## 4 Performance Evaluation
### Transfer Learning Tasks
#### 4.2.1 UNSW-NB15 to CIC-IDS2017 Transfer Learning  
In order to demonstrate the efficacy of the proposed transfer learning framework, we apply it to multiple scenarios with two datasets. Specifically, we use the UNSW-NB15 dataset as the source domain for training and transfer the knowledge to the CIC-IDS2017 dataset as the target domain with different attack scenarios. Through a grid search procedure for tuning hyper-parameters, we decide to set the number of hidden layers of the feature transform network for source and target to 2 and 3, respectively, set the dimension of common feature space to 128, and set the number of hidden layers of the classification network to 4, and ReLU is used as the activation function for all hidden layers. The training process includes four epochs. According to the attack characteristics summarized in Table 1, we divide data samples of similar attack types for source and target datasets into several groups to simulate multi-scenario cross-domain transfer learning. In each group of source and group dataset, data labeled with normal/benign are negative samples, while others are positive samples. The transfer learning settings are summarized in Table 2. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Dataset** & **Attack Types** & **Description** \\ \hline \multirow{8}{*}{NSL-KDD} & \multirow{2}{*}{DoS} & Involves overwhelming a network or system to disrupt its services. \\ \cline{2-3}  & & Attackers attempt to gather information about the target network without direct exploitation. \\ \cline{2-3}  & & Attackers exploit vulnerabilities to gain unauthorized access and escalate privileges. \\ \cline{2-3}  & & Attackers attempt to connect to a local system remotely without proper credentials. \\ \hline \multirow{8}{*}{UNSW-NB15} & \multirow{2}{*}{Fuzzers} & aimed at testing software vulnerabilities through unexpected inputs. \\ \cline{2-3}  & & Analysis & Techniques for gathering information about target systems. \\ \cline{2-3}  & Backdoors & