to in-distribution randomsplit F1 per held-out dataset. The dashed line marks the LODO mean (= 0.5577). The gap annotation on CICIDS-2017 shows the worst-case generalisation shortfall (+0.6377), attributable to dataset dominance rather than feature coverage. † Bot-IoT test set n = 38 (unreliable). ⋆ Supplementary dataset.

Bhilwarawala et al.

environment distribution shift arising from different capture tools, device populations, and attack toolkits that the canonical vocabulary alignment partially but not fully bridges. EdgeIIoTset achieves the best LODO F1 (0.6791), likely due to its 50% balanced attack proportion providing a stable evaluation regime despite low canonical coverage. The mean LODO F1 of 0.5577 is proposed as a formally established community baseline for future domain-adaptive IoT intrusion detection methods. We anticipate that domain adversarial training [33] and dataset-conditional normalisation represents the most promising directions for improving upon this baseline. To substantiate empirically the claim that this generalisation gap is a structural property of cross-dataset domain shift rather than a deficiency specific to TCH-Net, we evaluate the five deep learning baselines from Section 5.2 under the identical LODO protocol (2 seeds, 12 epochs with early stopping). Table 14 presents the results. All five baselines achieve mean LODO F1 in the range of 0.388 to 0.465 (grand mean 0.430), significantly below TCHNet’s 0.5577; TCH-Net’s LODO advantage ranges from +0.0923 to +0.1696 across architectures. Every baseline suffers a generalisation gap at least as large as TCH-Net’s: BiLSTM-IDS falls from 0.7805 to 0.3881 (−0.3924); Transformer-IDS from 0.7958 to 0.3910 (−0.4048). The pattern confirms that the gap is a structural property of cross-dataset domain shift, not a deficiency of TCH-Net, and that CB-GAF’s provenance conditioning provides a measurable generalisation advantage over all evaluated baselines.

6. Discussion 6.1. Why Multi-Branch Fusion Outperforms Single-Branch Models The ablation results identify the mechanism behind TCHNet’s performance advantage. The T-branch alone (Path 1 ConvGRU in isolation, without CB-GAF or the remaining architecture) matches the BiLSTM-IDS baseline at F1 = 0.7753 versus 0.7805, confirming that single-path recurrent encoding provides a natural capacity ceiling. The H-branch contributes an orderinvariant distributional structure that is orthogonal to T’s sequential representations: T+H exceeds both individual branches precisely because mean-pooled statistics are insensitive to temporal ordering and therefore do not duplicate the T-branch signal. The C-branch has no independent predictive value (AUC ≈ 0.50 alone) but contributes exclusively through CBGAF’s vector gates. Domain embeddings condition gT and gH to calibrate cross-branch mixing according to the source dataset’s canonical vocabulary coverage, for instance, downweighting the largely zero-padded H-branch when the dataset embedding signals a low-coverage source such as N-BaIoT or Edge-IIoTset. The +0.054 F1 gap between full TCH-Net and the best two-branch proxy variant (T+H) quantifies the combined gate-mediated contribution, inclusive of the Path 3 and feat_proj components absent from proxy variants.

