BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection

• URL: http://arxiv.org/abs/2604.11324v1
• Date: Mon, 13 Apr 2026 11:25:39 GMT
• Title: BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection
• Abstract summary: IoT botnet detection has advanced, yet most published systems are validated on a single dataset and rarely generalise across environments.<n>We introduce BRIDGE, the first formally specified heterogeneous multi-dataset benchmark for IoT intrusion detection.<n>We establish the first community generalisation baseline at mean LODO F1 = 0.5577, a result that shifts the agenda from single-benchmark optimisation to cross-environment generalisation.
• Score: 1.2019888796331233
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: IoT botnet detection has advanced, yet most published systems are validated on a single dataset and rarely generalise across environments. Heterogeneous feature spaces make multi-dataset training practically impossible without discarding semantic interpretability or introducing data integrity violations. No prior work has addressed both problems with a formally specified, reproducible methodology. This paper does. We introduce BRIDGE (Benchmark Reference for IoT Domain Generalisation Evaluation), the first formally specified heterogeneous multi-dataset benchmark for IoT intrusion detection, unifying CICIDS-2017, CIC-IoT-2023, Bot-IoT, Edge-IIoTset, and N-BaIoT through a 46-feature semantic canonical vocabulary grounded in CICFlowMeter nomenclature, with genuine-equivalence-only feature mapping, explicit zero-filling, and per-dataset coverage from 15% to 93%. A leave-one-dataset-out (LODO) protocol makes the generalisation gap precisely measurable: all five evaluated architectures achieve mean LODO F1 between 0.39 and 0.47, and we establish the first community generalisation baseline at mean LODO F1 = 0.5577, a result that shifts the agenda from single-benchmark optimisation toward cross-environment generalisation. We propose TCH-Net, a multi-branch network fusing a three-path Temporal branch (residual convolutional-BiGRU, stride-downsampled BiGRU, pre-LayerNorm Transformer), a provenance-conditioned Contextual branch, and a Statistical branch via Cross-Branch Gated Attention Fusion (CB-GAF) with learnable sigmoid gates for dynamic feature-wise mixing. Across five random seeds, TCH-Net achieves F1 = 0.8296 +/- 0.0028, AUC = 0.9380 +/- 0.0025, and MCC = 0.6972 +/- 0.0056, outperforming all twelve baselines (p < 0.05, Wilcoxon) and recording the highest LODO F1 overall. BRIDGE and the full pipeline are at https://github.com/Ammar-ss/TCH-Net.

