Numerically Stabilized Regularized Learning for Intrusion Detection: Conditioning, Scaling, and Cross-Dataset Transfer Analysis

1. Introduction

Network intrusion detection systems (IDSs) are commonly evaluated using benchmark datasets that contain heterogeneous traffic patterns, class imbalance, and diverse attack behaviors. Public datasets such as CICIDS2017, UNSW-NB15, and CIRA-CIC-DoHBrw-2020 have enabled reproducible experimental comparisons in intrusion detection research [1,2,3]. However, the use of such datasets also introduces methodological challenges. Traffic features often combine heterogeneous physical units, including durations, byte counts, rates, packet counts, and port-related variables. In addition, class distributions are frequently skewed, and models trained on one dataset may not preserve their operating behavior when transferred to another dataset. The datasets used in this study were obtained from their official public repositories to ensure traceability and reproducibility. CICIDS2017 was downloaded from the Canadian Institute for Cybersecurity repository at the University of New Brunswick (https://www.unb.ca/cic/datasets/ids-2017.html); UNSW-NB15 was obtained from the official University of New South Wales dataset page (https://research.unsw.edu.au/projects/unsw-nb15-dataset); and CIRA-CIC-DoHBrw-2020, from which the DoH-Combined subsets were derived, was downloaded from the Canadian Institute for Cybersecurity repository (https://www.unb.ca/cic/datasets/dohbrw-2020.html).

Most IDS studies emphasize predictive performance, typically through accuracy, F1-score, AUROC, or AUPR. These metrics are necessary but not sufficient to understand whether a model is numerically stable, operationally useful, and transferable across datasets. In particular, accuracy can be misleading under class imbalance, while AUROC and AUPR describe ranking behavior but do not fully determine the quality of a deployed binary decision rule [4,5,6]. For operational intrusion detection, the false alarm rate (FAR) is especially important because excessive false positives can make a detector impractical even when recall is high.

A second limitation is that preprocessing is often treated as a routine step rather than as a numerical component of the learning pipeline. Feature scaling is commonly applied before linear or distance-based learning algorithms, but its effect is rarely quantified in IDS studies through explicit conditioning analysis. From a numerical linear algebra perspective, ill-conditioned feature matrices can increase the sensitivity of optimization and estimation procedures to perturbations in the data [7]. Therefore, analyzing the condition number of traffic-feature matrices can provide a more rigorous justification for preprocessing decisions such as imputation and standard scaling.

A third challenge concerns cross-dataset generalization. A detector trained and validated on a single dataset may not preserve its decision behavior under distribution shift. Dataset shift occurs when the data-generating distribution differs between training and deployment conditions [8]. In domain adaptation theory, performance on a target domain depends not only on source-domain performance but also on the discrepancy between source and target distributions [9]. This issue is especially relevant for IDS evaluation because traffic-generation processes, feature extraction pipelines, attack taxonomies, and label semantics may differ substantially across datasets.

This paper addresses these issues through a numerical-computational analysis of ${\ell }_2$-regularized logistic learning for binary intrusion detection. The objective is not to introduce a new IDS architecture. Instead, the study uses a simple convex model as an interpretable probe to examine how numerical conditioning, scaling, feature-set design, class imbalance, threshold selection, and cross-dataset transfer interact across heterogeneous IDS datasets.

The paper makes the following contributions:

• It introduces a reproducible experimental pipeline for binary IDS evaluation across CICIDS2017, UNSW-NB15, and CIRA-CIC-DoHBrw-2020, using five fixed random seeds and explicit train-validation-test split validation.
• It quantifies the numerical conditioning of raw and scaled feature matrices, showing that standard scaling reduces condition numbers by several orders of magnitude across datasets and feature configurations.
• It evaluates ${\ell }_2$-regularized logistic regression under common and dataset-specific feature sets, demonstrating that richer feature sets may improve ranking metrics while degrading thresholded operational behavior.
• It performs a scaling ablation showing that improved conditioning does not always imply monotonic gains in F1-score, but may reduce false-alarm instability in highly imbalanced settings.
• It analyzes cross-dataset transfer using common standardized traffic features, revealing strong source-target asymmetry and threshold-transfer failures.
• It quantifies feature-level distribution shift using a bounded Kolmogorov–Smirnov-based score and relates distributional mismatch to transfer degradation.

The remainder of the paper is organized as follows. Section 2 reviews related work on IDS datasets, imbalanced evaluation, numerical conditioning, regularized linear learning, and dataset shift. Section 3 describes the datasets, preprocessing, splitting protocol, regularized model, threshold selection, transfer protocol, and distribution-shift analysis. Section 4 presents the numerical and predictive results. Section 5 discusses implications, limitations, and future work. Finally, Section 6 summarizes the main findings.

