Transfer-Difficulty-Aware Few-Shot Domain Adaptation for Cross-Domain Intrusion Detection

Few-shot domain adaptation (FSDA) has become a key approach for cross-domain intrusion detection, enabling models to leverage limited labeled target data under distribution shift. While a wide range of adaptation methods have been proposed, their effectiveness often varies significantly across different transfer scenarios, leading to inconsistent performance and limited interpretability. In this work, it is argued that such variability stems from an overlooked factor: transfer difficulty. This study proposes a transfer-difficulty-aware perspective on FSDA and shows that adaptation behavior is fundamentally dependent on cross-domain compatibility rather than solely on intrinsic domain structure. To this end, a distinction is made between intra-domain separability, which characterizes the internal structure of each domain, and transfer difficulty, which captures how well source-derived representations generalize to the target domain. A set of asymmetric transferability metrics is introduced to quantify this phenomenon and accompanied by a systematic analysis across multiple transfer directions. The results reveal that a domain with strong internal separability does not necessarily yield easy transfer, highlighting that intra-domain structure alone is insufficient to explain cross-domain performance. Furthermore, it is shown that different adaptation strategies exhibit distinct behaviors depending on transfer difficulty: target-only few-shot learning is effective in low-difficulty settings, whereas alignment-based approaches become essential in high-difficulty scenarios. These findings explain the inconsistent performance of existing methods and suggest that domain adaptation should be treated as a transfer-dependent problem rather than a uniform strategy. Ultimately, this work offers both theoretical insights and practical guidance for designing robust cross-domain intrusion detection systems.