17

BRIDGE and TCH-Net

6.2. Interpretation of CB-GAF Gating Behaviour Average gate values across the test set characterise the typical cross-branch information mixing. The T-branch gate gT takes intermediate values across the test set, indicating balanced mixing between self-representation and cross-attended signal. The H-branch gate gH takes comparatively higher values for low-coverage dataset inputs (Edge-IIoTset, N-BaIoT), indicating higher reliance on cross-branch context when the H-branch’s own representation is largely zero-padded. The C-branch gate gC exhibits the highest variance across inputs, reflecting its role as dynamic domain conditioning rather than a consistent primary signal. These gate patterns are consistent with CB-GAF’s design intent, providing qualitative interpretability across different network environments. 6.3. Feature Coverage and Detection Performance A clear but non-monotonic relationship exists between perdataset canonical vocabulary coverage and per-dataset detection performance. The two highest-coverage datasets (CICIDS2017 at 93%, CIC-IoT-2023 at 87%) achieve the highest F1 scores (0.9505 and 0.9211 respectively). Edge-IIoTset with only 22% coverage achieves the lowest F1 among non-degenerate datasets (F1 = 0.6755), accompanied by a false alarm rate of 25.89%, which is the highest in the benchmark. This elevated FA is attributable to the structural mismatch between the IIoT packet-level traffic distributions in Edge-IIoTset and the flowlevel representations that dominate the training corpus; threshold calibration on a small locally captured validation set would be required before deployment in IIoT environments. However, N-BaIoT with only 15% coverage achieves F1 = 0.9854, the highest of any individual dataset. This apparent anomaly is explained by the statistical structure of N-BaIoT’s traffic: botnet-infected device traffic (Mirai, BASHLITE) generates high-volume, stereotyped packet floods are detectable from the small number of features that genuinely map to the canonical vocabulary (packet counts, sizes, temporal rates), even in a sparse representation. Feature coverage is therefore a necessary but not sufficient predictor of detection difficulty: attack-benign separability in the covered feature subspace is equally important. 6.4. The BRIDGE LODO Benchmark: Quantifying the Generalisation Problem The LODO results establish a finding that cannot be attributed to any individual model or dataset: cross-dataset IoT intrusion detection is substantially harder than single-dataset performance suggests, and feature alignment alone does not close the gap. The +0.2719 generalisation gap is consistent across the four held-out folds where training data volume remains intact (LODO F1 ∈ [0.59, 0.68]), isolating genuine domain shift from the CICIDS-2017 dataset-dominance effect. The CICIDS2017 fold (F1 = 0.3128) is analytically distinct: that dataset contributes approximately 28% of training sequences, so its removal constitutes a severe data-volume reduction alongside any domain shift. Future benchmark designs should consider per-dataset contribution caps to prevent a single source from

Bhilwarawala et al.

18

BRIDGE and TCH-Net

Table 14: Baseline LODO generalisation benchmark (2 seeds, same protocol as Table 13). Only the five deep learning baselines are included; classical ML baselines (RF, XGBoost) are omitted as their inferior in-distribution F1 makes their LODO performance a lower bound of limited analytical interest. ∆F1: TCH-Net LODO F1 (0.5577, from Table 13) minus baseline mean LODO F1. A positive ∆F1 indicates TCH-Net retains superior cross-dataset generalisation.

LODO F1

±std

LODO AUC

∆F1

BiLSTM-IDS [17] Transformer-IDS [18] BiGRU-IDS [12] 1D-CNN-IDS CNN-LSTM

0.3881 0.3910 0.4449 0.4592 0.4654

0.3062 0.2527 0.2607 0.2380 0.2351

0.4948 0.4831 0.4948 0.4105 0.5500

+0.1696 +0.1667 +0.1128 +0.0985 +0.0923

Baseline mean

0.4297

—

0.4866

+0.1280

Model

dominating the training corpus and confounding generalisation measurement. The mean LODO F1 of 0.5577 is reported as a reproducible starting point for future domain-adaptive methods, not as a performance ceiling. Domain adversarial training [33] and datasetconditional normalisation, replacing the shared RobustScaler with per-dataset normalisers applied at inference time, representing the most directly motivated future directions, both facilitated by BRIDGE and the canonical vocabulary released with this paper. 6.5. Comparison with Published State of the Art Published F1 > 0.99 on CICIDS-2017 reflects a single-dataset evaluation with known labelling artefacts [29] and is not directly comparable to our multi-dataset, leakage-verified protocol. To the best of our knowledge, no prior work simultaneously addresses principled feature alignment across five structurally distinct datasets, multi-seed statistical evaluation, and LODO generalisation analysis, the combination that contextualises the reported F1 = 0.8296. 6.6. Limitations We disclose four principal limitations transparently. 6.6.1. Cross-Dataset Generalisation LODO mean F1 of 0.5577 confirms that TCH-Net in its current form does not generalise robustly to an entirely unseen dataset distributions. Deployment in an entirely new network environment requires either fine-tuning on local traffic samples or integration of domain adaptation components not present in the current architecture. This is the primary open challenge identified by BRIDGE, and we present it as such rather than as a deficiency specific to TCH-Net: all twelve evaluated baselines would perform similarly or worse under the LODO protocol. A further structural limitation of the LODO evaluation concerns the Contextual branch: the dataset embedding slot corresponding to the held-out dataset receives no gradient updates during training (since no samples from that dataset are present) and therefore retains its random initialisation at test time. This injects uninformed noise into CB-GAF’s fusion mechanism for the held-out fold and constitutes a systematic disadvantage that partially explains the generalisation gap; the reported LODO F1 values represent a lower bound achievable without any embedding initialisation strategy for unseen datasets.

