An Adversarial Zero-Shot Learning Approach for Anomaly Detection in Multivariate IoT Traffic Data

An Adversarial Zero-Shot Learning Approach for Anomaly Detection in Multivariate IoT Traffic Data⋆ Mahshid Rezakhania,1 , Tolunay Seyfia,∗,1 and Fatemeh Afghaha

arXiv:2609.03505v1 [cs.LG] 3 Sep 2026

a Holcombe Department of Electrical and Computer Engineering, Clemson University, Clemson, 29634 SC, USA

ARTICLE INFO

ABSTRACT

Keywords: Zero-Shot Learning IoT Anomaly Detection Domain Adaptation Variational Autoencoder Contrastive Learning Multivariate Time-Series Adversarial Representation Learning

Anomaly detection in Internet of Things (IoT) networks presents unique challenges due to the diversity of devices, lack of labeled data, and domain variability across environments. In this paper, we propose a novel framework for multivariate time-series anomaly detection that leverages adversarial learning and contrastive loss within a sequence-based Variational Autoencoder (VAE) architecture. Our method enables zero-shot domain adaptation by jointly optimizing domain-invariant latent representations and semantically structured embedding spaces, without requiring labeled data or raw feature transfer. To address the heterogeneity of IoT deployments, we introduce encoder and decoder adaptor layers that align feature distributions across domains while preserving contextual semantics. Additionally, we propose a destination-based segmentation strategy to better model real-world communication structures in IoT traffic. Our framework is comprehensively evaluated on six distinct datasets spanning industrial, enterprise, general-purpose, smart home, and military automation domains across 44 transfer scenarios. Experimental results demonstrate strong zero-shot generalization in several cross-domain settings and competitive performance against a contrastive domain-adaptation baseline under realistic, heterogeneous, and privacy-constrained IoT conditions.

1. Introduction The rapid proliferation of Internet of Things (IoT) devices across industrial, urban, and defense infrastructures has heightened the risk of operational failures and security breaches. Anomaly detection (AD) in IoT networks is therefore a critical capability: it enables the timely identification of hardware malfunctions, communication disruptions, and malicious cyber-attacks by recognizing deviations from expected traffic patterns [1, 2]. From a security perspective, anomalies map directly to common network attacks such as scanning, denial-of-service (DoS), botnet propagation, and brute-force intrusions. From a reliability perspective, they also capture system-level degradations such as abnormal packet loss or irregular latency surges that signal hardware or connectivity failures [1]. A large fraction of these anomalies can be inferred directly from flow-level network data, where each flow aggregates packets sharing source, destination, and protocol attributes. Network-level anomaly detection thus provides visibility into a diverse set of attack classes. Reconnaissance attacks such as port and vulnerability scans manifest as repetitive short flows; volumetric floods (UDP, DNS, ICMP) appear as sustained high-throughput flows with abnormal temporal correlations; and stealthy application-layer attacks like Slowloris exhibit long-duration but low-rate deviations. By analyzing traffic at this granularity, AD models can detect both acute, short-term disruptions and gradually evolving threats [3, 1]. ⋆

This material is based upon work supported by the National Science Foundation under Grant Numbers CNS- 2318726, and CNS-2232048. ∗ Corresponding author. mrezakh@clemson.edu (M. Rezakhani); tseyfi@clemson.edu (T. Seyfi); fafghah@clemson.edu (F. Afghah) ORCID (s): 1 These authors contributed equally to this work.

Rezakhani et al.: Preprint submitted to Elsevier

While anomaly detection has been widely studied in other cyber–physical domains, IoT environments introduce distinctive challenges. IoT traffic is inherently heterogeneous—devices differ in computational capabilities, communication protocols, and sampling rates—yielding highly multivariate traffic, variable sequence lengths, and irregular sampling intervals [4]. In addition, IoT deployments are distributed across diverse environments (e.g., smart grids, medical sensors, military automation), which produces severe domain shift when models trained on one setting are applied to another [5]. Finally, the scarcity of labeled anomalies in IoT networks makes purely supervised approaches impractical [2, 4]. Machine learning–based AD has emerged as a natural solution, modeling complex nonlinear dependencies without heavy feature engineering [1]. Within this space, two dominant paradigms exist: reconstruction-based methods (e.g., autoencoders) that flag large reconstruction errors, and prediction-based methods that flag large forecasting residuals; both exploit temporal correlations in multivariate traffic [4]. Recent time-series work also leverages contrastive objectives to improve representation quality for downstream detection [6]. Among these, sequence models such as LSTM-based autoencoders capture both short- and long-range temporal dependencies, and Variational Autoencoders (VAEs) extend this framework by probabilistically modeling latent spaces to improve generalization in unsupervised settings [7]. Despite these advantages, commonly used VAE-based approaches in IoT still face two critical limitations: (i) many assume fixed-length input sequences, limiting robustness to realworld traffic variability, and (ii) they often lack mechanisms to transfer knowledge across heterogeneous domains without retraining on target data [4, 5]. Page 1 of 12

Adversarial Zero-Shot IoT Anomaly Detection

Effective AD in IoT networks therefore requires models that can (a) accept variable-length flows to capture both rapid and gradual deviations, (b) remain robust under domain shift without fine-tuning on new data, and (c) operate in zero-shot conditions without access to labeled target samples [4, 5, 2]. Few existing approaches simultaneously address these requirements; contrastive learning and domain adaptation are promising ingredients but are rarely combined with strict zero-shot constraints in flow-based IoT settings [6, 5]. To fill this gap, we propose a zero-shot anomaly detection framework that integrates adversarial domain adaptation and contrastive representation learning into a sequencedriven LSTM–VAE architecture. Our method enforces domaininvariant latent representations while structuring the latent space to capture semantic relationships between flows. Unlike prior work, it supports variable-length sequences and generalizes to unseen domains without requiring raw data, labels, or retraining, making it suitable for dynamic, privacysensitive, and continually evolving IoT ecosystems.

2. Related Work 2.1. Supervised and Semi-Supervised AD Label-rich models generally achieve strong in-domain accuracy but require continuous annotation and re-labeling as traffic evolves. ST-VAE [8] combines spatiotemporal VAE encoding with supervised contrastive learning and entropyaware sampling to mitigate concept drift; however, its reliance on labeled feedback limits deployment in label-scarce environments. Transformer-based detectors such as SwinIoT [9] tailor hierarchical vision Transformers and SLAA modules to structured visual inputs at the edge, yet the specialization to vision signals constrains applicability to general multivariate telemetry. Classical supervised pipelines (e.g., TF–IDF over system calls [10]) offer interpretability and low cost but lack temporal modeling and do not transfer across unseen domains. SDN-integrated policies [11] optimize network-layer behavior with tight control loops, but policy coupling hampers portability to heterogeneous infrastructures.

2.2. Unsupervised AD Unsupervised approaches remove the label dependency but still struggle with domain shift. DUDetector [12] combines Transformer modules and dual-resolution autoencoding for fine-grained segmentation, at the expense of higher compute budgets. EvoAAE [13] augments adversarial training with PSO-driven architecture search, but training stability can be fragile. Graph-based models such as DPGLAD [14] exploit dynamic diffusion over evolving topologies, yet require domain-specific graph construction and extensive feature engineering. Lightweight statistical detectors (e.g., moment-based features [15]) are efficient but typically lack the representational capacity for heterogeneous IoT domains. Platform-bound pipelines like MindFlow [16] (CNN+BiLSTM on NF-BoT-IoT) highlight temporal modeling benefits but limit portability across Rezakhani et al.: Preprint submitted to Elsevier

toolchains and protocols. Federated variants [17, 18] improve privacy via decentralized training, though they often depend on synchronized participation and sensitive hyperparameters; practical deployments face stragglers and non-IID data issues.