Unlike prior IDS benchmarking studies that primarily emphasize predictive comparison among classifiers, this work focuses on the numerical and operational mechanisms underlying regularized intrusion detection. Its novelty lies in jointly analyzing matrix conditioning, scaling effects, ${\ell }_2$-regularized optimization, threshold selection, false-alarm behavior, cross-dataset degradation, and feature-level distribution shift within a reproducible experimental pipeline. Therefore, the contribution is not a new IDS architecture, but a numerical-computational framework for understanding when and why regularized IDS models remain stable, fail operationally, or degrade under dataset shift.

2. Related Work

2.1. Benchmark Datasets for Intrusion Detection

Benchmark datasets are essential for reproducible intrusion detection research. CICIDS2017 was designed to include benign traffic and several attack families, addressing limitations of older IDS datasets such as outdated traffic patterns and insufficient attack diversity [1]. UNSW-NB15 was generated using the IXIA PerfectStorm tool and contains both normal and attack traffic with a mixture of flow and content features [2]. CIRA-CIC-DoHBrw-2020 focuses on encrypted DNS-over-HTTPS traffic and supports layered detection tasks, including DoH identification and malicious DoH detection [3].

These datasets differ not only in size and class balance but also in feature definitions, traffic-generation procedures, and label semantics. Such heterogeneity is useful for testing robustness, but it complicates direct cross-dataset comparison. For this reason, the present study separates in-domain experiments from cross-dataset transfer experiments and restricts transfer analysis to features that are available and semantically comparable across datasets.

2.2. Evaluation under Class Imbalance

Class imbalance is a central issue in intrusion detection because benign and malicious samples are often unevenly represented. Imbalanced learning has been extensively studied, and prior work has shown that conventional accuracy may provide an incomplete view of performance when one class dominates the dataset [10]. This is particularly relevant in IDS settings, where false negatives and false positives have different operational consequences.

ROC analysis is widely used for classifier evaluation and provides a threshold-independent view of the tradeoff between true-positive and false-positive rates [5]. However, precision-recall analysis is often more informative in imbalanced binary classification because it directly reflects the behavior of the positive class under skewed class distributions [4,6]. For this reason, the present study reports AUROC and AUPR together with thresholded metrics such as F1-score, balanced accuracy, recall, precision, and FAR.

2.3. Numerical Conditioning and Feature Scaling

Feature scaling is standard in many machine learning workflows, especially for linear models and optimization-based algorithms. Nevertheless, its numerical effect is often not explicitly reported in IDS studies. From a numerical analysis perspective, the condition number of a matrix measures the sensitivity of computations to perturbations and finite-precision effects [7]. A large condition number indicates that small changes in the input may be amplified in downstream calculations.

IDS feature matrices can be naturally ill-conditioned because they combine features with very different scales and units. Examples include duration, packet counts, byte counts, rates, and port numbers. In such settings, standardization can improve numerical conditioning by centering and rescaling each feature. The present work explicitly measures this effect through the spectral condition number before and after scaling.

2.4. Regularized Linear Models

Regularized logistic regression remains a useful baseline for binary classification because it is convex, interpretable, and computationally efficient. Large-scale linear classification libraries such as LIBLINEAR support logistic regression and linear support vector machines and have demonstrated the practical relevance of regularized linear models [11]. In this study, logistic regression is not used as a state-of-the-art IDS model, but as a controlled mathematical probe for analyzing the interaction between feature conditioning, regularization, imbalance-aware weighting, and threshold selection.

The use of ${\ell }_2$ regularization is especially appropriate in this context because it constrains the coefficient norm and improves the stability of the fitted linear decision function. This allows the analysis to focus on numerical and operational effects without introducing the additional complexity of nonlinear architectures.

2.5. Dataset Shift and Cross-Dataset Transfer

Dataset shift arises when the training and test distributions differ. The problem has been formalized in machine learning as a mismatch between the joint distributions of inputs and outputs across stages or domains [8]. Domain adaptation theory further shows that target-domain performance depends on both source-domain performance and the discrepancy between source and target domains [9]. These ideas are directly relevant to IDS evaluation because a model trained on one traffic corpus may encounter substantially different feature distributions and label priors in another.

The present study evaluates direct cross-dataset transfer without target-domain recalibration. This is a deliberately strict setting: the source-fitted imputer, scaler, model coefficients, and decision threshold are applied unchanged to the target dataset. This protocol makes it possible to isolate threshold-transfer failures and operational degradation under distribution shift.

Recent cross-dataset IDS studies have shown that models trained on one traffic dataset may generalize poorly to unseen datasets, even when in-domain performance is high. However, these studies usually emphasize predictive degradation across classifiers, whereas the present work focuses on the numerical and operational factors behind such degradation, including conditioning, scaling, transferred thresholds, FAR variation, and KS-based feature shift.