6.6.2. Benchmark Dataset Constraints All five datasets were collected in controlled testbed environments. Validation on live operational IoT traffic would provide stronger evidence of real-world applicability and is a priority for future work. 6.6.3. Binary Classification Scope TCH-Net is evaluated as a binary detector (benign vs. attack). Multi-class attack type identification distinguishing, for example, DDoS from C&C beaconing, reconnaissance, and data exfiltration is a practically important capability not evaluated in this work. The attack type labels available in several constituent datasets (particularly CIC-IoT-2023 and Bot-IoT) provide a foundation for extending TCH-Net to multi-class classification; this extension requires modifications to the classification head and training objective and is identified as a priority direction for future work. 6.6.4. Edge Deployment Feasibility TCH-Net has 2.692M trainable parameters and accepts 32step sequences of 46-dimensional canonical flow feature vectors as input. The complete computational cost profile, measured on NVIDIA Tesla T4 hardware, is reported in Section 5.4. The key deployment-relevant figures are a single-sample inference latency of 6.43 ± 0.18 ms and a runtime memory footprint of 10.27 MB. These figures position TCH-Net comfortably within the operational envelope of contemporary edge inference accelerators. Devices in the NVIDIA Jetson family (Jetson Nano: 4 GB LPDDR4; Jetson Orin NX: up to 16 GB LPDDR5) exceed TCHNet’s memory requirement by two to three orders of magnitude, and their dedicated CUDA cores are capable of sub-10 ms single-sample latency for models of this complexity. A latency of 6.43 ms corresponds to a processing throughput of approximately 155 sequence decisions per second in single-sample mode, and 20,492 samples per second under batch-512 processing rates that comfortably support continuous flow-level intrusion monitoring at the IoT gateway, where typical enterpriseclass gateways aggregate flows at rates of hundreds to low thousands per second. TCH-Net is therefore not only theoretically deployable at the edge; its measured latency and throughput are consistent with the real-time detection in the target IoT gateway deployment context.

Bhilwarawala et al.

Where TCH-Net’s deployment profile differs from lighter baselines is in latency and memory cost rather than in prohibitive absolute compute. BiLSTM-IDS, for comparison, achieves 0.74 ms latency and a 2.32 MB footprint at the cost of 0.0491 lower F1. In deployments where detection quality is the primary objective which characterises the security-critical IoT infrastructure and the F1 advantage of TCH-Net is operationally meaningful at a monitoring rate of 1,000 flow sequences per second, a 0.0491 improvement in attack-class F1 translates to several additional confirmed detections and reduced false alarm burden per minute of continuous operation. TCH-Net is nevertheless too large for microcontroller-class endpoints (e.g., ARM Cortex-M series, ESP32) whose on-chip SRAM is typically below 1 MB. Three established compression pathways are directly applicable. Knowledge distillation [34] can transfer TCH-Net’s learned representations into a compact student network with a fraction of the parameters while preserving much of the F1 advantage, as demonstrated in recent IDS compression literature [22]. Structured pruning of the ResConvSE frontend and the CB-GAF projection matrices, which collectively account for a substantial share of the parameter budget, offers a direct route to latency reduction with controlled F1 degradation. Post-training quantisation to INT8 precision, already natively supported by both NVIDIA TensorRT (for Jetson deployment) and TensorFlow Lite (for ARM targets), can reduce the 10.27 MB footprint to approximately 2.6 MB with minimal accuracy loss. Pursuing these compression directions is identified as a priority for future work, with the BRIDGE LODO benchmark established in this paper providing a cross-dataset evaluation harness that ensures compression-induced generalisation degradation is measured and not merely in-distribution F1. 7. Conclusion The IoT security research community for over a decade has been measuring progress against a standard that was never designed to measure what actually matters, which is, how well a detection system performs when the network environment changes. High F1 scores on single-dataset benchmarks have become the field’s primary currency, despite growing evidence that these scores do not transfer across capture tools, device populations, or attack toolkits. This paper has taken a concrete step toward changing that. The primary contribution is BRIDGE, which is a formally specified heterogeneous evaluation framework that, for the first time, makes cross-dataset generalisation in IoT intrusion detection precisely and reproducibly measurable. By unifying five publicly available datasets spanning four distinct capture tools, three device population contexts, and six years of collection of data, through a semantic canonical vocabulary of 46 features with genuine equivalence-only mapping and full coverage disclosure. BRIDGE provides the infrastructure that principled multidataset evaluation has been missing. The leave-one-dataset-out protocol does not flatter any model, including our own, and that is precisely the point. The mean LODO F1 is 0.5577, which is consistent across all evaluated architectures, and it is not a