2.3. Few-/Zero-Shot AD and Domain Shift Without Retraining A growing line of work targets adaptation with few or no labels in the target domain. Typical strategies rely on (i) metric learning (contrastive/triplet) to shape a semantically meaningful latent space, and (ii) domain alignment (adversarial or discrepancy-based) to encourage invariance. However, many methods still fine-tune on target data (even unlabeled), which weakens the zero-shot guarantee and adds operational complexity. Our framework is designed for strict zero-shot inference on the target domain: the final phase computes no loss on target data and requires no targetside retraining, while contrastive and adversarial objectives (learned on source/auxiliary domains) yield a latent geometry that generalizes across domains.

2.4. Positioning and Distinctions Key differentiators of our approach relative to prior work: • Fully unsupervised source-side training with strict zero-shot target inference: No labels are required from source or target, and the final phase performs decisions without any target loss or fine-tuning. • Dual latent alignment: A combination of contrastive learning (semantic structuring) and adversarial domain alignment (invariance) produces transferrable representations under domain shift. • No handcrafted features or graph construction: The method is protocol-agnostic and avoids bespoke feature engineering or topology building. • Privacy-aware operation: No raw feature transfer from target sites is required; the model transfers solely via learned parameters trained on source/auxiliary domains.

2.5. Comparison With Representative Methods To highlight axes that matter in deployment, Table 1 compares representative works along: supervision level, data modality (multivariate flows), support for variable-length sequences, explicit handling of domain shift, zero-/few-shot readiness, and retraining needs on new domains.2

3. System Model In this work, we propose the Contrastive AdversariallyAdaptive LSTM-VAE, a novel framework tailored for multivariate anomaly detection in IoT and networked environments. The overall architecture of the proposed model is illustrated in Figure 1. 2 “NR” denotes not reported or unspecified in the cited source.

Page 2 of 12

Adversarial Zero-Shot IoT Anomaly Detection Table 1 Comparison of representative IoT anomaly detection methods. Method

Supervision

Multivar.

Var. Len.

Domain Shift

Zero/Few

Retrain?

ST-VAE [8]

Sup.

Yes

NR

Partial

Few-shot

Often

SwinIoT [9]

Sup.

Vision

NR

No

No

Yes

Sup. Sup./Rules Unsup.

Syscall text Net. flows Yes

No NR NR

No No Partial

No No No

Yes Yes Possibly

Unsup. (adv.) Unsup. (graph)

Yes Graph

NR NR

Partial Partial

No No

Possibly Possibly

Sup./Heur. Sup. Fed. Fed. Unsup./DA

Yes (hand) Yes Yes Yes Yes

NR NR NR NR NR

No No Partial Partial Yes

No No Few-shot Few-shot Zero/Few

Yes Yes Sometimes Sometimes Often

Unsup.

Yes

Yes

Yes

Zero/Few

No

TF–IDF Syscalls [10] SDN-IIoT Policy [11] DUDetector [12] EvoAAE [13] DPGLAD [14] Stat. Moments [15] MindFlow [16] Fed. GAN/Ensemble [17] Fed. IF Opt. [18] DACAD [5]

This work

Notes Supervised contrastive + spatiotemporal VAE. Hierarchical Transformers for edge vision only. Lightweight, but weak temporal modeling. Tight SDN coupling; limited portability. Transformer + dual-res AE; high compute. Adversarial AE + PSO NAS; unstable. Needs domain-specific graph construction. Efficient, limited to handcrafted features. CNN+BiLSTM; platform-dependent. FL; sync/global aggregation required. FL, hyperparam-sensitive. Contrastive domain adaptation for multivariate time-series AD; strong baseline but not designed around destinationcentric IoT flow segmentation, variablelength LSTM-VAE reconstruction, or strict no-target-loss inference. Strict zero-shot inference; dual alignment; validated on 6 datasets.

Phase 1 : Data Processing and Training with Reconstruction Loss Temporal Input Window

Reconstruction Loss Input(Xt. ,…..,Xt+n )

Z=μ+σ⊙ϵ Encoder LSTM

Xt Xt+1 Xt+2…. Xt+n

μ Z

-

Decoder

σ ….

….

Grouping Package by Destination Address

Reconstructor

Encoder

Data Processing

Xt Xt+1 Xt+2…. Xt+n

Xt Xt+1 Xt+2…. Xt+n recon(Xt. ,…..,Xt+n )

Update Encoder

Phase 2 : Optimization with Multiple Loss Data Processing From Multiple Resources

Contrastive Loss

Domain Loss

Adversarial Domain Alignment Gradient Reversal Layer (GRL) Domain Discriminator

Pre-trained Shared Decoder (Frozen)

Contrastive Domain Adaptation Projection Head Cosine Similarity Calculation

Phase 3 : Zero-Shot Inference Flow Target Domain Adaptation

E

Pre-trained Encoder Decoder (Frozen)

Encoder

D Calculate Decoder Anomaly Score

Pass Alert System

Figure 1: Overall architecture of the proposed Contrastive Adversarially-Adaptive LSTM-VAE framework. The model is trained using two unlabeled source datasets to learn domain-invariant and semantically structured latent representations. Adversarial learning minimizes the domain discrepancy through a gradient reversal layer and domain classifier, while contrastive loss refines the latent space geometry. Adaptors normalize cross-domain input/output formats. At inference, the model generalizes to the unseen target domain in a zero-shot manner using reconstruction error and latent deviations for anomaly detection.

Our framework builds upon a Variational Autoencoder (VAE) augmented with Long Short-Term Memory (LSTM) layers to effectively capture temporal dependencies in multivariate time-series data. To address domain shifts across different network traffic distributions, we introduce lightweight input and output adaptor layers that serve as transformation modules, aligning feature representations between source and target domains. As shown in Figure 1, the model is trained on two distinct, unlabeled network traffic datasets. The goal is to learn representations that are invariant to dataset-specific characteristics while capturing fundamental patterns in temporal dynamics and cross-feature correlations. This enables

Rezakhani et al.: Preprint submitted to Elsevier

the model to generalize based on intrinsic structure rather than domain-dependent artifacts. The training procedure begins with unsupervised pretraining on a large-scale source dataset, where the Variational Autoencoder (VAE) learns to reconstruct benign traffic patterns and encode variable-length input sequences into compact latent representations. To minimize the domain gap between the source and auxiliary datasets, adversarial domain alignment is applied. Specifically, a domain discriminator is trained to identify the origin of encoded samples, while the encoder is concurrently optimized in an adversarial manner to mislead the discriminator, thereby promoting the learning of domain-invariant latent features.

Page 3 of 12

Adversarial Zero-Shot IoT Anomaly Detection

In addition, to develop a more generalizable model that is also capable of zero-shot adaptation, it is essential to enhance the semantic structure of the latent space. This facilitates the model’s ability to extract and retain meaningful knowledge even when input sequences vary in length and no labeled or unlabeled samples from the target domain are available during training. To achieve this, we incorporate a contrastive learning objective, which encourages the model to learn discriminative and semantically meaningful representations under such constraints. Specifically, the encoder is guided to cluster similar patterns (positive pairs) and separate dissimilar ones (negative pairs) based on cosine similarity, even when they originate from different domains. This dual training strategy—adversarial for alignment and contrastive for structure—produces a latent space that is both generalizable and discriminative. After training, the model is deployed to a previously unseen target domain in a zero-shot manner, meaning no retraining or target-domain labels are used. Anomalies are detected based on reconstruction errors and deviations from the latent distribution learned during training on source domains. To provide a structured overview of our approach, we first formalize the anomaly detection problem and the challenges of domain adaptation in time-series data. We then detail the architecture and components of our framework, including the LSTM-VAE core, domain-specific adaptor layers, and the integration of adversarial and contrastive learning mechanisms.

