# DI-NIDS: Domain Invariant Network Intrusion Detection System

arXiv: https://arxiv.org/abs/2210.08252 · HTML: https://mlsanity.com/paper/2210.08252/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 33 references that are in the map.
- First posted on arXiv 15 Oct 2022.

## Builds on (most cited first, 9 of 9)

- [Domain-Adversarial Training of Neural Networks](https://mlsanity.com/paper/1505.07818/) (2015)
- [Unsupervised Domain Adaptation by Backpropagation](https://mlsanity.com/paper/1409.7495/) (2014)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2011.09144/) (2020)
- [Generative Domain Adaptation for Face Anti-Spoofing](https://mlsanity.com/paper/2207.10015/) (2022)
- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [A Transfer Learning Approach for Network Intrusion Detection](https://mlsanity.com/paper/1909.02352/) (2019)
- [A new method for flow-based network intrusion detection using the inverse Potts model](https://mlsanity.com/paper/1910.07266/) (2019)
- [Benchmarking the Benchmark -- Analysis of Synthetic NIDS Datasets](https://mlsanity.com/paper/2104.09029/) (2021)

## Built on by (most cited first, 7 of 7)

- [FlowTransformer: A Transformer Framework for Flow-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2304.14746/) (2023)
- [Towards Explainable Network Intrusion Detection using Large Language Models](https://mlsanity.com/paper/2408.04342/) (2024)
- [Generative Active Adaptation for Drifting and Imbalanced Network Intrusion Detection](https://mlsanity.com/paper/2503.03022/) (2025)
- [Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers](https://mlsanity.com/paper/2409.00667/) (2024)
- [Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks](https://mlsanity.com/paper/2604.12655/) (2026)
- [A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic](https://mlsanity.com/paper/2607.17105/) (2026)
- [Concept drift mitigation through community and spectral graph analysis for the detection of cyberattacks in network traffic](https://mlsanity.com/paper/2609.09442/) (2026)

## Abstract (arXiv)

The performance of machine learning based network intrusion detection systems (NIDSs) severely degrades when deployed on a network with significantly different feature distributions from the ones of the training dataset. In various applications, such as computer vision, domain adaptation techniques have been successful in mitigating the gap between the distributions of the training and test data. In the case of network intrusion detection however, the state-of-the-art domain adaptation approaches have had limited success. According to recent studies, as well as our own results, the performance of an NIDS considerably deteriorates when the `unseen' test dataset does not follow the training dataset distribution. In some cases, swapping the train and test datasets makes this even more severe. In order to enhance the generalisibility of machine learning based network intrusion detection systems, we propose to extract domain invariant features using adversarial domain adaptation from multiple network domains, and then apply an unsupervised technique for recognising abnormalities, i.e., intrusions. More specifically, we train a domain adversarial neural network on labelled source domains, extract the domain invariant features, and train a One-Class SVM (OSVM) model to detect anomalies. At test time, we feedforward the unlabeled test data to the feature extractor network to project it into a domain invariant space, and then apply OSVM on the extracted features to achieve our final goal of detecting intrusions. Our extensive experiments on the NIDS benchmark datasets of NFv2-CIC-2018 and NFv2-UNSW-NB15 show that our proposed setup demonstrates superior cross-domain performance in comparison to the previous approaches.