## 1 Introduction  
Network Intrusion Detection Systems (NIDS) play a vital role in maintaining the appropriate level of cybersecurity for contemporary computer systems. Their primary objective is identifying unauthorized access or irregularities in network traffic and system operations. The emergence of new forms of Internet communication, such as the Internet of Things (IoT) that connects various devices and Operational Technology (OT) that oversees and controls physical devices, processes, and events within industrial settings, has not only amplified the volume of network traffic but also diversified it, thereby introducing new paths for cyber threats [1]. By detecting suspicious behaviors, NIDS contributes significantly to preventing security breaches. Our investigation focuses on intrusion detection systems based on the online processing of traffic features that use pre-trained Machine Learning (ML) models. In the vast majority of cases, such systems are trained on the collected labeled traffic data samples before their proper use. As in most ML models, the quality of the training data is one of the most significant factors influencing the overall final efficiency and accuracy of the machine-learning-based NIDS. Typically, the acceptable measures obtained on the test data, usually of the exact origin as the training one, make the model ready to deploy. Finally, considering the correct (in terms of performance measures) work on the test data, one expects the model's good performance on actual network traffic. It is the principal factor influencing the process of transition of the model from the \"closed world\" of the training environment into the real world of actual network traffic [2]. Such a transfer-learning approach is common in all fields of machine learning, not excluding the NIDS [3]. In our paper, we show that this process does not necessarily run smoothly in the case of the ML model trained on the available internet traffic datasets, which is primarily due to a wide variety of data transmitted over the network from one side and relatively limited scope of data gathered on the other. In our research, we focus on the dataset bias that influences the ability of the NIDS to generalize its expertise. This property is crucial in all ML models as it allows for detecting traffic classes on data of the same categories from sources other than the training data. We investigate the generalizability of four popular Internet traffic data sets: UNSW-NB15 [4], CSE-CIC-IDS2018 [5], BoT-IoT [6] and ToN-IoT [7] in their unified ('v2') versions sharing the same collection of features [8] (In the remainder of the paper these four sets are referred to by the following simplified abbreviations as NB15, IDS18, BoT and ToN). The first two datasets collect traffic that circulates in typical enterprise networks, while the remaining two contain samples of the industrial IoT network traffic. Although registered in controlled environments, they all reflect real-world scenarios and challenges, making them valuable resources for academic research and practical cybersecurity applications. They contain specific data of different origins consisting of various traffic classes, including benign traffic and multiple harmful categories. The categories differ from one set to another, but some classes are present in more than one dataset (co-occurring classes). We focus on them, observing how these classes are detected within samples belonging to one set while training the model on another. In our experiments, we use the extremely randomized trees (extra trees) classifier [9] to investigate the influence of train-test set combinations on traffic classification efficiency. This investigation is based on the cross-validation of models using subsets of original datasets consisting of one million samples and a reduced number of features each.