3.1. Problem Definition We model IoT network traffic as a multivariate time series, where each observation is a feature vector recorded at a discrete time step. Formally, a traffic sequence is denoted as 𝐗 = (𝑥1 , 𝑥2 , … , 𝑥𝑇 ) ∈ ℝ𝑇 ×𝑑 , where 𝑇 is the sequence length and 𝑑 is the number of traffic features. In flow-level network monitoring, these features may include packet counts, flow duration, inter-arrival statistics, throughput, byte counts, protocol indicators, or other traffic descriptors. A collection of such features over time forms a multivariate sequence that captures both temporal dependencies and cross-feature correlations in network behavior. This work addresses anomaly detection under heterogeneous cross-domain IoT deployments. Let 𝑠 denote a primary source domain, 𝑎 denote an auxiliary source domain used for domain alignment, and 𝑡 denote a held-out target domain. The source and auxiliary domains may come from different network environments, devices, protocols, or attack distributions. The target domain represents an unseen deployment whose data distribution is not available during training. The goal is to learn an anomaly detector from 𝑠 and 𝑎 that generalizes to 𝑡 without target-domain labels, target-domain fine-tuning, or target-domain loss computation. Rezakhani et al.: Preprint submitted to Elsevier

The proposed framework follows a strict zero-shot protocol. In the first stage, an LSTM-based VAE is trained on the primary source domain to model normal temporal behavior through sequence reconstruction and latent-space regularization. In the second stage, samples from the source and auxiliary domains are used to improve transferability through adversarial domain alignment and contrastive representation learning. The adversarial objective encourages the encoder to suppress domain-specific artifacts between 𝑠 and 𝑎 , while the contrastive objective structures the latent space by pulling similar temporal patterns closer and pushing dissimilar patterns apart. Importantly, the held-out target domain 𝑡 is not used in either stage. After training, the learned encoder–decoder model is deployed directly on 𝑡 . For each target sequence, the model computes an anomaly score from reconstruction error and latent deviation relative to the source-learned normal-behavior representation. A sequence is classified as anomalous when its score exceeds a predefined threshold. Target-domain labels are used only for final evaluation metrics and are never used for training, alignment, threshold selection, or model adaptation. This formulation enables privacy-preserving and deployment-oriented anomaly detection in heterogeneous IoT environments where collecting labeled target data or retraining the model for every new domain is impractical.

3.2. Sequence-Based VAE We employ a sequence-based Variational Autoencoder (VAE) architecture to model multivariate time-series data in IoT environments. The goal is to encode an observed sequence 𝑥 into a latent representation 𝑧 while retaining its essential structural and temporal features. The VAE models the joint probability distribution of observed variables 𝑥 and latent variables 𝑧, assuming a standard Gaussian prior over 𝑧: (1)

𝑝(𝑧) =  (𝑧; 0, 𝐼)

The data 𝑥 is generated conditionally through a neural decoder 𝑝𝜃 (𝑥|𝑧), but the true posterior 𝑝(𝑧|𝑥) is intractable. To approximate it, we use an encoder 𝑞𝜙 (𝑧|𝑥) parameterized as a Gaussian with learned mean and variance: (2)

𝑞𝜙 (𝑧|𝑥) =  (𝑧; 𝜇(𝑥), 𝜎 2 (𝑥)) where the approximate posterior takes the form: ( ) (𝑧 − 𝜇(𝑥))2 1 exp − 𝑞𝜙 (𝑧|𝑥) = √ 2𝜎 2 (𝑥) 2𝜋𝜎 2 (𝑥)

(3)

To enable backpropagation through sampling, we apply the reparameterization trick: 𝑧 = 𝜇(𝑥) + 𝜎(𝑥) ⋅ 𝜖,

𝜖 ∼  (0, 𝐼)

(4)

In our approach, each input sequence 𝑥 = {𝑥1 , 𝑥2 , … , 𝑥𝑇 }, representing a series of network traffic observations, is fed into the model. Instead of treating each time step independently, we use an LSTM to capture temporal dependencies Page 4 of 12

Adversarial Zero-Shot IoT Anomaly Detection

across the sequence. The encoder LSTM processes the entire sequence and computes the final hidden state ℎ𝑇 , which summarizes it. The latent variables are derived as: ℎ𝑡 = 𝑓LSTM (ℎ𝑡−1 , 𝑥𝑡 )

(5)

𝜇𝜙 (𝑥) = 𝑊𝜇 ℎ𝑇 + 𝑏𝜇

(6)

log 𝜎𝜙2 (𝑥) = 𝑊𝜎 ℎ𝑇 + 𝑏𝜎

(7)

The latent vector 𝑧 is sampled using the learned parameters: 𝑧 = 𝜇𝜙 (𝑥) + 𝜎𝜙 (𝑥) ⋅ 𝜖,

𝜖 ∼  (0, 𝐼)

(8)

The decoder is also an LSTM network and reconstructs the sequence one step at a time. Given 𝑧 and the previously reconstructed step 𝑥̂ 𝑡−1 , each next step is generated as: 𝑥̂ 𝑡 = 𝑓decoder (𝑧, 𝑥̂ 𝑡−1 )

(9)

This sequence-based formulation allows the model to learn both short- and long-term temporal patterns in IoT traffic data. By encoding the full sequence into a latent space and reconstructing it iteratively, the model builds a nuanced understanding of normal traffic behavior. Deviations in the reconstruction signal potential anomalies, enabling effective detection of both sudden and gradual attacks across varied environments.

3.3. Variable-Length Sequence Adaptation Real IoT traffic rarely arrives as uniform fixed-length sequences. Flow durations vary across devices, protocols, sampling rates, and attack behaviors. A fixed-window detector can therefore introduce two practical problems: short flows may be padded with little useful context, while long flows may be truncated before slow or gradual anomalies become visible. Both effects can degrade detection performance and delay operational response. To address this issue, the proposed framework supports variable-length traffic sequences. Each sequence is encoded by the LSTM encoder into a compact latent representation, allowing the model to summarize temporal behavior without requiring all inputs to share the same duration. This makes the detector more suitable for heterogeneous IoT environments, where attacks may appear as short bursts, repeated scans, or long-duration low-rate deviations. Because shorter sequences may contain limited temporal context, variable-length modeling is combined with adversarial and contrastive latent learning. Adversarial alignment reduces domain-specific artifacts between the primary and auxiliary source domains, while contrastive learning encourages similar temporal patterns to remain close in the latent space. Together, these mechanisms help the model preserve useful behavioral structure across different sequence lengths and deployment domains.

3.4. Adversarial and Contrastive Learning for Domain-Invariant Representations To improve cross-domain generalization, we integrate adversarial domain alignment and cosine-based contrastive Rezakhani et al.: Preprint submitted to Elsevier

learning into the latent-space training stage. Let 𝑠 denote the primary source domain and 𝑎 denote the auxiliary source domain used for alignment. The held-out target domain 𝑡 is not used during this stage. The goal is to learn an encoder 𝐸 that suppresses domain-specific artifacts between 𝑠 and 𝑎 while preserving temporal structures that are useful for anomaly detection in unseen deployments.

3.4.1. Adversarial Domain Alignment We introduce a domain discriminator 𝐷 that predicts whether a latent representation originates from the primary source domain 𝑠 or the auxiliary source domain 𝑎 . The discriminator is trained to distinguish the two domains, while the encoder is trained through a Gradient Reversal Layer (GRL) to make the two latent distributions difficult to separate. This adversarial objective encourages the encoder to remove domain-specific nuisance factors and retain features that are more transferable across environments. The adversarial loss is defined as [ ] adv (𝐸, 𝐷) = − 𝔼𝑥𝑠 ∼𝑠 log 𝐷(𝐸(𝑥𝑠 )) [ ( )] (10) − 𝔼𝑥𝑎 ∼𝑎 log 1 − 𝐷(𝐸(𝑥𝑎 )) , where 𝑥𝑠 and 𝑥𝑎 denote samples from the primary and auxiliary source domains, respectively. The discriminator minimizes adv , whereas the encoder receives the reversed gradient through the GRL, which makes the latent representations less domain-identifiable.

3.4.2. Cosine-Based Contrastive Learning Adversarial alignment alone may remove domain-specific information but does not necessarily impose a useful semantic geometry on the latent space. Therefore, we also apply cosine-based contrastive learning to encourage similar temporal patterns to remain close while dissimilar patterns are separated. For each anchor representation 𝑧𝑎𝑖 , we define a positive representation 𝑧𝑝𝑖 and a negative representation 𝑧𝑛𝑖 . The contrastive loss is

con =

𝑁 ( )] 1 ∑[ 1 − cos(𝑧𝑎𝑖 , 𝑧𝑝𝑖 ) + max 0, cos(𝑧𝑎𝑖 , 𝑧𝑛𝑖 ) − 𝑚 , 𝑁 𝑖=1

(11) where cos(⋅, ⋅) denotes cosine similarity and 𝑚 is a margin controlling the minimum desired separation between anchornegative pairs. This objective improves latent-space organization by reducing intra-pattern variation and increasing separation between dissimilar temporal behaviors.