2.6. Calibration and Threshold Transfer

Binary classifiers produce scores or probabilities, but the conversion of scores into decisions depends on a threshold. Under distribution shift, a threshold selected on the source validation set may not remain appropriate for the target domain. Calibration research has shown that predicted probabilities may become unreliable, and that confidence estimates can degrade under shifted data conditions [12,13]. Although the present study does not perform post-transfer recalibration, it explicitly evaluates how source-selected thresholds behave when transferred to a different dataset.

This threshold-centered perspective is important for IDS deployment. A transferred model may retain partial ranking ability while failing operationally because its decision threshold produces either almost no positive detections or an excessive number of false alarms. Therefore, cross-dataset evaluation should report both ranking metrics and thresholded operational metrics.

3. Materials and Methods

3.1. Study Design and Scope

This study evaluates numerically stabilized regularized learning for binary network-traffic detection under class imbalance and dataset shift. The central objective is not to propose a new intrusion-detection architecture, but to analyze how numerical conditioning, feature scaling, ${\ell }_2$-regularized optimization, threshold selection, and cross-dataset transfer interact in heterogeneous intrusion-detection datasets.

The experimental design focuses exclusively on binary targets. For CICIDS2017 and UNSW-NB15, the negative class corresponds to benign or normal traffic and the positive class corresponds to attack traffic. For CIRA-CIC-DoHBrw-2020 Layer 2, the negative class corresponds to benign DoH traffic and the positive class to malicious DoH traffic. CIRA-CIC-DoHBrw-2020 Layer 1 was retained only for in-domain binary experiments, since its task is protocol-level discrimination, i.e., DoH versus non-DoH, rather than benign-versus-attack detection. Consequently, Layer 1 was excluded from cross-dataset transfer experiments to avoid mixing incompatible label semantics.

CIRA-CIC-DoHBrw-2020 Layer 3 was not included because the present study was restricted to binary detection tasks with validated label semantics. Layer 3 introduces a finer-grained label structure that would require a separate multiclass or hierarchical evaluation protocol, which is beyond the scope of this work.

3.2. Datasets

Four processed binary datasets were considered: CICIDS2017, UNSW-NB15, CIRA-CIC-DoHBrw-2020 Layer 1, and CIRA-CIC-DoHBrw-2020 Layer 2. CICIDS2017 is a modern intrusion-detection dataset generated to include benign traffic and multiple attack families [1]. UNSW-NB15 is a widely used network intrusion-detection benchmark containing normal and attack traffic generated using the IXIA PerfectStorm tool [2]. CIRA-CIC-DoHBrw-2020 focuses on DNS-over-HTTPS traffic and includes both protocol-level and malicious-DoH detection scenarios [3].

Table 1 summarizes the processed datasets used in the experiments. The binary class imbalance is substantial in several cases, particularly in DoH-Combined-L2, where malicious DoH traffic accounts for more than 92% of the samples. This imbalance motivated the use of balanced accuracy, AUPR, F1-score, and false alarm rate in addition to standard accuracy.

3.3. Feature Sets

Two feature configurations were evaluated. The first one, denoted as common features, contains only variables that are available and reasonably comparable across all processed datasets:

$${\mathcal{X}}_{common}=\{\mathtt{duration},\mathtt{bytes}\_\mathtt{fwd},\mathtt{bytes}\_\mathtt{bwd},\mathtt{bps}\}.$$

These features were used in all in-domain experiments and were the only features used for cross-dataset transfer analysis.

The second configuration, denoted as dataset features, uses all available numerical variables that were meaningful within each dataset after schema harmonization. These features were used only for in-domain comparison, because variables such as ports, packet counts, packets per second, and protocol-specific fields are not consistently available across all datasets.

The feature-availability audit showed that the four common features were present in all datasets with negligible missingness, except for bps in UNSW-NB15, which had a missing rate of approximately 1.4%. By contrast, several candidate features were structurally absent from some datasets: src_port was absent from CICIDS2017 and UNSW-NB15, dst_port was absent from UNSW-NB15, and packet-count features were absent from the DoH datasets. This justified the separation between in-domain feature sets and the common cross-dataset feature set.

3.4. Splitting Protocol and Reproducibility

All experiments were repeated over five fixed random seeds:

$$\mathcal{S}=\{0,42,1337,2026,9999\}.$$

For CICIDS2017 and the DoH datasets, stratified train-validation-test splits were generated with proportions 70%, 15%, and 15%, respectively. For UNSW-NB15, the official train-test split was preserved; the validation set was obtained by stratified sampling from the official training partition. Split-integrity checks confirmed zero overlap between train, validation, and test identifiers for every dataset and seed.

