Wasserstein distance guided feature Tokenizer transformer domain adaptation for network intrusion detection

When deploying a machine learning-based network intrusion detection system in an environment with significantly different feature distribution from the training dataset, its performance is substantially degraded. This paper presents a domain adaptation approach (WDFT-DA) that utilizes Wasserstein Distance and Feature Tokenizer Transformer to address this issue. The proposed method employs Wasserstein distance to measure the dissimilarity between the source and target domains and mitigates it through adversarial training for achieving domain-invariant feature learning. Simultaneously, a feature token converter acts as a feature extractor to obtain domain-invariant representations of network traffic data with rich information content. This facilitates mapping of both source and target domain data into a shared domain-invariant space, promoting feature alignment and representation consistency. As a result, it enhances generalization capability and performance across the target domain. Experimental validation is conducted on diverse intrusion detection datasets, demonstrating that the proposed model outperforms existing domain adaptation methods by effectively training highly accurate intrusion detection classification models without relying on labeled data within the target domain.