3.4.3. Combined Objective The final phase–2 training objective combines adversarial alignment and contrastive structuring: phase2 = 𝜆adv adv + 𝜆con con ,

(12)

where 𝜆adv and 𝜆con control the relative strength of domain confusion and contrastive latent organization. The target Page 5 of 12

Adversarial Zero-Shot IoT Anomaly Detection

domain 𝑡 is excluded from this optimization and is used only during final zero-shot evaluation. Thus, the learned representation is encouraged to be transferable without requiring target-domain labels, target-domain loss computation, or target-side fine-tuning.

IoT datasets often differ in feature scale, feature ordering, measurement units, protocol composition, and device behavior. Directly feeding such heterogeneous inputs into a shared sequence model can cause the encoder to learn dataset-specific artifacts rather than transferable temporal structure. To reduce this effect, we introduce lightweight domain-specific adaptor layers around the shared LSTMVAE. For a sample 𝑥(𝑘) 𝑖 from domain 𝑘 , where 𝑘 ∈ {𝑠, 𝑎} during training, the encoder adaptor 𝐴(𝑘) 𝑒 maps the input sequence into a shared feature space: (13)

The transformed sequence 𝑥̃ (𝑘) 𝑖 is then passed to the shared LSTM encoder, which produces the latent representation 𝑧(𝑘) 𝑖 . This design allows the source and auxiliary domains to be normalized before entering the shared latent model. Similarly, after decoding, a lightweight decoder adaptor 𝐴(𝑘) maps the decoder output back to the corresponding 𝑑 domain-specific feature space: (𝑘) ̂ (𝑘) 𝑥̂ (𝑘) ̃ 𝑖 ). 𝑖 = 𝐴𝑑 (𝑥

(14)

The adaptor layers therefore act as interface modules that absorb domain-specific feature variability, while the shared LSTM-VAE focuses on learning transferable temporal dynamics. During strict zero-shot inference, no target-specific adaptor is trained using target data. The learned shared encoder– decoder is applied directly to the held-out target domain, and the anomaly decision is computed from the reconstruction and latent-deviation score. This preserves the zero-shot protocol while still allowing the model to benefit from source–auxiliary adaptor-based alignment during training.

3.6. Loss Functions and Training Phases The proposed framework is trained in two stages. Phase 1 learns a reconstruction-based normal-behavior model from the primary source domain. Phase 2 improves cross-domain transferability by aligning the primary source domain with an auxiliary source domain using adversarial and contrastive objectives. The held-out target domain is excluded from both training stages and is used only for final zero-shot evaluation.

3.6.1. Phase 1: VAE Pretraining on the Primary Source Domain In the first stage, the LSTM-VAE is pretrained on the primary source domain 𝑠 to model normal temporal behavior. Given an input sequence 𝑥𝑖 , the encoder produces Rezakhani et al.: Preprint submitted to Elsevier

1 ∑‖ 2 𝑥 − 𝑥̂ 𝑖 ‖ ‖2 . 𝑁 𝑖=1 ‖ 𝑖 𝑁

rec =

3.5. Domain-Specific Adaptors for Variability Handling

(𝑘) (𝑘) 𝑥̃ (𝑘) 𝑖 = 𝐴𝑒 (𝑥𝑖 ).

the approximate posterior parameters 𝜇𝑖 and 𝜎𝑖 , samples a latent vector 𝑧𝑖 through the reparameterization trick, and the decoder reconstructs the sequence as 𝑥̂ 𝑖 . The reconstruction loss is defined as (15)

The Kullback–Leibler divergence regularizes the approximate posterior 𝑞𝜙 (𝑧|𝑥) toward the standard Gaussian prior 𝑝(𝑧) =  (0, 𝐼): KL = −

𝑑𝑧 ( ) 1∑ 1 + log 𝜎𝑖𝑗2 − 𝜇𝑖𝑗2 − 𝜎𝑖𝑗2 , 2 𝑗=1

(16)

where 𝑑𝑧 is the latent dimension. The Phase 1 objective is phase1 = 𝜆rec rec + 𝜆KL KL ,

(17)

where 𝜆rec and 𝜆KL control the relative contributions of reconstruction fidelity and latent regularization.

3.6.2. Phase 2: Source–Auxiliary Alignment In the second stage, we improve transferability using the primary source domain 𝑠 and an auxiliary source domain 𝑎 . The target domain 𝑡 is not used in this phase. A domain discriminator 𝐷 attempts to distinguish whether an encoded representation comes from 𝑠 or 𝑎 , while the encoder 𝐸 is optimized through a Gradient Reversal Layer (GRL) to make the two domains difficult to separate. The adversarial domain loss is [ ] GRL = − 𝔼𝑥𝑠 ∼𝑠 log 𝐷(𝐸(𝑥𝑠 )) (18) [ ( )] − 𝔼𝑥𝑎 ∼𝑎 log 1 − 𝐷(𝐸(𝑥𝑎 )) , where 𝑥𝑠 and 𝑥𝑎 are samples from the primary and auxiliary source domains, respectively. To further organize the latent space, we apply cosinebased contrastive learning. For each anchor representation 𝑧𝑎𝑖 , let 𝑧𝑝𝑖 denote a positive representation and 𝑧𝑛𝑖 denote a negative representation. The contrastive loss is con =

𝑁 ( )] 1 ∑[ 1 − cos(𝑧𝑎𝑖 , 𝑧𝑝𝑖 ) + max 0, cos(𝑧𝑎𝑖 , 𝑧𝑛𝑖 ) − 𝑚 , 𝑁 𝑖=1

(19) where cos(⋅, ⋅) denotes cosine similarity and 𝑚 is the margin that controls anchor-negative separation. The Phase 2 objective is then phase2 = 𝜆GRL GRL + 𝜆con con ,

(20)

where 𝜆GRL and 𝜆con balance adversarial domain confusion and contrastive latent structuring.

Page 6 of 12

Adversarial Zero-Shot IoT Anomaly Detection

3.6.3. Phase 3: Strict Zero-Shot Inference After training, the encoder and decoder are frozen and deployed directly on the held-out target domain 𝑡 . No target-domain labels, target-domain loss, target-domain finetuning, or target-domain model selection are used. For a target sequence 𝑥𝑡 , the model computes an anomaly score from the reconstruction error and latent deviation: ‖2 ‖ ‖2 𝑠(𝑥𝑡 ) = 𝛼 ‖ ‖𝑥𝑡 − 𝑥̂ 𝑡 ‖2 + (1 − 𝛼) ‖𝑧𝑡 − 𝑧̄ 𝑠 ‖2 ,

(21)

where 𝑧𝑡 = 𝐸(𝑥𝑡 ), 𝑧̄ 𝑠 is the mean latent representation estimated from normal source-domain training samples, and 𝛼 ∈ [0, 1] controls the relative contribution of reconstruction and latent deviation. A target sequence is classified as anomalous when 𝑠(𝑥𝑡 ) exceeds a predefined threshold. Target labels are used only to compute final evaluation metrics.