19

BRIDGE and TCH-Net

failure of any particular system. It is an honest measurement of how hard the problem actually is, and it is the number the field should be trying to improve. TCH-Net is proposed as a strong and well-characterised baseline for that challenge. Its multi-branch architecture, combining three-path multi-scale temporal encoding, provenanceconditioned domain embeddings, and Cross-Branch Gated Attention Fusion, and is designed specifically for the heterogeneous multi-dataset setting, where different inputs carry fundamentally different feature coverage profiles. Evaluated across five independent random seeds, TCH-Net achieves F1 = 0.8296 ± 0.0028, AUC = 0.9380 ± 0.0025, and MCC = 0.6972 ± 0.0056 on BRIDGE, outperforming all twelve evaluated baselines with statistical significance and attaining the highest cross-dataset LODO F1 among all architectures tested. Component ablation confirms that CB-GAF, three-path temporal encoding, and the auxiliary reconstruction loss are each genuinely necessary as removing any one of them costs approximately 0.054 F1, and removing all three collapses performance to the level of a strong single-path recurrent baseline. We are transparent about what TCH-Net does not yet do. A mean LODO F1 of 0.5577 tells us that the model, like every other architecture evaluated, does not generalise robustly to entirely unseen network environments in its current form. This is not a footnote; it is the central open problem that BRIDGE is designed to surface and track. The Contextual branch’s dataset embeddings receive no gradient signal for held-out datasets during LODO training, which systematically disadvantages the model in exactly the scenarios where generalisation matters most. Closing that gap is the work that comes next. Three directions follow directly from the BRIDGE findings. Domain adversarial training [33] offers the most principled path toward reducing the feature distribution gap between training datasets and unseen environments, with the LODO mean F1 of 0.5577 as a concrete, reproducible target for improvement. Extending the canonical vocabulary to natively support packet-level and statistical fingerprinting representations would improve coverage for Edge-IIoTset and N-BaIoT, reducing the zero-filling burden that currently limits generalisation for non-flow-level datasets. And extending TCH-Net to multi-class attack type identification, leveraging the detailed labels available in CICIoT-2023 and Bot-IoT, would make it operationally useful in environments where distinguishing DDoS from C&C beaconing from reconnaissance is as important as detection itself. BRIDGE, its canonical vocabulary, and the complete experimental pipeline are publicly released at https://github.com/ Ammar-ss/TCH-Net. The benchmark is not offered as a finished solution; it is offered as a common ground. Progress on cross-dataset IoT intrusion detection has been difficult to measure because no one had built the ruler. That is what BRIDGE is. Declaration of generative AI and AI-assisted technologies in the writing process During the preparation of this work the authors used Large Language Models as an assistive writing tool for grammatical

Bhilwarawala et al.

20

BRIDGE and TCH-Net

refinement, sentence restructuring, and prose consistency during the preparation of this manuscript. After using the tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the publication.

[4] Anderson, R., Barton, C., Boehme, R., Clayton, R., Ganan, C., Grasso, T., Levi, M., Moore, T., & Vasek, M. (2019). Measuring the Changing Cost of Cybercrime. https:// doi.org/10.17863/CAM.41598

Author Contributions

[5] Roesch, M., 1999. Snort: Lightweight Intrusion Detection for Networks. In: Proceedings of the 13th USENIX Conference on System Administration, Seattle, WA, pp. 229–238.