All preprocessing transformations were fitted exclusively on the training partition. For cross-dataset transfer, the imputer and scaler were fitted on the source training set and then applied unchanged to the target test set. This prevents information leakage and reflects a realistic transfer setting.

3.5. Numerical Preprocessing and Conditioning Audit

Missing numerical values and non-finite values were handled through median imputation. The default numerically stabilized preprocessing pipeline consisted of median imputation followed by standard scaling:

$$z_{ij}={\displaystyle \frac{x_{ij}-{\mu }_j}{{\sigma }_j}},$$

where ${\mu }_j$ and ${\sigma }_j$ were estimated only from the corresponding training split.

The effect of scaling was quantified using the spectral condition number of the design matrix,

$${\kappa }_2\left(X\right)={\displaystyle \frac{{\sigma }_{max}\left(X\right)}{{\sigma }_{min}\left(X\right)}},$$

where ${\sigma }_{max}\left(X\right)$ and ${\sigma }_{min}\left(X\right)$ denote the largest and smallest nonzero singular values of X. The condition number is a standard indicator of sensitivity in numerical linear algebra and is closely related to the stability of least-squares and optimization computations [7]. For each dataset, seed, and feature set, condition numbers were computed for the imputed raw matrix and for the imputed-scaled matrix.

3.6. Regularized Logistic Learning

The main predictive model was ${\ell }_2$-regularized logistic regression. Given training pairs ${\left\{(x_i,y_i)\right\}}_{i=1}^n$, with $y_i\in \{0,1\}$, the model estimates a linear score

$$s_i={\beta }^{\top }{x}_i+b,$$

and posterior probability

$$p_i={\displaystyle \frac{1}{1+exp(-s_i)}}.$$

The optimized objective can be written as

$$\underset{\beta ,b}{min}{\displaystyle \frac{1}{n}}{\displaystyle \sum _{i=1}^n}{w}_{y_i}\left[-y_{i}log\left(p_i\right)-(1-y_i)log(1-p_i)\right]+{\displaystyle \frac{\lambda }{2}}{\parallel \beta \parallel }_2^2,$$

where $w_{y_i}$ denotes class-balanced weights and $\lambda$ controls the strength of regularization. The inverse regularization parameter $C=1/\lambda$ was selected from

$$C\in \{0.01,0.1,1.0,10.0\}.$$

Regularized logistic regression was selected because it is convex, interpretable, computationally efficient, and directly connected to numerical conditioning and feature scaling [11,14].

All models were implemented in Python using scikit-learn [15]. The solver was lbfgs, the maximum number of iterations was set sufficiently high for convergence in all experiments, with 1500 iterations used in the ablation and transfer analyses, and class weights were balanced automatically from the training class frequencies.

3.7. Hyperparameter and Threshold Selection

For each dataset, seed, feature set, and preprocessing configuration, the regularization parameter C was selected on the validation set. Since class imbalance affects decision quality, the decision threshold was not fixed at 0.5. Instead, for each candidate C, thresholds were searched over

$$\tau \in \{0.01,0.02,\dots ,0.99\}.$$

The selected threshold maximized validation balanced accuracy, followed by F1-score, and then minimized false alarm rate. The final value of C was selected using validation balanced accuracy, F1-score, false alarm rate, and AUPR as tie-breakers. The selected C and threshold were then applied unchanged to the test set.

3.8. Evaluation Metrics

Performance was evaluated using accuracy, balanced accuracy, precision, recall, F1-score, area under the receiver-operating-characteristic curve (AUROC), area under the precision-recall curve (AUPR), and false alarm rate (FAR). Because several datasets are highly imbalanced, AUPR was included as a ranking metric that is more informative than AUROC in skewed binary classification problems [4,6].

The false alarm rate was defined as

$$\mathrm{FAR}={\displaystyle \frac{FP}{FP+TN}},$$

where $FP$ denotes false positives and $TN$ denotes true negatives. Balanced accuracy was defined as

$$\mathrm{BA}={\displaystyle \frac{1}{2}}\left({\displaystyle \frac{TP}{TP+FN}}+{\displaystyle \frac{TN}{TN+FP}}\right).$$

Across the five seeds, results were reported as mean ± 95% confidence interval. Since $n=5$, confidence intervals were computed using the Student-t multiplier $t_{0.975,4}=2.776$.

3.9. Scaling Ablation

To determine whether improved numerical conditioning translated into predictive gains, two preprocessing variants were compared:

$$\mathtt{imputed}\_\mathtt{raw}:\mathrm{median}\mathrm{imputation}\mathrm{only},$$

and

$$\mathtt{imputed}\_\mathtt{scaled}:\mathrm{median}\mathrm{imputation}\mathrm{followed}\mathrm{by}\mathrm{standard}\mathrm{scaling}.$$

Both variants used the same logistic model, regularization grid, validation threshold search, and test protocol.