3.7. Evaluation Datasets In this study, we utilize six distinct IoT-related datasets originating from diverse application domains—namely, industrial IoT, general-purpose enterprise networks, military automation, academic testbeds, and smart home automation—to comprehensively evaluate the effectiveness and generalizability of our proposed anomaly detection framework. • CICIDS 2018 Dataset: The CICIDS 2018 dataset [19], curated by the Canadian Institute for Cybersecurity (CIC) in collaboration with the Communications Security Establishment (CSE), was generated using a simulated enterprise network setup. It spans ten days of realistic network traffic, totaling over 16 million flow-based entries. Approximately 83% of the data is benign, while 17% comprises various attack categories including brute force, denial-of-service (DoS), botnet activity, web attacks, and infiltration. Each record contains more than 80 traffic flow features extracted via CICFlowMeter. This dataset serves as a comprehensive benchmark for evaluating intrusion detection systems in general network environments. All recorded features are monitored to examine the robustness of our method under diverse traffic behaviors, enabling an in-depth assessment of model adaptability across heterogeneous network conditions. • WUSTL-IIOT-2021 Dataset: The WUSTL-IIOT2021 dataset [20] originates from an Industrial IoT (IIoT) testbed designed to monitor water storage tanks. Spanning 53 hours of operation, it includes 1,194,464 entries, capturing critical network metrics such as packet drops and flow durations. The dataset is predominantly benign (93%), with 7% of records corresponding to attack types such as denial-of-service (89.98%), reconnaissance (9.46%), SQL injection (0.31%), and backdoor access (0.25%). Consistent with prior studies, we track all extracted features to analyze the effectiveness of the proposed method when applied to industrial traffic with varying characteristics. Rezakhani et al.: Preprint submitted to Elsevier

• ACI-IoT-2023 Dataset: The ACI-IoT-2023 dataset [21] was collected within a simulated military IoT environment that replicates real-world home automation scenarios. It contains 742,758 traffic entries recorded over five days, of which 95% are malicious. The attack composition includes reconnaissance (74%), brute force (1%), and denial-of-service (25%), encompassing subcategories such as scanning and sweeping. This dataset offers valuable insights into the cybersecurity vulnerabilities inherent in military-oriented IoT systems. We utilize all available features to evaluate the proposed method’s performance in handling traffic patterns with distinct operational contexts. • CICIDS 2017 Dataset: A predecessor to CICIDS 2018, this dataset [22] includes both benign and common, up-to-date attacks. It contains 2,830,743 total flow entries, of which approximately 80.3% are benign. The remaining 19.7% of malicious traffic is composed of several attack types. The most prevalent attacks are Denial-of-Service (DoS/DDoS), accounting for the vast majority of malicious instances, followed by Port Scanning. Other implemented attacks include Brute Force (FTP and SSH), Web Attacks (Brute Force, XSS, SQL Injection), Infiltration, Botnet, and Heartbleed. The dataset is used in source–target–adversary combinations to evaluate robustness across different temporal captures and protocol variations within CIC environments. • UNSW-NB15 Dataset: Developed by the Australian Cyber Security Centre, this dataset [23] includes both real benign and synthetic attack flows from a total of 2,540,044 records. Approximately 87.4% of the traffic is benign, while the other 12.6% is malicious. The attack composition consists of nine types, dominated by Generic attacks (67.1%) and Exploits (13.9%). The remaining categories are Fuzzers (7.5%), DoS (5.1%), Reconnaissance (4.3%), Analysis (0.8%), Backdoors (0.7%), Shellcode (0.5%), and Worms (0.1%). It is employed as both a source and target to evaluate crossprotocol and attack-style generalization. • TON-IoT Dataset: Provided by the Cyber Range Lab at UNSW, TON-IoT [24] is a smart home-oriented dataset with over 22 million telemetry and network event records. Within the network traffic portion, approximately 64.8% of entries are benign, and 35.2% are malicious. The malicious traffic is heavily skewed towards reconnaissance activities, with Scanning attacks making up 48.7% of all malicious events. Denialof-Service is also highly prevalent, with DDoS (29.0%) and DoS (21.6%) attacks forming the next largest categories. The dataset also contains smaller numbers of Backdoor (0.34%), Injection (0.19%), Ransomware (0.10%), XSS (0.04%), Password (0.01%), and Manin-the-Middle (MITM) attacks. It is used as a target domain in several experiments, revealing generalization challenges in more constrained settings. Page 7 of 12

Adversarial Zero-Shot IoT Anomaly Detection

Together, these six datasets provide a heterogeneous evaluation suite spanning enterprise network traffic, industrial IoT, military-oriented IoT, academic intrusion-detection testbeds, and smart-home IoT environments. CICIDS2017 and CICIDS2018 represent general-purpose enterprise network settings with diverse benign and malicious flow patterns; WUSTL-IIoT-2021 captures industrial IoT traffic with operationally structured benign behavior and a smaller set of attack classes; ACI-IoT-2023 reflects a military-oriented IoT environment with a highly attack-dominant distribution; UNSW-NB15 introduces additional protocol and attackstyle diversity; and TON-IoT provides smart-home IoT traffic with substantial reconnaissance and denial-of-service activity. In our evaluation framework, these datasets are used in source–auxiliary–target combinations to test cross-domain generalization under strict zero-shot conditions. For each experiment, the model is trained using a primary source domain 𝑠 and an auxiliary source domain 𝑎 for adversarial and contrastive alignment, while the target domain 𝑡 is held out entirely during training. No target-domain samples, labels, losses, or fine-tuning steps are used before inference. The target dataset is used only for final metric computation. This protocol allows us to evaluate both successful transfer cases and failure modes caused by domain shift, class imbalance, and insufficient source-domain coverage.

4. Model Evaluation and Analysis 4.1. Experimental Protocol In all experiments, the held-out target domain is used only for final evaluation. Target labels are not used during model training, adversarial alignment, contrastive learning, threshold selection, or model selection. Performance is reported using accuracy, Matthews correlation coefficient (MCC), recall, precision, F1-score, and false-positive rate (FPR). This protocol is intended to measure strict zero-shot transfer rather than target-adaptive performance. The confusion matrices in Figs. 2–4 reinforce these observations. In the CICIDS-only scenario, true positives are generally high, indicating good recognition of abnormal patterns. However, moderate false positives suggest some overgeneralization to benign classes. The WUSTLonly model achieves a similar true negative rate but suffers from increased false positives and false negatives, due to the absence of explicit attack semantics during training. The combined scenario demonstrates the most balanced classification performance with minimal false negatives (66) and false positives (330), aligning with its top accuracy. This confirms that the adversarial framework effectively aligns heterogeneous source domains to construct a more resilient decision boundary in the target space.

4.2. Zero-Shot Inference Protocol (No Target Loss) In the final phase, the model operates under a strict zeroshot setting on the target domain: no target data (labeled or Rezakhani et al.: Preprint submitted to Elsevier

unlabeled) is used and no loss function is computed in this phase. Decisions are made using reconstruction errors and latent deviations only.

4.3. Cross-Domain Benchmarking and Latent Alignment via t-SNE We expanded the evaluation to six datasets: CICIDS2017, CICIDS2018, UNSW–NB15, TON–IoT, ACI–IoT–2023, and WUSTL-IIoT-2021/WUSTL-IIoT. These datasets form 44 source–auxiliary–target combinations, where two domains are used during training and alignment and the remaining domain is held out for zero-shot evaluation. The cross-domain results are reported in Tables 2 and 3. Figure 5 complements these numerical results by showing the phase–2 latent geometry, i.e., the aligned 𝑧 space after VAE encoding with contrastive and adversarial objectives, for thirteen representative source-domain pairs. Several regularities emerge from the latent visualizations. First, source pairs involving CICIDS2017, CICIDS2018, NB15, or WUSTL-IIoT-2021 often form smooth low-dimensional manifolds, suggesting that the adversarial and contrastive objectives reduce visible domain separation in the learned latent space. Second, when TON participates as a source, the embedding often becomes highly smooth and nearly one-dimensional. Although this indicates strong geometric regularization, it may also suggest reduced latent diversity, which can limit coverage of unseen target-domain modes. Third, source pairs involving ACI sometimes retain more scattered or multi-lobed structures, indicating that complete cross-domain mixing is more difficult when military-IoT traffic is involved. These visual patterns suggest that latent compactness alone is not sufficient; the aligned representation must also preserve enough variability to support unseen target domains. The numerical results in Tables 2 and 3 show that the proposed method performs strongly for several CICIDS2017, CICIDS2018, and NB15 target settings. When CICIDS2017 is used as the target, source pairs such as ACI+TON, ACI+WUSTL-IIoT-2021, and CICIDS2018+ACI achieve perfect or near-perfect accuracy, MCC, recall, precision, and F1. Similar behavior is observed when CICIDS2018 is the target, especially for source pairs involving CICIDS2017, NB15, TON, or WUSTL-IIoT-2021. By contrast, the results also reveal systematic weaknesses in some target domains. Transfers to TON–IoT often produce low precision and F1 despite high recall, indicating that the model detects many anomalous samples but also generates many false positives. This behavior appears across several TON target cases, especially when the source pairs include ACI, CICIDS2017, CICIDS2018, NB15, or WUSTL-IIoT-2021. A similar failure mode appears when ACI is the unseen target for several source pairs, where the model collapses toward poor recall and low MCC. These results indicate that strict zero-shot transfer remains challenging when the held-out target contains traffic modes or attack distributions that are poorly covered by the aligned source domains. Page 8 of 12