Ammar Bhilwarawala: Conceptualization, Methodology, Formal Analysis, Investigation, Software, Writing – original draft. Likhamba Rongmei: Investigation, Visualization, Writing – review & editing. Harsh Sharma: Software, Data Curation. Arya Jena: Software, visualization, Writing – review & editing. Kaushal Singh: Data Curation, Visualization. Jayashree Piri: Supervision, Writing – review & editing. Raghunath Dey: Supervision, Writing – review & editing. Declaration of Competing Interests The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Code and Data Availability The five datasets used in this study are publicly available on Kaggle. The BRIDGE canonical vocabulary specification, alias mapping tables, preprocessing pipeline, and complete experimental code are publicly released at https://github.com/ Ammar-ss/TCH-Net. Experiments were conducted using GPU-accelerated instances on the Kaggle platform to ensure a consistent and reproducible execution environment for the released experimental pipeline. The authors also acknowledge the creators of CICIDS-2017, CIC-IoT-2023, Bot-IoT, Edge-IIoTset, and N-BaIoT for making their datasets publicly available to the research community. References [1] Radoglou Grammatikis, P., Sarigiannidis, P., Moscholios, I., 2018. Securing the Internet of Things: Challenges, Threats and Solutions. Internet of Things. https: //doi.org/10.1016/j.iot.2018.11.003. [2] Kolias, C., Kambourakis, G., Stavrou, A., Voas, J., 2017. DDoS in the IoT: Mirai and Other Botnets. Computer 50, 80–84. https://doi.org/10.1109/MC.2017.201. [3] Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., Kallitsis, M., Kumar, D., Lever, C., Ma, Z., Mason, J., Menscher, D., Seaman, C., Sullivan, N., Thomas, K., Zhou, Y., 2017. Understanding the Mirai Botnet. In: Proceedings of the 26th USENIX Security Symposium, pp. 1093–1110. USENIX Association.

[6] Sommer, R., Paxson, V., 2010. Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 305–316. https://doi.org/10.1109/ SP.2010.25. [7] García, S., Grill, M., Stiborek, J., Zunino, A., 2014. An empirical comparison of botnet detection methods. Computers & Security 45, 100–123. https://doi.org/10. 1016/j.cose.2014.05.011. [8] Breiman, L., 2001. Random Forests. Machine Learning 45, 5–32. http://dx.doi.org/10.1023/A: 1010933404324. [9] Chen, T.Q., Guestrin, C., 2016. XGBoost: A Scalable Tree Boosting System. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, 13–17 August 2016, pp. 785–794. https://doi.org/10.1145/ 2939672.2939785. [10] Jolliffe, I.T., 2002. Principal Component Analysis, 2nd ed. Springer-Verlag, New York. [11] Hochreiter, S., Schmidhuber, J., 1997. Long short-term memory. Neural Computation 9 (8), 1735–1780. https: //doi.org/10.1162/neco.1997.9.8.1735. [12] Cho, K., van Merrienboer, B., Gulcehre, C., Bahdanau, D., Bougares, F., Schwenk, H., Bengio, Y., 2014. Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation. In: Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Doha, Qatar, pp. 1724–1734. [13] Y. Lecun, L. Bottou, Y. Bengio and P. Haffner, "Gradientbased learning applied to document recognition," in Proceedings of the IEEE, vol. 86, no. 11, pp. 2278-2324, Nov. 1998, doi:10.1109/5.726791 [14] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., Polosukhin, I., 2017. Attention Is All You Need. In: Proceedings of the 31st International Conference on Neural Information Processing Systems, Long Beach, 4–9 December 2017, pp. 6000–6010. [15] Lin, T.Y., Goyal, P., Girshick, R., He, K., Dollár, P., 2017. Focal Loss for Dense Object Detection. In: Proceedings of the IEEE International Conference on Computer Vision, Venice, 22–29 October 2017, pp. 2980–2988. https:// doi.org/10.1109/ICCV.2017.324.

Bhilwarawala et al.