3.10. Cross-Dataset Transfer Protocol

Cross-dataset transfer was evaluated using only the common features. A model was trained on the source dataset training split, hyperparameters and thresholds were selected on the source validation split, and the resulting pipeline was evaluated on the target dataset test split. The source-fitted median imputer, standard scaler, model coefficients, and decision threshold were transferred without adaptation.

Cross-dataset transfer was performed only among CICIDS2017, UNSW-NB15, and DoH-Combined-L2. DoH-Combined-L1 was excluded from transfer because its positive class denotes DoH traffic rather than malicious or attack traffic. Therefore, including it in benign-versus-attack transfer matrices would confound protocol identification with intrusion detection.

3.11. Relative Transfer Degradation

To quantify out-of-distribution degradation, each transfer result was compared against the in-domain performance of the target dataset. For a metric M where larger values are better, the retention ratio was defined as

$$R_M(A\to B)={\displaystyle \frac{M(A\to B)}{M(B\to B)}}.$$

For FAR, where lower values are better, the transfer delta was defined as

$${\Delta }_{\mathrm{FAR}}(A\to B)=\mathrm{FAR}(A\to B)-\mathrm{FAR}(B\to B).$$

Thus, positive FAR deltas indicate worse operational behavior than the target in-domain baseline.

3.12. Distribution-Shift Analysis

To quantify feature-level distribution shift, source training and target test distributions were compared after applying source-fitted median imputation and standard scaling. For each common feature, the two-sample Kolmogorov–Smirnov (KS) statistic was computed [16]. Wasserstein distance was also computed as a secondary descriptive metric grounded in optimal transport [17]. However, because Wasserstein distance and location differences are unbounded and may be dominated by heavy-tailed traffic features, the primary bounded shift score was defined as the mean KS statistic across the four common features:

$$D_{\mathrm{KS}}(A\to B)={\displaystyle \frac{1}{4}}{\displaystyle \sum _{j=1}^4}{D}_{\mathrm{KS}}^{\left(j\right)}(A_{\mathrm{train}},B_{\mathrm{test}}).$$

This score lies in $[0,1]$ and is therefore more suitable for cross-pair comparison than unbounded distance averages.

4. Results

4.1. Numerical Conditioning

Table 2 summarizes the condition-number audit. Standard scaling reduced the condition number by several orders of magnitude in all datasets and feature configurations. The largest effect was observed for UNSW-NB15 common features, where the condition number decreased from approximately $7.93\times {10}^6$ to $1.30$, corresponding to a reduction factor of approximately $6.09\times {10}^6$. CICIDS2017 dataset-specific features also showed strong ill-conditioning before scaling, with a raw condition number of approximately $2.08\times {10}^6$, reduced to approximately $85.9$ after scaling.

These results support the numerical motivation for median imputation followed by standard scaling. The raw feature matrices combine heterogeneous physical units, including durations, byte counts, rates, packet counts, and port numbers. Such heterogeneous scales can produce ill-conditioned design matrices even when the underlying classification task is not intrinsically unstable.

4.2. In-Domain Regularized Logistic Baseline

Table 3 reports the in-domain performance of ${\ell }_2$-regularized logistic regression using scaled preprocessing. Results show that the model provides stable and interpretable baselines across all datasets, but its operational behavior varies substantially by dataset and feature set.

For UNSW-NB15, both feature sets produced stable F1-scores around $0.745$, while dataset-specific features improved AUPR from $0.7633$ to $0.7959$. This indicates that additional features improved ranking quality, but did not materially improve the final thresholded F1-score.

For CICIDS2017, common features produced higher recall but also a higher FAR. Dataset-specific features reduced FAR from $0.3297$ to $0.2766$, but also reduced recall from $0.9103$ to $0.8072$. Thus, the operational trade-off is not captured by a single ranking metric.

For DoH-Combined-L1, common features outperformed dataset-specific features in accuracy, F1-score, and FAR. This is an important result: adding more available variables did not improve operational decision quality. For DoH-Combined-L2, dataset-specific features achieved a slightly higher AUPR, but strongly reduced recall and F1-score while lowering FAR. This again shows that AUPR and thresholded operational metrics may disagree under imbalance.

4.3. Effect of Scaling on Predictive Performance

Table 4 reports the scaling ablation results for ${\ell }_2$-regularized logistic regression. The comparison evaluates two preprocessing variants: median imputation without scaling and median imputation followed by standard scaling. This experiment is important because the numerical conditioning audit showed that scaling substantially reduces the condition number of the feature matrices; however, Table 4 shows that this numerical improvement does not translate into uniformly superior predictive performance.