Adversarial Zero-Shot IoT Anomaly Detection Source

Target

ACC

MCC

Recall

Precision

F1

FPR

ACI+TON ACI+TON ACI+TON ACI+WUSTL-IIoT-2021 ACI+WUSTL-IIoT-2021 ACI+WUSTL-IIoT-2021 ACI+WUSTL-IIoT-2021 CICIDS2017+ACI CICIDS2017+ACI CICIDS2017+ACI CICIDS2017+TON CICIDS2017+TON CICIDS2017+TON CICIDS2017+WUSTL-IIoT-2021 CICIDS2017+WUSTL-IIoT-2021 CICIDS2017+WUSTL-IIoT-2021 CICIDS2017+WUSTL-IIoT-2021 CICIDS2018+ACI CICIDS2018+ACI CICIDS2018+ACI CICIDS2018+TON CICIDS2018+TON

CICIDS2017 CICIDS2018 NB15 CICIDS2017 CICIDS2018 NB15 TON CICIDS2018 NB15 TON ACI CICIDS2018 NB15 ACI CICIDS2018 NB15 TON CICIDS2017 NB15 TON ACI CICIDS2017

1.000 0.833 0.812 1.000 0.854 0.833 0.479 0.875 0.812 0.479 0.333 0.958 0.854 0.333 0.958 0.833 0.479 1.000 0.833 0.479 0.333 1.000

1.000 0.707 0.584 1.000 0.737 0.632 0.227 0.769 0.584 0.227 0.000 0.913 0.679 0.000 0.913 0.632 0.227 1.000 0.632 0.227 0.000 1.000

1.000 1.000 0.781 1.000 1.000 0.800 0.889 1.000 0.781 0.889 0.000 1.000 0.821 0.000 1.000 0.800 0.889 1.000 0.800 0.889 0.000 1.000

1.000 0.750 1.000 1.000 0.781 1.000 0.250 0.812 1.000 0.250 0.000 0.938 1.000 0.000 0.938 1.000 0.250 1.000 1.000 0.250 0.000 1.000

1.000 0.857 0.877 1.000 0.877 0.889 0.390 0.897 0.877 0.390 0.000 0.968 0.901 0.000 0.968 0.889 0.390 1.000 0.889 0.390 0.000 1.000

0.000 0.333 0.000 0.000 0.304 0.000 0.615 0.273 0.000 0.615 0.667 0.111 0.000 0.667 0.111 0.000 0.615 0.000 0.000 0.615 0.667 0.000

Table 2 Cross-domain zero-shot results for part 1 of the 44-experiment evaluation. Source lists the two training domains (A+B); Target is the held-out zero-shot domain. Source

Target

ACC

MCC

Recall

Precision

F1

FPR

CICIDS2018+TON CICIDS2018+WUSTL-IIoT-2021 CICIDS2018+WUSTL-IIoT-2021 CICIDS2018+WUSTL-IIoT-2021 CICIDS2018+WUSTL-IIoT-2021 NB15+ACI NB15+ACI NB15+ACI NB15+TON NB15+TON NB15+TON NB15+WUSTL-IIoT-2021 NB15+WUSTL-IIoT-2021 NB15+WUSTL-IIoT-2021 NB15+WUSTL-IIoT-2021 TON+ACI TON+ACI TON+ACI TON+WUSTL-IIoT-2021 TON+WUSTL-IIoT-2021 TON+WUSTL-IIoT-2021 TON+WUSTL-IIoT-2021

NB15 ACI CICIDS2017 NB15 TON CICIDS2017 CICIDS2018 TON ACI CICIDS2017 CICIDS2018 ACI CICIDS2017 CICIDS2018 TON CICIDS2017 CICIDS2018 NB15 ACI CICIDS2017 CICIDS2018 NB15

0.812 0.333 1.000 0.854 0.479 1.000 0.938 0.479 0.333 1.000 0.958 0.333 1.000 0.958 0.479 1.000 0.896 0.812 0.333 1.000 0.958 0.854

0.584 0.000 1.000 0.679 0.227 1.000 0.874 0.227 0.000 1.000 0.913 0.000 1.000 0.913 0.227 1.000 0.802 0.584 0.000 1.000 0.913 0.679

0.781 0.000 1.000 0.821 0.889 1.000 1.000 0.889 0.000 1.000 1.000 0.000 1.000 1.000 0.889 1.000 1.000 0.781 0.000 1.000 1.000 0.821

1.000 0.000 1.000 1.000 0.250 1.000 0.906 0.250 0.000 1.000 0.938 0.000 1.000 0.938 0.250 1.000 0.844 1.000 0.000 1.000 0.938 1.000

0.877 0.000 1.000 0.901 0.390 1.000 0.951 0.390 0.000 1.000 0.968 0.000 1.000 0.968 0.390 1.000 0.915 0.877 0.000 1.000 0.968 0.901

0.000 0.667 0.000 0.000 0.615 0.000 0.158 0.615 0.667 0.000 0.111 0.667 0.000 0.111 0.615 0.000 0.238 0.000 0.667 0.000 0.111 0.000

Table 3 Cross-domain P3 results for part 2 of the 44-experiment subset from the previous runs. Source lists the two training domains (A+B); Target is the held-out zero-shot domain.

Overall, the cross-domain benchmark shows that the proposed adversarial and contrastive LSTM–VAE can learn useful transferable representations across several heterogeneous IoT and network-security datasets, especially when the target domain shares latent structure with the source and auxiliary domains. At the same time, the weaker TON and ACI target cases highlight an important limitation of strict zero-shot anomaly detection: alignment between the available source domains does not guarantee sufficient latent support for every unseen deployment. This motivates the DACAD comparison in the next subsection and suggests that future work should incorporate uncertainty-aware rejection, Rezakhani et al.: Preprint submitted to Elsevier

broader source-domain coverage, or lightweight adaptoronly calibration when a small amount of target data is available.

4.4. Comparison with DACAD DACAD [5] is the closest conceptual baseline to our work because it also addresses anomaly detection in multivariate time series under domain shift using contrastive domain adaptation. Its main objective is to learn transferable representations by aligning source and target domains through contrastive learning, thereby improving anomaly detection when the deployment distribution differs from Page 9 of 12