Related papers

• Long-Range Indirect Control-Flow Prediction in Stripped Binaries via Dual Virtual Hubs and Multi-Task Graph Learning [44.79384874347874]
  We present ICFlowNet, a unified framework for long-range ICF prediction in stripped binaries.<n>ICFlowNet introduces candidate-aware Dual Virtual Hubs, a Global Code Hub and a Global Data Hub.<n>We also develop a leakage-aware, noise-controlled pipeline with package-level splits, function-level mnemonic-hash deduplication, and a clean test protocol.
  arXiv  Detail & Related papers  (2026-09-03T02:17:23Z)
• Architecture-Dependent Causal Transfer of Activation States Across Large Language Models [51.56484100374058]
  Internal language activation states can be transferred causally between different large language models.<n>Injecting projected activations into a target model during generation produces a statistically significant, preregistered causal effect.<n>We conclude that end-to-end activation-state transfer between LLMs, as currently implemented, is architecture-dependent rather than universal.
  arXiv  Detail & Related papers  (2026-08-17T09:53:27Z)
• Provenance, Not Behaviour: A Serialisation Artifact in Edge-IIoTset and a Leakage-Free Benchmark for Precision-Agriculture Intrusion Detection [0.0]
  Edge-IIoTset is the benchmark for machine-learning intrusion detection in the Internet of Things.<n>We show that much of that performance is not intrusion detection.<n>We produce AgriEdge: 1,276,122 rows, five devices with full attribution, and no column separating the classes above 0.0288.
  arXiv  Detail & Related papers  (2026-08-16T14:30:45Z)
• Cross-Layer Intrusion Detection in 5G O-RAN: Gains and Limits of Fusing Radio Telemetry with Network Flow Records [2.992414059774663]
  Open RAN disaggregation enables joint analysis of DU radio telemetry and CU-side network-flow records.<n>We evaluate whether fusing these two modalities improves over each individually across seven architectures.
  arXiv  Detail & Related papers  (2026-06-21T11:48:23Z)
• EEVEE: Towards Test-time Prompt Learning in the Real World for Self-Improving Agents [64.96332056338923]
  EEVEE is the first multi-dataset test-time prompt learning framework for LLM agents.<n>It enables test-time prompt learning under real-world task streams.<n>EEVEE improves average multi-benchmark scores by 10.38 and 24.32 points over Qwen3-4B-Instruct and DeepSeek-V3.2.
  arXiv  Detail & Related papers  (2026-06-09T17:57:16Z)
• Benchmarking Inductive Biases for Multivariate Time-Series Anomaly Detection with a Robust Multi-View Channel-Graph Detector [8.29991973809832]
  Ten family-representative detectors are evaluated on five datasets.<n>All methods share the same windowing, scoring, hardware, and metric protocols.<n>We introduce ours, an adaptive detector family combining a NOTEARS-constrained directed channel-graph view with optional patch-attention and temporal-association views.
  arXiv  Detail & Related papers  (2026-05-27T07:55:44Z)
• R2G: A Multi-View Circuit Graph Benchmark Suite from RTL to GDSII [14.790942679912595]
  R2G is a multi-view circuit-graph benchmark suite that standardizes five stage-aware views with information parity.<n>R2G provides an end-to-end DEF-to-graph pipeline spanning synthesis, placement, and routing stages.
  arXiv  Detail & Related papers  (2026-04-09T22:59:27Z)
• EAGLE: Edge-Aware Graph Learning for Proactive Delivery Delay Prediction in Smart Logistics Networks [0.5653106385738822]
  We propose a hybrid deep learning framework for proactive supply chain risk management.<n>The proposed method jointly models temporal order-flow dynamics via a lightweight Transformer patch encoder.<n>The framework exhibits a cross-seed F1 standard deviation of only 0.0089 -- a 3.8 times improvement over the best ablated variant.
  arXiv  Detail & Related papers  (2026-04-06T23:35:15Z)
• COVTrack++: Learning Open-Vocabulary Multi-Object Tracking from Continuous Videos via a Synergistic Paradigm [59.26203051651017]
  C-TAO is the first continuously annotated training set for Open-Vocabulary Multi-Object Tracking (OVMOT)<n>For the framework bottleneck, we propose COVTrack++, a synergistic framework that achieves a bidirectional reciprocal mechanism between detection and association through three modules.<n>Experiments on TAO demonstrate state-of-the-art performance, with novel TETA reaching 35.4% and 30.5% on validation and test sets, improving novel AssocA by 4.8% and novel LocA by 5.8% over previous methods.
  arXiv  Detail & Related papers  (2026-03-25T07:20:27Z)
• A Comprehensive Forecasting-Based Framework for Time Series Anomaly Detection: Benchmarking on the Numenta Anomaly Benchmark (NAB) [0.0]
  Time series anomaly detection is critical for modern digital infrastructures.<n>We present a forecasting-based framework unifying classical methods with deep learning architectures.<n>We conduct the first complete evaluation on the Numenta Anomaly Benchmark.
  arXiv  Detail & Related papers  (2025-10-13T08:31:42Z)
• Benchmarking Federated Learning for Throughput Prediction in 5G Live Streaming Applications [5.026196568145574]
  This paper presents the first comprehensive benchmarking of federated learning strategies for throughput prediction in realistic 5G edge scenarios.<n>It is found that FedBN consistently delivers robust performance under non-IID conditions.<n>LSTM and Transformer models outperform CNN-based baselines by up to 80% in R2 scores.
  arXiv  Detail & Related papers  (2025-08-11T21:27:40Z)
• LLM-Based Emulation of the Radio Resource Control Layer: Towards AI-Native RAN Protocols [28.04609776570199]
  Large AI Models (LAMs) are key enablers of the AI-Native Air Interface (AI-AI)<n>This paper presents the first standards-compliant emulation of the Radio Resource Control layer using a decoder-only LAM.<n>Results demonstrate that LAMs, when augmented with protocol-aware reasoning, can directly orchestrate control-plane procedures.
  arXiv  Detail & Related papers  (2025-05-22T15:55:56Z)
• Upcycling Models under Domain and Category Shift [95.22147885947732]
  We introduce an innovative global and local clustering learning technique (GLC) We design a novel, adaptive one-vs-all global clustering algorithm to achieve the distinction across different target classes. Remarkably, in the most challenging open-partial-set DA scenario, GLC outperforms UMAD by 14.8% on the VisDA benchmark.
  arXiv  Detail & Related papers  (2023-03-13T13:44:04Z)
• Global Context Vision Transformers [78.5346173956383]
  We propose global context vision transformer (GC ViT), a novel architecture that enhances parameter and compute utilization for computer vision. We address the lack of the inductive bias in ViTs, and propose to leverage a modified fused inverted residual blocks in our architecture. Our proposed GC ViT achieves state-of-the-art results across image classification, object detection and semantic segmentation tasks.
  arXiv  Detail & Related papers  (2022-06-20T18:42:44Z)
• MD-CSDNetwork: Multi-Domain Cross Stitched Network for Deepfake Detection [80.83725644958633]
  Current deepfake generation methods leave discriminative artifacts in the frequency spectrum of fake images and videos. We present a novel approach, termed as MD-CSDNetwork, for combining the features in the spatial and frequency domains to mine a shared discriminative representation.
  arXiv  Detail & Related papers  (2021-09-15T14:11:53Z)
• ReActNet: Towards Precise Binary Neural Network with Generalized Activation Functions [76.05981545084738]
  We propose several ideas for enhancing a binary network to close its accuracy gap from real-valued networks without incurring any additional computational cost. We first construct a baseline network by modifying and binarizing a compact real-valued network with parameter-free shortcuts. We show that the proposed ReActNet outperforms all the state-of-the-arts by a large margin.
  arXiv  Detail & Related papers  (2020-03-07T02:12:02Z)
• R-FCN: Object Detection via Region-based Fully Convolutional Networks [87.62557357527861]
  We present region-based, fully convolutional networks for accurate and efficient object detection. Our result is achieved at a test-time speed of 170ms per image, 2.5-20x faster than the Faster R-CNN counterpart.
  arXiv  Detail & Related papers  (2016-05-20T15:50:11Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.