## 5 Evaluation
### Intrusion Detection Performance  
To verify the assessment result, we constructed multiple models for each source domain combined with the target domain data set, a typical way of instance-based transfer learning. For this, three training data sets were constructed by combining 100% of the source data set and 70% of the target data set for each of the three source data sets. Note that the remaining 30% of the target data set was used as a test data set. The accuracy evaluation index employed in the performance assessment was derived from a confusion matrix and adhered to the following standard measurements:  
\[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN}\]  
\[\text{Precision}=\frac{TP}{TP+FP}\]  
\[\text{Recall}=\frac{TP}{TP+FN}\]  
\[\text{F1-Score}=2\cdot\frac{\text{Precision}\cdot\text{Recall}}{\text{ Precision}+\text{Recall}}\]  
Here, TP (True Positive) represents the count of inference results in which the model correctly predicted a malicious flow as an attack class. In essence, the accuracy metric serves as an indicator of how precise the model's predictions are, with a higher value approaching 1 signifying superior performance. Tables 6 and 7 show the experimental results of phase 2. As expected, the highest Accuracy value and the lowest loss value were identified in the case of using the IoT Intrusion data set as the source data set. To cross-check whether the selected source domain based on the assessment and the target domain were indeed similar, we performed a qualitative analysis by scrutinizing the data sets, for example, by examining the number of attack types and the instance ratio of common attack types. First, when the number of common attack types between the target and source domains was examined, UNSW-NB15 overlapped the most with two types: DoS and Reconnaissance. Meanwhile, IoT Intrusion and CIC-IDS2017 had only DoS in common. Considering that all three source domains shared the DoS attack type with the target domain, similarity was assessed based on the number of DoS instances. The counts for each source domain were as follows: IoT Intrusion with 59,391 instances, UNSW-NB15 with 16,353 instances, and CIC-IDS2017 with 252,661 instances, out of a total of 625,783 instances across the domains. The percentage of DoS instances from the total for each source domain was calculated as follows: IoT Intrusion at 9.48%, UNSW-NB15 at 2.61%, and CIC-IDS2017 at \begin{table}
\begin{tabular}{l l l l l l} \hline \hline  & **Accuracy** & **Loss** & **F1-Score** & **Recall** & **Precision** \\ \hline CIC-IDS2017 & 0.9928 & 0.0278 & 0.9792 & 0.9605 & 0.9994 \\ IoT Intrusion & **0.9994** & **0.0049** & **0.9997** & **1.0000** & **0.9994** \\ UNSW-NB15 & 0.9993 & 0.0083 & 0.9997 & 1.0000 & 0.9993 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The results of the performance evaluation experiment in the case where the target domain was Bot-IoT. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline  & **Accuracy** & **Loss** & **F1-Score** & **Recall** & **Precision** \\ \hline CIC-IDS2017 & 0.9753 & 0.0452 & 0.9865 & 0.9776 & 0.9960 \\ Bot-IoT & **0.9994** & **0.0053** & **0.9997** & **1.0000** & **0.9994** \\ UNSW-NB15 & 0.9765 & 0.0600 & 0.9937 & 0.9995 & 0.9882 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The results of the performance evaluation experiment in the case where the target domain was IoT Intrusion. 40.35%. Interestingly, this reveals that CIC-IDS2017 significantly had the highest number of instances for the common attack type. Then, we reviewed the data collection environment for each public data set. The data sets used as source domains were collected from diverse environments ranging from actual IoT setups to virtual networks. The IoT Intrusion data set originated from a smart home environment, specifically from SKT NUGU (NU 100) and the EZVIZ Wi-Fi Camera (C2C Mini O Plus 1080P). The UNSW-NB15 data set is a hybrid blend of genuine modern network traffic and synthesized modern attack behaviors.