Adversarial Zero-Shot IoT Anomaly Detection

the training distribution. This makes DACAD a strong reference point for evaluating whether the proposed Contrastive Adversarially-Adaptive LSTM-VAE provides additional value beyond contrastive domain adaptation alone. Despite this conceptual similarity, our framework differs from DACAD in four important ways. First, DACAD is primarily designed around domain-adaptive multivariate time-series anomaly detection, whereas our framework is designed for strict zero-shot IoT traffic anomaly detection. In our final inference phase, no target-domain samples, labels, target loss, or target-side fine-tuning are used. The model performs detection only through reconstruction error and latent deviation from the source-learned normal-behavior manifold. Second, DACAD focuses on contrastive domain adaptation, while our method combines contrastive latent structuring with adversarial domain alignment through a gradient reversal mechanism. This dual objective simultaneously encourages semantic separation between dissimilar temporal patterns and domain invariance across heterogeneous IoT traffic sources. Third, our model explicitly supports variable-length flow sequences through the LSTMVAE formulation, which is important for realistic IoT traffic where flows differ in duration, sampling density, and attack timescale. Fourth, our destination-centric segmentation strategy groups traffic by receiver endpoint, preserving device-level communication context instead of relying only on generic temporal windows. To compare against DACAD, we use the same crossdomain evaluation setting adopted in the previous subsection. Multiple datasets are used as source/adversarial training domains, while the held-out target domain is never exposed during training. The comparison therefore evaluates generalization under domain shift rather than in-domain detection. This is particularly important because IoT anomaly detection systems are often deployed in environments whose device composition, protocols, traffic intensity, and attack distribution differ from those observed during training. The comparison shows a mixed outcome rather than a uniform advantage for either method. The proposed framework performs particularly well when CICIDS2017 or CICIDS2018 is the held-out target, often reaching near-perfect accuracy in these transfer settings. In contrast, DACAD achieves stronger accuracy in several NB15, TON-IoT, and ACI-IoT target configurations. This indicates that the proposed reconstruction-based adversarial LSTM-VAE is effective when the unseen target shares temporal and flowlevel structure with the aligned source domains, whereas DACAD can be more competitive when contrastive domain adaptation provides better direct representation transfer. These results also clarify the role of the proposed design choices. Our method emphasizes strict no-target-loss inference, variable-length sequence reconstruction, adversarial source-domain alignment, and destination-centric flow modeling. This design is especially effective when the heldout target shares temporal and flow-level structure with the aligned source domains, as seen in several CICIDS2017 and CICIDS2018 target settings. DACAD, by contrast, is Rezakhani et al.: Preprint submitted to Elsevier

a strong contrastive domain-adaptation baseline and can outperform the proposed method in several NB15, TON– IoT, and ACI–IoT target configurations, where direct contrastive representation transfer appears to handle the domain shift more effectively. Therefore, the comparison should be interpreted as complementary rather than as a one-sided improvement: the proposed framework offers a deploymentoriented strict zero-shot detector for IoT traffic anomaly detection, while DACAD remains highly competitive in difficult cross-domain accuracy comparisons.

5. Conclusion This paper introduced a contrastive adversarially adaptive LSTM–VAE framework for zero-shot anomaly detection in multivariate IoT network traffic. By combining sequence-based variational reconstruction with adversarial source-domain alignment and cosine-based contrastive latent structuring, the framework addresses cross-domain shifts without requiring target-side labels, target-domain loss computation, or target-side fine-tuning. The integration of lightweight domain adaptors and destination-centric traffic segmentation further allows the model to accommodate variable-length flows while preserving device-level communication context. Extensive evaluation across six diverse IoT and networksecurity benchmarks spanning 44 transfer scenarios demonstrates that the proposed framework achieves strong zeroshot generalization in several structurally compatible crossdomain settings, particularly for CICIDS2017 and CICIDS2018 targets. At the same time, the results expose systematic degradation in highly shifted smart-home and military-IoT target domains when the aligned source domains do not provide sufficient latent coverage. In particular, TON–IoT target cases often produce high recall but low precision, indicating elevated false-positive rates, while several ACI– IoT target cases show poor recall and low MCC under strict zero-shot transfer. Comparison with DACAD shows a complementary performance pattern rather than a uniform advantage for either method. The proposed reconstruction-driven LSTM–VAE is highly effective when temporal and flow-level structures transfer across domains, whereas direct contrastive domain adaptation can be more competitive under severe distribution shift. These findings highlight both the promise and the limitations of strict zero-shot anomaly detection for heterogeneous IoT deployments.

CRediT authorship contribution statement Mahshid Rezakhani: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Data curation, Writing – original draft, Visualization. Tolunay Seyfi: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Data curation, Writing – original draft, Writing – review and editing, Visualization. Fatemeh Afghah: Conceptualization, Supervision, Project Page 10 of 12

Adversarial Zero-Shot IoT Anomaly Detection Source

Target

ACI+TON ACI+TON ACI+TON ACI+WUSTL-IIoT-2021 ACI+WUSTL-IIoT-2021 ACI+WUSTL-IIoT-2021 ACI+WUSTL-IIoT-2021 CICIDS2017+ACI CICIDS2017+ACI CICIDS2017+ACI CICIDS2017+TON CICIDS2017+TON CICIDS2017+TON CICIDS2017+WUSTL-IIoT-2021 CICIDS2017+WUSTL-IIoT-2021 CICIDS2017+WUSTL-IIoT-2021 CICIDS2017+WUSTL-IIoT-2021 CICIDS2018+ACI CICIDS2018+ACI CICIDS2018+ACI CICIDS2018+TON CICIDS2018+TON

CICIDS2017 CICIDS2018 NB15 CICIDS2017 CICIDS2018 NB15 TON CICIDS2018 NB15 TON ACI CICIDS2018 NB15 ACI CICIDS2018 NB15 TON CICIDS2017 NB15 TON ACI CICIDS2017

Proposed ACC

DACAD ACC

1.000 0.833 0.812 1.000 0.854 0.833 0.479 0.875 0.812 0.479 0.333 0.958 0.854 0.333 0.958 0.833 0.479 1.000 0.833 0.479 0.333 1.000

0.519 0.415 0.649 0.656 0.738 0.985 0.966 0.506 0.895 0.800 0.485 0.551 0.988 0.512 0.559 0.984 0.979 0.626 0.989 0.563 0.492 0.600

Table 4 Accuracy comparison between the proposed method and DACAD for part 1 of the 44-experiment P3 subset. The higher accuracy in each row is shown in bold.

administration, Funding acquisition, Writing – review and editing.

Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Data availability The datasets analyzed in this study are publicly available from their respective repositories. Processed data and implementation details are available from the corresponding author upon reasonable request.

Acknowledgements This material is based upon work supported by the National Science Foundation under Grant Numbers CNS2318726 and CNS-2232048.

References [1] Z. A. Haider, A. Zeb, T. Rahman, S. K. Singh, R. Akram, A. Arishi, and I. Ullah, “A survey on anomaly detection in IoT: Techniques, challenges, and opportunities with the integration of 6G,” Computer Networks, vol. 270, p. 111484, 2025. [Online]. Available: https: //www.sciencedirect.com/science/article/pii/S1389128625004517 [2] M. M. Rahman, S. Al Shakil, and M. R. Mustakim, “A survey on intrusion detection system in IoT networks,” Cyber Security and

Rezakhani et al.: Preprint submitted to Elsevier

Applications, vol. 3, p. 100082, 2025. [Online]. Available: https: //www.sciencedirect.com/science/article/pii/S2772918424000481 [3] J. Doménech, O. León, M. S. Siddiqui, and J. Pegueroles, “Evaluating and enhancing intrusion detection systems in IoMT: The importance of domain-specific datasets,” Internet of Things, vol. 32, p. 101631, 2025. [Online]. Available: https: //www.sciencedirect.com/science/article/pii/S2542660525001453 [4] Z. Z. Darban, G. I. Webb, S. Pan, C. Aggarwal, and M. Salehi, “Deep learning for time series anomaly detection: A survey,” ACM Computing Surveys, vol. 57, no. 1, October 2024. [Online]. Available: https://doi.org/10.1145/3691338 [5] Z. Z. Darban, Y. Yang, G. I. Webb, C. C. Aggarwal, Q. Wen, S. Pan, and M. Salehi, “DACAD: Domain adaptation contrastive learning for anomaly detection in multivariate time series,” IEEE Transactions on Knowledge and Data Engineering, vol. 37, no. 8, pp. 4485–4496, 2025. [6] L. Tang, Z. Wang, G. He, R. Wang, and F. Nie, “Perturbation guiding contrastive representation learning for time series anomaly detection,” in Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI-24, K. Larson, Ed. International Joint Conferences on Artificial Intelligence Organization, August 2024, pp. 4955–4963, main Track. [Online]. Available: https://doi.org/10.24963/ijcai.2024/548 [7] S. Guan, Z. He, S. Ma, and M. Gao, “Multivariate time series anomaly detection with variational autoencoder and spatial–temporal graph network,” Computers & Security, vol. 142, p. 103877, 2024. [Online]. Available: https://www.sciencedirect.com/science/article/ pii/S0167404824001780 [8] L. Tang, R. Wei, B. Xia, Y. Tang, W. Wang, Q. Huang, and Q. Chen, “Online anomaly detection in industrial IoT networks using a supervised contrastive learning-based spatiotemporal variational autoencoder,” IEEE Internet of Things Journal, 2025. [9] H. Mancy and Q. H. Naith, “SwinIoT: A hierarchical transformerbased framework for behavioral anomaly detection in IoT-driven smart cities,” IEEE Access, vol. 13, pp. 48 758–48 774, 2025.