Although standard scaling consistently improved numerical conditioning, its predictive effect was not uniformly monotonic. In CICIDS2017 with dataset-specific features, the raw-imputed model obtained a slightly higher F1-score ($0.5579\pm 0.0019$) than the scaled model ($0.5502\pm 0.0047$), whereas the scaled model reduced FAR from $0.3052\pm 0.0011$ to $0.2766\pm 0.0077$. This suggests that scaling made the model less aggressive in terms of false alarms, but did not improve thresholded F1-score in this configuration.

For DoH-Combined-L1, Table 4 shows that raw and scaled preprocessing produced nearly identical results in both common and dataset-specific feature configurations. This indicates that, for this dataset, scaling improved numerical conditioning without substantially changing the learned decision behavior. In contrast, DoH-Combined-L2 with common features shows a clearer operational trade-off: the raw model achieved a higher F1-score ($0.9036\pm 0.0391$), but with a much larger and more unstable FAR ($0.4394\pm 0.1752$). Scaling reduced FAR to $0.2959\pm 0.0406$ and improved balanced accuracy from $0.7075\pm 0.0491$ to $0.7467\pm 0.0167$, although F1-score decreased to $0.8708\pm 0.0038$.

The results in Table 4 therefore support a nuanced conclusion: scaling is strongly justified from a numerical-conditioning perspective, but its predictive effect depends on the dataset, feature set, class imbalance, and threshold behavior. In particular, scaling may improve operational stability by reducing false-alarm variability, as observed in DoH-Combined-L2, even when it does not maximize F1-score. Consequently, numerical conditioning, ranking quality, thresholded F1-score, and false-alarm behavior must be evaluated jointly rather than interpreted as equivalent indicators.

4.4. Cross-Dataset Transfer

Cross-dataset transfer was evaluated using only the four common features and scaled preprocessing. Table 5 shows the F1-score transfer matrix. The diagonal entries correspond to in-domain performance, while off-diagonal entries correspond to transfer from a source dataset to a different target dataset.

The results reveal strong asymmetry. CICIDS2017 did not transfer effectively to either UNSW-NB15 or DoH-Combined-L2, yielding near-zero F1-scores. Conversely, UNSW-NB15 transferred partially to DoH-Combined-L2, achieving $0.8921\pm 0.0011$ F1-score, slightly above the DoH-L2 in-domain F1-score. However, this transfer also produced a high FAR, as shown in Table 6. Therefore, this transfer direction should be interpreted as partial detection transfer rather than operationally robust deployment.

The transfer from UNSW-NB15 to CICIDS2017 is especially illustrative. It achieved high recall, but FAR reached $0.9796\pm 0.0012$, meaning that nearly all benign CICIDS2017 samples were incorrectly marked as positive. This confirms that recall alone is insufficient for operational IDS evaluation. The transferred threshold can collapse under distribution shift, producing either nearly no attack detections or excessive false alarms.

4.5. Relative Transfer Degradation

To compare transfer directions relative to target in-domain baselines, retention ratios were computed. Table 7 reports F1 retention and FAR delta for off-diagonal transfer directions. CICIDS2017 retained virtually no F1-score when transferred to UNSW-NB15 or DoH-L2. DoH-L2 retained about $51\%$ of the CICIDS2017 in-domain F1-score, but increased FAR by $0.3195$. UNSW-NB15 retained $102.46\%$ of the DoH-L2 in-domain F1-score, but increased FAR by $0.0991$.

These findings show that transfer is highly asymmetric. Some directions preserve part of the detection capability, but at unacceptable operational cost. Other directions reduce FAR only because the model almost never predicts the positive class. Therefore, transfer degradation must be analyzed jointly through F1 retention and FAR change.

4.6. Distribution Shift Across Datasets

Table 8 reports the KS-based distribution-shift matrix computed over the four common features. In-domain shift scores were low: $0.0033\pm 0.0007$ for CICIDS2017, $0.0050\pm 0.0017$ for DoH-L2, and $0.0646\pm 0.0012$ for UNSW-NB15. By contrast, all cross-dataset shift scores were substantially larger, ranging from $0.5411\pm 0.0023$ to $0.6725\pm 0.0010$.

The distribution-shift results support the interpretation that cross-dataset transfer failures are associated with substantial feature-distribution mismatch. However, the relationship is not strictly monotonic. The transfer from UNSW-NB15 to DoH-L2 achieved high F1 retention despite a high KS shift score. This indicates that distribution shift is an important explanatory factor, but not the only one. Threshold transferability, class imbalance, source-target label semantics, and directional effects also influence operational behavior.

Exploratory correlations between shift scores and transfer-retention metrics were computed only over six off-diagonal source-target pairs. Because of the small number of pairs, these correlations should be interpreted cautiously. The analysis did not provide sufficient evidence to claim a simple monotonic relationship between larger distribution shift and lower F1 retention. Therefore, the main conclusion is that distribution shift helps explain transfer degradation, but does not fully determine it.

