DIRECTIONAL TRANSFER IN CROSS-NETWORK INTRUSION DETECTION: A LAYERED ARCHITECTURE EVALUATED AGAINST MANDATORY CONTROLS paper DATASETs

This dataset accompanies the manuscript "Directional Transfer in Cross-Network Intrusion Detection: A Layered Architecture Evaluated Against Mandatory Controls." It contains the code and data needed to reproduce every numeric claim in the paper. DATA (data/): the six network-intrusion domains used in the study (CICIoT2023, Gotham2025, NF-ToN-IoT-v2, NF-UNSW-NB15-v2, NSL-KDD, UNSW-NB15-classic) at three processing stages — harmonized feature tables, size-capped benchmark splits (bench_capped/) used for the main experiments, and full benchmark splits (bench/) — plus 9 pipeline result tables (bibliography, evaluation matrix, claims registry, feature-intersection matrix, benchmark-split summary). Gotham2025-derived files are built from the openly released Gotham Dataset 2025 (Belarbi et al., Zenodo, CC0). CODE: dais/ (5 scripts) implements the layered detection architecture (DAIS, layers L0-L7: anomaly detection, few-shot adaptation, XAI, integration/cascade). tdi/ (6 scripts) implements the Transfer Directionality Index and its validation. figs/ (8 scripts + 7 rendered figures) generates every figure in the paper directly from the result tables. experiments/ (20 scripts) covers the full pipeline: adversarial evasion/poisoning tests, campaign linking, the baseline training run, and 14 manuscript-production scripts that extract claims, compute every reported number from source, verify the manuscript text against those numbers, assemble the document, and check cross-section consistency. All experiments use 5 fixed random seeds (0-4); results are released per-seed rather than pre-averaged. Reproducing the manuscript's numbers requires no GPU and no network access — running the scripts in experiments/ (prefixed P1 through P14) in order regenerates every table, figure, and the manuscript text itself from this data.