## 4 Framework Design
### Preprocessing  
Given the diverse deployment scenarios and specialized devices inherent in the IoT ecosystem, it is essential to acknowledge that the data collection environments for each candidate source data set can significantly vary. These differences manifest in various ways, including variations in the number of features, data set composition, and the quantities of attack and benign instances. Consequently, preprocessing is necessarily required to unify the feature configurations across multiple data sets and address uninitialized values before embarking on the knowledge transfer process. This ensures that the source and target domains are effectively aligned, evaluating the similarity between data sets and facilitating a seamless transfer of knowledge between them.  
Based on a feature analysis of the four data sets that we utilized, we first identified a common set of 12 features shared among all the source domain candidates and the target domain data set. Table 2 summarizes the result.  
To acquire common features across the four data sets, we focused on unifying features whose names were different but virtually identical in representing flow aspects (e.g., bytes in Bot-IoT and Fwd_Pkt_Len_Mean in IoT Intrusion data sets). We note that the four data sets used in our study are representative and widely used data sets with extensive flow characteristics, which means that our approach can be extended to apply to other IoT intrusion detection data sets. The remaining features include 'Source IP', 'Source Port', 'Destination IP', 'Destination Port', 'Protocol', 'Flow Duration', 'Fwd Packet Length Mean', 'Bwd Packet Length Average', 'Total Delivered Packets', 'Total Bandwidth Packets', 'Timestamp', and 'Label', which signify the maliciousness of the data. We also note that the previous studies showed that anomaly detection performance is affected by feature importance (e.g., the weight of the information gain) rather than the sheer number of features [36]. In a comparative analysis, previous studies grouped features into sets of 4, 15, and 22, demonstrating a consistently high accuracy ranging from 96% to 99%. We confirmed that our evaluation result aligns with such a result to distinguish benign and malicious traffic, as our proposed framework delivers a 97-99% accuracy (see Section 5.3). To ensure a balanced representation among the source data sets, we employed a sampling strategy for the number of attack instances in each attack type. Specifically, we adjusted the total count of benign and attack instances in each data set to align with 625,783, which is the smallest instance number among the data sets (IoT Intrusion data set).  
\begin{table}
\begin{tabular}{c l l} \hline \hline
**No.** & **Feature Names** & **Feature Description** \\ \hline
1 & Source IP & Source IP address \\
2 & Source Port & Source port number \\
3 & Destination IP & Destination IP address \\
4 & Destination Port & Destination port number \\
5 & Protocol & Internet Protocol used \\
6 & Flow Duration & Duration of the flow in microsecond \\
7 & Fwd Packet Length Mean & Mean size of packet in forward direction \\
8 & Bwd Packet Length Mean & Mean size of packet in backward direction \\
9 & Total Fwd Packets & Total packets in the forward direction \\
10 & Total Bwd Packets & Total packets in the backward direction \\
11 & Timestamp & Timestamp of the packet \\
12 & Label & Category of attack or normal \\ \hline \hline \end{tabular}
\end{table}
Table 2: Common feature description.