5. Discussion

The results provide evidence that numerical conditioning, feature scaling, class imbalance, threshold selection, and cross-dataset transfer cannot be treated as independent design decisions in intrusion-detection pipelines. Although the predictive model used in this work is intentionally simple, the experiments reveal several non-trivial effects that are directly relevant to applied numerical analysis and computational learning.

First, the numerical audit showed that the raw feature matrices were often severely ill-conditioned before scaling. This was especially visible in UNSW-NB15, where the condition number of the common-feature matrix was reduced from approximately $7.93\times {10}^6$ to approximately $1.30$ after standard scaling. Similar reductions were observed in CICIDS2017 and the DoH datasets. This supports the use of scaling not merely as a conventional preprocessing step, but as a numerically motivated transformation that improves the conditioning of the optimization problem. Such behavior is consistent with classical numerical linear algebra, where ill-conditioning is associated with increased sensitivity of computations to perturbations in the data [7].

Second, the scaling ablation showed that improved conditioning does not automatically imply monotonic improvements in all predictive metrics. In some cases, raw-feature optimization achieved comparable or higher F1-score, whereas scaled preprocessing reduced false alarm instability. The clearest example was DoH-Combined-L2 with common features: the raw model obtained higher F1-score, but with a substantially larger and more variable false alarm rate; the scaled model produced lower F1-score but a more controlled FAR. This suggests that the practical value of numerical stabilization should be evaluated jointly with operational metrics, not only with ranking metrics or threshold-independent measures.

Third, the comparison between common features and dataset-specific features showed that adding more variables does not necessarily improve operational performance. In DoH-Combined-L1, the common-feature configuration achieved better F1-score and lower FAR than the dataset-specific configuration, despite the latter achieving higher AUROC and AUPR. In DoH-Combined-L2, dataset-specific features slightly improved AUPR but strongly reduced recall and F1-score while lowering FAR. This confirms that ranking quality and thresholded operational quality can diverge under class imbalance. This observation is aligned with prior work showing that ROC and PR analyses capture different aspects of classifier behavior, especially in skewed binary problems [4,5,6].

Fourth, the cross-dataset transfer experiments showed that numerically stabilized common features were not sufficient to guarantee robust out-of-distribution generalization. In-domain performance was relatively stable, but off-diagonal transfer was highly asymmetric. Models trained on CICIDS2017 almost completely failed to detect positive samples in UNSW-NB15 and DoH-Combined-L2, producing near-zero F1-scores. Conversely, the model trained on UNSW-NB15 transferred partially to DoH-Combined-L2 in terms of F1-score, but at the cost of a higher false alarm rate. This behavior is consistent with the broader dataset-shift literature, where performance can degrade when the joint distribution of features and labels differs between training and deployment conditions [8,13].

Fifth, threshold transferability emerged as a major limitation. The transferred source-domain thresholds frequently collapsed on the target domain, leading to two opposite operational failures: almost no positive detections, as in CICIDS2017-to-UNSW-NB15 and CICIDS2017-to-DoH-L2, or excessive false alarms, as in UNSW-NB15-to-CICIDS2017. This indicates that a model may retain some ranking ability while still failing as a decision system if the operating threshold is not recalibrated. This point is related to calibration research, which has shown that predicted probabilities and decision confidence may become unreliable under distributional changes [12,13].

Sixth, the distribution-shift analysis confirmed that the in-domain train–test discrepancies were small, whereas cross-dataset discrepancies were consistently large under the bounded KS-based score. The in-domain KS scores were close to zero for CICIDS2017 and DoH-Combined-L2, while all cross-dataset scores were above $0.54$. This supports the interpretation that transfer degradation is associated with substantial distributional mismatch in common traffic features. However, the relationship was not strictly monotonic. The transfer from UNSW-NB15 to DoH-Combined-L2 achieved high F1 retention despite a large KS shift score. Therefore, distribution shift is an important explanatory factor, but not a sufficient condition for predicting transfer failure by itself. Directionality, class priors, threshold selection, and label semantics also matter.

The results also show why DoH-Combined-L1 should not be included in cross-dataset benign-versus-attack transfer. Its positive class represents DoH traffic rather than malicious traffic, and therefore it corresponds to protocol identification rather than intrusion detection. Including it in the transfer matrix would mix different binary semantics and could produce misleading conclusions. Similarly, DoH-Combined-L3 was excluded because the present study focuses on binary detection and the validated processed data used in the experiments covered Layer 1 and Layer 2. Adding Layer 3 would require a separate label-mapping and validation strategy.

Overall, the main finding is not that a simple regularized logistic model is sufficient for intrusion detection, but that such a model provides a useful mathematical probe for studying numerical and operational behavior. Its convex objective, low computational cost, and sensitivity to feature scaling make it suitable for analyzing the interaction between conditioning, regularization, class imbalance, and transfer degradation. More complex models may improve absolute predictive performance, but they may also obscure the numerical mechanisms that this study aims to isolate.

