## 4 Methodology
### Classifier(s) and Cross-Validation  
One may find various classification models in reported research on NIDS [66]. However, when investigating the cross-dataset generalization properties described in some papers, one may observe a relatively high correlation between results obtained by different classifiers [27]. Although the results of individual tested classifiers differ, the relations between the results for individual sets usually remain constant. Our research aims not to find the best classifier but to investigate the generalizability of models trained on various datasets. That is why, in our paper, we omit the--typical in many papers in this domain--comparison of various classifiers, focusing on just a single one, carefully selected. Consequently, although several classifiers were initially investigated, a single one was chosen to perform the ultimate experiments. We pre-selected classifiers, restricting their broad spectrum to tree-based models. This choice was motivated by these models' high explainability and effectiveness. We have chosen three decision-tree-based classifiers for our experiments: decision trees [67], random forests [68], and randomized decision trees (extra-trees) classifier [9]. A decision tree [67] represents the classification process by a tree-based model. Each internal node of the tree corresponds to a test on a feature, each branch to a decision rule, and each leaf node represents a classification result. One of the main advantages of this approach is the ease of interpretation and understanding, as it is close to human decision-making processes. A random forest [68] is a classic ensemble learning method that operates by constructing a multitude of decision trees at training time and outputting the class that is computed, usually as a modal value, based on classification results of the individual trees. Random forest combine the predictions of several base decision-tree estimators built with a given learning algorithm to improve generalizability and robustness over a single classifier. Extremely randomized (extra-) tree [9] is a decision tree that introduces randomness as part of the construction process. Unlike traditional decision trees, where the best split at each node is determined based solely on deterministic criteria (like information gain or Gini impurity), a randomized decision tree incorporates random choices in splitting nodes. We used the scikit-learn (1.5.2) Python (3.10.9) package in our experiments, where all three classifiers are available. Our goal was not to maximize the classification measures but to compare their performance for different train-test set combinations. The default and fine-tuned versions were used in the initial phase of the research to confirm the validity of such an approach. However, comparing results for default and fine-tuned versions revealed that although the latter generally provides higher values of quality measures, the relation between results obtained for various sets remains unchanged. In the final phase of the classifier selection process, the above classifiers were trained and tested on various configurations of train-test sets. Again, the results revealed a highcorrelation (between 0.75 and 0.95). Finally, the ExtraTree classifier was chosen as the one with the highest value for quality measures. This choice confirmed the choice of reference classifier applied in validation experiments in [8]. Our experiments investigate how classification models trained on one dataset perform when the other is used as a test set. As each set (BoT, ToN, NB15, and IDS18) was captured in different network testbeds, they allowed the simulation of applying the model trained on a given set used in a real environment. Despite the various quantities of samples initially included in each of the four sets, equally sized subsets are extracted from each to perform the experiments. Thanks to that, we avoid the differences in results that may be caused by the inequality of training (and test) datasets' sizes.