## 3 System Design and Methods  
In light of the existing research gaps, our proposed model addresses the feature space and distribution heterogeneity by utilizing deep learning-enabled heterogeneous transfer learning.  
To illustrate the deep transfer learning model, we first define the notations for datasets. A transfer learning domain is defined as a dataset with its probability distribution. Thus, the source domain is defined as  
\[\mathcal{D}_{s}=\{\mathcal{X}_{s},\ P_{s}(\mathcal{X}_{s})\}, \tag{1}\]  
where the dataset \(\mathcal{X}_{s}\) is a \(d_{s}\)-dimensional feature with \(C\) classes and \(P_{s}\) is the associated probability distribution of the dataset. The dataset consists of \(n_{s}\) data samples, which is denoted as  
\[\mathcal{X}_{s}=\{(\mathcal{x}_{i}^{s},y_{i}^{s})\}_{i=1}^{n_{s}},\ \mathcal{x}_{i}^{s}\in \mathbb{R}^{d_{s}},\ \ y_{i}^{s}\in\{0,1,\cdots,C-1\}. \tag{2}\]  
Particularly, we consider binary a classification task, wherein the class label is set to \(\{0,1\}\).  
Similarly, the target domain is defined as  
\[\mathcal{D}_{t}=\{\mathcal{X}_{t},P_{t}(\mathcal{X}_{t})\}, \tag{3}\]  
where the dataset \(\mathcal{X}_{t}\) is a \(d_{t}\)-dimensional feature with \(C\) classes and \(P_{t}\) is the associated probability distribution of the dataset. The dimension of feature space might be different from the source domain, i.e., \(d_{t}\
eq d_{s}\), which hinders the direct alignment of probability distribution of two domains. Even if the dimension sizes might be the same, there is still a large chance that the original features have different meaning in two domains. In order to reflect the scarcity of labeled data in the target domain, the data samples in the target domain dataset are further divided into a labeled subset \(\mathcal{X}_{L}\) with \(n_{l}\) samples and an unlabeled subset \(\mathcal{X}_{U}\) with \(n_{u}\) samples. Note that \(n_{l}\ll n_{u}\), meaning the majority of the target domain data are unlabeled. Thus, the target data samples are denoted as  
\[\mathcal{X} =\mathcal{X}_{l}\cup\mathcal{X}_{u}\] \[=\{(\mathcal{x}_{i}^{t},y_{i}^{t})\}_{i=1}^{n_{l}}\cup\{( \mathcal{x}_{i}^{t},y_{i}^{t})\}_{i=n_{l}+1}^{n_{l}+n_{u}},\ \mathcal{x}_{i}^{t}\in \mathbb{R}^{d_{s}},\ \ y_{i}^{t}\in\{0,1,\cdots,C-1\}. \tag{4}\]  
The proposed method only tries to address the heterogeneous transfer learning task with heterogeneous feature spaces, but the learning task (classes for the data) should be the same cross-domain. That is to say, the two datasets should share the same labels (as we denoted above, both datasets have labels of \(C\) classes). The heterogeneous transfer learning task with both heterogeneous feature space and learning task is out of the scope of this article and should be investigated in future research.  
To effectively tackle the inherent challenge of lacking labeled training data, our approach makes the best of labeled datasets from the external internet. At the same time, we incorporate a small, yet invaluable, portion of labeled data along with the bulk of unlabeled data available from the internal network. The incorporation of the two heterogeneous sources of datasets is realized by devising a deep neural network model and formulating the problem of network attack detection as a binary classification task. Particularly, by employing feature projection networks for each data source, the heterogeneous feature spaces are transformed into a common latent space. Thus, the transfer of attack detection knowledge from external networks to internal networks is possible via minimization of maximum mean discrepancy (MMD).