5.1. Implications

The findings have three practical implications. First, preprocessing should be justified numerically when models are trained on heterogeneous traffic features with different physical units. Second, intrusion-detection evaluation should report operational metrics such as FAR together with F1-score, AUROC, and AUPR. Third, cross-dataset validation should not rely only on in-domain test performance, because transferred thresholds may fail under distribution shift even when the model performs acceptably on the source dataset.

5.2. Limitations

This study has several limitations. First, it focuses on binary classification only. Multiclass intrusion detection was not evaluated because several CICIDS2017 attack classes contain very few samples, which would require a different evaluation strategy. Second, the main predictive model is restricted to ${\ell }_2$-regularized logistic regression. This is intentional for numerical interpretability, but it limits claims about deep or ensemble models. Third, the distribution-shift correlation analysis was exploratory because only six off-diagonal source–target pairs were available. Therefore, the results should not be interpreted as proving a universal monotonic relationship between KS shift and transfer degradation. Fourth, cross-dataset transfer was evaluated without target-domain recalibration. This was appropriate for testing direct transferability, but future work should evaluate source-free calibration, unsupervised adaptation, and domain-alignment strategies.

5.3. Future Work

Future work should extend the framework in four directions. First, multiclass detection should be analyzed with class-aware metrics and rare-class handling. Second, regularized linear models should be compared with tree ensembles, kernel methods, and lightweight neural architectures under the same numerical audit. Third, post-transfer threshold recalibration should be evaluated to determine whether the observed collapse is mainly due to score miscalibration or deeper representation mismatch. Fourth, the distribution-shift analysis should be extended with multivariate distances and domain-adaptation diagnostics, since univariate KS statistics may not capture feature interactions.

6. Conclusions

This paper presented a numerical-computational analysis of ${\ell }_2$-regularized logistic learning for binary intrusion detection under heterogeneous datasets, class imbalance, and cross-dataset shift. The goal was not to propose a new IDS architecture, but to examine how numerical conditioning, feature scaling, feature-set design, threshold selection, and distribution shift affect operational detection behavior.

The numerical audit showed that median imputation followed by standard scaling reduced the spectral condition number of the feature matrices by several orders of magnitude across CICIDS2017, UNSW-NB15, and CIRA-CIC-DoHBrw-2020. This confirms that preprocessing is not merely a routine engineering step, but a numerically relevant component of the learning pipeline when traffic features combine heterogeneous physical units such as durations, byte counts, packet rates, and ports.

The in-domain experiments showed that ${\ell }_2$-regularized logistic regression provides a stable and interpretable baseline across heterogeneous IDS datasets. However, the relationship between feature richness and operational performance was non-monotonic. Dataset-specific features sometimes improved ranking metrics such as AUROC or AUPR, but did not necessarily improve F1-score or false alarm behavior. This finding is especially relevant for IDS evaluation, where a model with strong ranking performance may still be operationally problematic if its thresholded decisions generate excessive false alarms.

The scaling ablation further showed that better numerical conditioning does not automatically imply uniformly better predictive performance. In some cases, raw-feature optimization achieved comparable or higher F1-score, whereas scaled preprocessing produced more controlled false alarm behavior. Therefore, numerical stability, ranking quality, thresholded detection quality, and false alarm rate should be analyzed jointly rather than treated as interchangeable indicators.

The cross-dataset transfer experiments revealed strong source-target asymmetry. Models trained on CICIDS2017 failed to transfer effectively to UNSW-NB15 and DoH-Combined-L2, while UNSW-NB15 transferred partially to DoH-Combined-L2 in terms of F1-score but at the cost of increased false alarms. These results indicate that common numerically stabilized features are not sufficient to guarantee robust out-of-distribution generalization. In particular, source-selected thresholds may collapse on target datasets, producing either near-zero positive detection or excessive false alarms.

The distribution-shift analysis confirmed that in-domain discrepancies were small, whereas cross-dataset discrepancies were consistently large under the bounded KS-based shift score. Nevertheless, the relationship between distribution shift and transfer degradation was not strictly monotonic. This suggests that distributional mismatch is an important explanatory factor, but not the only determinant of transfer behavior. Threshold calibration, class priors, label semantics, and source-target directionality also play important roles.

Overall, the main contribution of this work is a reproducible numerical-computational framework that links matrix conditioning, scaling, regularized optimization, class imbalance, operational IDS metrics, cross-dataset transfer degradation, and feature-level distribution shift. Future work should extend this framework to multiclass detection, nonlinear and ensemble models, post-transfer threshold recalibration, and domain adaptation methods.