HAC-IDS

Leakage-aware semantic harmonization and few-shot calibration for cross-dataset intrusion detection in heterogeneous IoT/IIoT environments.

Overview

HAC-IDS is a reproducible research pipeline for evaluating cross-dataset intrusion detection robustness under heterogeneous IoT/IIoT settings. The framework performs dataset auditing, deterministic preprocessing, semantic feature harmonization, leave-one-dataset-out zero-shot evaluation, lightweight few-shot target calibration, statistical validation, ablation analysis, and publication-ready visualization.

This repository supports the paper:

HAC-IDS: Leakage-Aware Semantic Harmonization and Few-Shot Calibration for Cross-Dataset Intrusion Detection in Heterogeneous IoT/IIoT Environments

Datasets

The experiments use four public IDS datasets:

• Edge-IIoTset
• MQTT-IoT-IDS2020
• X-IIoTID
• CICIDS2017

Raw datasets are not included due to size and licensing constraints. Place them under data/raw/ following the structure described in data/README.md.

Repository Structure

HAC-IDS/
|-- configs/
|   `-- paths.example.yaml
|-- data/
|   `-- README.md
|-- docs/
|   `-- README.md
|-- outputs/
|   `-- README.md
|-- scripts/
|   |-- 01_dataset_audit.py
|   |-- 03_stage2A_leakage_safe_cleaning.py
|   |-- 04_stage2B_semantic_harmonization_v3.py
|   |-- 05_stage3A_lodo_semantic_v3.py
|   |-- 06_stage3B_fewshot_calibration.py
|   |-- 07_stage3C_analyze_fewshot_results.py
|   |-- 08_stage4_statistical_validation.py
|   |-- 09_stage5_ablation_summary.py
|   |-- 10_stage6A_raw_vs_semantic_ablation.py
|   |-- 11_stage7_visual_analytics.py
|   |-- 12_stage9_methodology_architecture_map.py
|   `-- 13_generate_publication_figures.py
|-- requirements.txt
`-- README.md