Page 11 of 12

Adversarial Zero-Shot IoT Anomaly Detection Source

Target

CICIDS2018+TON CICIDS2018+WUSTL-IIoT-2021 CICIDS2018+WUSTL-IIoT-2021 CICIDS2018+WUSTL-IIoT-2021 CICIDS2018+WUSTL-IIoT-2021 NB15+ACI NB15+ACI NB15+ACI NB15+TON NB15+TON NB15+TON NB15+WUSTL-IIoT-2021 NB15+WUSTL-IIoT-2021 NB15+WUSTL-IIoT-2021 NB15+WUSTL-IIoT-2021 TON+ACI TON+ACI TON+ACI TON+WUSTL-IIoT-2021 TON+WUSTL-IIoT-2021 TON+WUSTL-IIoT-2021 TON+WUSTL-IIoT-2021

NB15 ACI CICIDS2017 NB15 TON CICIDS2017 CICIDS2018 TON ACI CICIDS2017 CICIDS2018 ACI CICIDS2017 CICIDS2018 TON CICIDS2017 CICIDS2018 NB15 ACI CICIDS2017 CICIDS2018 NB15

Proposed ACC

DACAD ACC

0.812 0.333 1.000 0.854 0.479 1.000 0.938 0.479 0.333 1.000 0.958 0.333 1.000 0.958 0.479 1.000 0.896 0.812 0.333 1.000 0.958 0.854

0.891 0.418 0.691 0.904 0.963 0.484 0.545 0.603 0.564 0.647 0.594 0.418 0.620 0.551 0.984 0.389 0.410 0.632 0.449 0.680 0.755 0.940

Table 5 Accuracy comparison between the proposed method and DACAD for part 2 of the 44-experiment P3 subset. The higher accuracy in each row is shown in bold.

[10] N. Shamim, M. Asim, A. I. Awad, and M. K. Khan, “Anomaly detection in internet of things system calls using a centroid-based vector-space model,” IEEE Internet of Things Journal, 2025. [11] L. Tan, A. Singh, W. Zhang, H. Pei, P. Zhang, P. K. Chahal, and M. Singh, “Energy-efficient tactile-driven rule configuration and anomaly detection in industrial IoT systems,” IEEE Internet of Things Journal, 2025. [12] H. Geng, Q. Ma, H. Chi, Z. Zhang, J. Yang, and X. Yin, “DUdetector: A dual-granularity unsupervised model for network anomaly detection,” Computer Networks, vol. 257, p. 110937, 2025. [13] G.-Q. Zeng, Y.-W. Yang, K.-D. Lu, G.-G. Geng, and J. Weng, “Evolutionary adversarial autoencoder for unsupervised anomaly detection of industrial internet of things,” IEEE Transactions on Reliability, pp. 1–15, 2025. [14] M. Zhang et al., “DPGLAD: An unsupervised graph learning-based anomaly detection model for industrial IoT,” Applied Intelligence, 2024. [15] E. Tuyishime, M. Martalò, P. A. Cotfas, V. Popescu, D. T. Cotfas, and A. Rekeraho, “Resource-efficient traffic classification using feature selection for message queuing telemetry transport–internet of things network-based security attacks,” Applied Sciences, vol. 15, no. 8, p. 4252, 2025. [16] L. Chen et al., “MindFlow: A deep learning-based intrusion detection system for IoT using CNN-BiLSTM on mindspore,” arXiv preprint arXiv:2504.17678, 2025. [17] B. Jiang, G. Wang, X. Cui, F. Luo, and J. Wang, “Lightweight anomaly detection in federated learning via separable convolution and convergence acceleration,” Internet of Things, vol. 30, p. 101518, 2025. [18] A. Babu and A. Bagubali, “Federated learning with sailfish-optimized ensemble models for anomaly detection in iot edge computing environment,” IEEE Access, vol. 13, pp. 53 171–53 187, 2025. [19] Communications Security Establishment (CSE) and Canadian Institute for Cybersecurity (CIC), “Cse-cic-ids2018: A collaborative dataset for computer network intrusion detection,” University

Rezakhani et al.: Preprint submitted to Elsevier

of New Brunswick, Tech. Rep., 2018. [Online]. Available: https://www.unb.ca/cic/datasets/ids-2018.html [20] D. Bhamare, S. Zolanvari et al., “Cybersecurity for industrial internet of things (IIoT): A survey and a testbed,” IEEE International Conference on Computer and Communication Engineering (ICCCE), 2021. [Online]. Available: https://www.cse.wustl.edu/~jain/iiot2/ index.html [21] N. Bastian, D. Bierbrauer et al., “ACI IoT network traffic dataset 2023,” 2023. [22] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), 2018, pp. 108– 116. [23] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems,” in Proceedings of the Military Communications and Information Systems Conference (MilCIS), 2015, pp. 1–6. [24] N. Moustafa, M. Ahmed et al., “Data analytics-enabled intrusion detection: Evaluations of ToN_IoT linux datasets,” in Proceedings of the 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2020, pp. 839–846. [25] S. Xie, L. Li, and Y. Zhu, “Anomaly detection for multivariate time series in IoT using discrete wavelet decomposition and dual graph attention networks,” Computers & Security, vol. 146, p. 104075, 2024. [Online]. Available: https://www.sciencedirect.com/science/ article/pii/S0167404824003808 [26] J. Azar, M. Al Saleh, R. Couturier, and H. Noura, “Text mining and unsupervised deep learning for intrusion detection in smart-grid communication networks,” IoT, vol. 6, no. 2, p. 22, 2025. [27] R. Fang et al., “LTG: Learning temporal and graph structures for multivariate time-series anomaly detection in IoT networks,” Discover Internet of Things, 2024.

Page 12 of 12

Adversarial Zero-Shot IoT Anomaly Detection

Figure 2: Confusion matrix for transfer scenario: CICIDS 2018 (source) → ACI-IoT-2023 (target)

Figure 4: Confusion matrix for transfer scenario: CICIDS 2018 + WUSTL-IIoT-2021 (source) → ACI-IoT-2023 (target)

Figure 3: Confusion matrix for transfer scenario: WUSTL-IIoT2021 (source) → ACI-IoT-2023 (target)

Rezakhani et al.: Preprint submitted to Elsevier

Page 13 of 12

Adversarial Zero-Shot IoT Anomaly Detection

ACI+TON

ACI+WUSTL-IIoT-2021

CICIDS2017+ACI

CICIDS2017+TON

CICIDS2017+WUSTL-IIoT-2021

CICIDS2018+ACI

CICIDS2018+TON

CICIDS2018+WUSTL-IIoT-2021

NB15+ACI

NB15+TON

NB15+WUSTL-IIoT-2021

TON+ACI

TON+WUSTL-IIoT-2021

Figure 5: Phase 2 latent space visualization after contrastive and adversarial alignment. Each panel shows the t-SNE projection of the aligned VAE latent representations for one source domain pair. Rezakhani et al.: Preprint submitted to Elsevier

Page 14 of 12

Related documents

• An Adversarial Zero-Shot Learning Approach for Anomaly Detection in Multivariate IoT Traffic Data#926420
• MCES-CNN: A Hybrid Meta-classification Framework with Explainable AI for Enhanced IoT Intrusion Detection#379336
• Enhancing IoT Security through Machine Learning-Driven Anomaly Detection#328744
• Enhancing IoT Security: Optimizing Anomaly Detection through Machine Learning#207623
• A stacking ensemble of deep learning models for IoT intrusion detection#200935