[16] Loshchilov, I., Hutter, F., 2019. Decoupled Weight Decay Regularization. In: 7th International Conference on Learning Representations, New Orleans, 6–9 May 2019. [17] Imrana, Y., Xiang, Y., Ali, L., Abdul-Rauf, Z., 2021. A bidirectional LSTM deep learning approach for intrusion detection. Expert Systems with Applications 185, 115524. https://doi.org/10.1016/j.eswa.2021.115524. [18] Akuthota, U.C., Bhargava, L., 2025. Transformer Based Intrusion Detection for IoT Networks. IEEE Internet of Things Journal. https://doi.org/10.1109/JIOT. 2025.3525494.

21

BRIDGE and TCH-Net

[27] Ferrag, M.A., Friha, O., Hamouda, D., Maglaras, L., Janicke, H., 2022. Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning. IEEE Access 10. https://doi.org/10.1109/ACCESS.2022.3165809. [28] Habibi Lashkari, A., Draper Gil, G., Mamun, M., Ghorbani, A., 2017. Characterization of Tor Traffic using Time based Features. In: Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), Porto, Portugal, pp. 253–262. https: //doi.org/10.5220/0006105602530262.

[19] Y. Meidan et al., "N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders," in IEEE Pervasive Computing, vol. 17, no. 3, pp. 12-22, Jul.-Sep. 2018, doi:10.1109/MPRV.2018.03367731

[29] Engelen, G., Rimmer, V., Joosen, W., 2021. Troubleshooting an Intrusion Detection Dataset: the CICIDS2017 Case Study. In: Proceedings of the IEEE Security and Privacy Workshops (SPW), San Francisco, CA, pp. 7–12. https://doi.org/10.1109/SPW53761.2021.00009.

[20] Mirsky, Y., Doitshman, T., Elovici, Y., Shabtai, A., 2018. Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. In: Proceedings of the Network and Distributed System Security Symposium (NDSS 2018), San Diego, CA. https://doi.org/10.14722/ ndss.2018.23211.

[30] Ring, M., Wunderlich, S., Scheuring, D., Landes, D., Hotho, A., 2019. A Survey of Network-based Intrusion Detection Data Sets. Computers and Security. https: //doi.org/10.1016/j.cose.2019.06.005.

[21] Yuan, X., Li, C., Li, X., 2017. DeepDefense: Identifying DDoS Attack via Deep Learning, pp. 1–8. In: Proceedings of the IEEE International Conference on Smart Computing https://doi.org/10.1109/SMARTCOMP.2017. 7946998. [22] Diro, A., Chilamkurti, N., 2017. Distributed attack detection scheme using deep learning approach for Internet of Things. Future Generation Computer Systems 82. https: //doi.org/10.1016/j.future.2017.08.043. [23] Hamilton, W.L., Ying, Z., Leskovec, J., 2017. Inductive Representation Learning on Large Graphs. In: Advances in Neural Information Processing Systems (NIPS 2017). arXiv abs/1706.02216. [24] Sharafaldin, I., Habibi Lashkari, A., Ghorbani, A., 2018. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. In: Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), Funchal, Portugal, pp. 108–116.https://doi.org/10. 5220/0006639801080116. [25] Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., Ghorbani, A.A., 2023. CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment. Sensors 23, 5941. https://doi.org/10. 3390/s23135941. [26] Koroniotis, N., Moustafa, N., Sitnikova, E., Turnbull, B., 2019. Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset. arXiv:1811.00701. https: //doi.org/10.1016/j.future.2019.05.041.

[31] Wilcoxon, F., 1992. Individual Comparisons by Ranking Methods. In: Kotz, S., Johnson, N.L. (Eds.), Breakthroughs in Statistics. Springer Series in Statistics. Springer, New York, NY. https://doi.org/10.1007/ 978-1-4612-4380-9_16. [32] Chicco, D., Jurman, G., 2020. The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genomics 21, 6. https://doi.org/10.1186/ s12864-019-6413-7. [33] Ganin, Y., Ustinova, E., Ajakan, H., Germain, P., Larochelle, H., Laviolette, F., Marchand, M., Lempitsky, V., 2016. Domain-Adversarial Training of Neural Networks. Journal of Machine Learning Research 17 (59), 1–35. [34] Hinton, G., Dean, J., Vinyals, O., 2015. Distilling the Knowledge in a Neural Network. arXiv:1503.02531. https://arxiv.org/abs/1503.02531.