Bridging Training-Deployment Gap in Intrusion Detection With Source-Free Domain Adaptation

Abstract

Machine learning (ML)–based intrusion detection systems (IDS) frequently degrade when deployed across heterogeneous networks due to domain shifts in traffic composition and monitoring configurations. Conventional domain adaptation (DA) methods mitigate this issue by aligning source and target distributions, but they often rely on retaining source-domain data at deployment—an impractical requirement that undermines operational scalability and reusability. To address this gap, we propose TRANSFA-IDS (Transformer Source-Free Adaptation for IDS), a lightweight source-free adaptation framework that recalibrates a source-trained IDS using only target traffic data. TRANSFA-IDS converts tabular flow records into structured RGB image embeddings and employs a compact Vision Transformer with a Deep Support Vector Data Description (Deep-SVDD) head to learn transferable normal representations. At deployment, adaptation is performed by fine-tuning only the last transformer block on a small target buffer, realigning target representations without retraining or access to source data. Experiments on cross-dataset transfer between CIC-IDS-2018 and UNSW-NB15 show that TRANSFA-IDS achieves AUROC of 0.9177 and 0.9071 in the two transfer directions, reduces target-domain benign false positives by over 60% relative to the same source-pretrained model deployed without source-free adaptation, and adapts substantially faster than supervised and unsupervised DA baselines while using at most 20% of the target-domain data. These results indicate that source-free adaptation can achieve both strong detection performance and a practical deployment-oriented design, with cross-benchmark evidence of scalable adaptation across heterogeneous network environments.