DIRECTIONAL TRANSFER IN CROSS-NETWORK INTRUSION DETECTION: A LAYERED ARCHITECTURE EVALUATED AGAINST MANDATORY CONTROLS paper DATASETs

DATA (data/): the six network-intrusion domains used in the study (CICIoT2023, Gotham2025, NF-ToN-IoT-v2, NF-UNSW-NB15-v2, NSL-KDD, UNSW-NB15-classic) at three processing stages — harmonized feature tables, size-capped benchmark splits (bench_capped/) used for the main experiments, and full benchmark splits (bench/) — plus 9 pipeline result tables (bibliography, evaluation matrix, claims registry, feature-intersection matrix, benchmark-split summary).

Gotham2025-derived files are built from the openly released Gotham Dataset 2025 (Belarbi et al., Zenodo, CC0). CODE: dais/ (5 scripts) implements the layered detection architecture (DAIS, layers L0-L7: anomaly detection, few-shot adaptation, XAI, integration/cascade). tdi/ (6 scripts) implements the Transfer Directionality Index and its validation. figs/ (8 scripts + 7 rendered figures) generates every figure in the paper directly from the result tables. experiments/ (20 scripts) covers the full pipeline: adversarial evasion/poisoning tests, campaign linking, the baseline training run, and 14 manuscript-production scripts that extract claims, compute every reported number from source, verify the manuscript text against those numbers, assemble the document, and check cross-section consistency.