## 6 Conclusions  
Our work aimed to investigate the generalizability of datasets used to train the ML models used in NIDS, which is a crucial issue, given possible practical implementations of these models to classify the network traffic. The results obtained allow us to formulate the following conclusions:  
1. In the case of diverse traffic datasets containing an essential amount of _Benign_ traffic class samples, the multi-class classification results are strongly biased by this class. Relatively high measures obtained in the multi-class case are caused by efficient identification of normal traffic, which does not happen in the case of the harmful one. Consequently, such models may correctly detect _Benign_ classes but cannot distinguish between various harmful ones.
2. Contrary to the _Benign_ class that shows some similarities between different datasets, the harmful classes differ depending on the dataset they originate from. This means that models trained on a particular dataset are hardly generalizable to other data in detecting and classifying harmful traffic.
3. The exact names of harmful classes in different sets, or--more generally--in different data sources, do not necessarily imply that the nature of sources of this kind of traffic is similar. On the other hand, classes bearing different names in different data sources may represent traffic of similar nature.
4. The variety of network traffic variants results in various classes and possible feature value combinations in samples of the traffic data used in the NIDS systems. The available datasets contain only a part of a spectrum of possible traffic variants. Nevertheless, they are widely used to train new models intended to work with another traffic variant that is not necessarily similar, which has been reported in many papers. The outcomes of our research show that one always needs to carefully analyze similarities between the fundamental nature of harmful classes present in the dataset used and properties of possible harmful traffic that may occur in the target environment. Only high similarity may eventually result in correct classification in the target environment.
5. Combining datasets collecting the traffic data captured in differentiated environments results in more exhaustive and robust collections of traffic samples. Finally, it may result in ML models used in NIDS that are ready to deal with more diverse traffic.  
Figure 4: The t-SNE visualization of _backdoor_ class (**left**) and Reconnaissance (**right**) with labeled original sets.  
**Author Contributions:** Conceptualization, M.I.; methodology, M.I., W.G. and D.O.; software, J.K.; validation, M.I., J.K. and F.P.; formal analysis, M.I.; investigation, M.I., D.O. and J.K.; resources, J.K.; data curation, J.K.; writing--original draft preparation, M.I.; writing--review and editing, M.I., D.O., W.G., J.K. and F.P.; visualization, M.I., D.O.; supervision, M.I.; project administration, M.I. and W.G.; funding acquisition, W.G. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** The research described in this paper was done using publicly available datasets. They are available via the web at addresses provided by their authors, which are to be found in the appropriate papers.  
The authors declare no conflicts of interest.