AUTOSIGNAL 车智信号

Human-curated. Expert-annotated. Every signal traced to source. 人工精选 · 专家点评 · 每条信号可溯源

Research Frontier研究前沿

Lightweight IDS Models Show ~90% Performance Drop Across Industrial Networks轻量级工业网络入侵检测模型跨域泛化严重失效

S 1.7 T1 1 sources1 个来源 R7-research

Researchers trained four lightweight intrusion detection architectures (Decision Tree, small MLP, 1D-CNN, LSTM) on Edge-IIoTset and evaluated them without retraining on two independent datasets (Gotham 2025, WUSTL-IIoT-2021) to assess cross-domain generalization.
F1 scores collapsed dramatically from ~0.97 in-domain to 0.09–0.28 cross-domain across all models; the "port shortcut" vulnerability persists despite mitigation attempts, with top features appearing 96–435x more frequently in source-domain attack traffic than targets.
Balanced sampling reversed dataset difficulty rankings compared to natural imbalanced distributions; the best cross-domain performer (SmallLSTM) showed weakest adversarial robustness; few-shot recovery was architecture-dependent, with Decision Tree and LSTM recovering substantially while 1D-CNN barely improved.

研究人员在 Edge-IIoTset 上训练了四种轻量级入侵检测架构（决策树、小型 MLP、1D-CNN、LSTM），在两个独立数据集（Gotham 2025、WUSTL-IIoT-2021）上进行了跨域评估，以测试泛化能力。
F1 分数从同域的约 0.97 严重下降到跨域的 0.09–0.28；"端口捷径"漏洞持续存在，即使采取了缓解措施，最重要的特征在源域攻击流量中的出现频率比目标域高 96–435 倍。
平衡采样与自然不平衡分布下的数据集难度排名相反；跨域性能最佳的模型（SmallLSTM）对抗性鲁棒性最弱；少次学习恢复能力因架构而异，决策树和 LSTM 有显著改进，而 1D-CNN 几乎没有改进。

hf-daily-papers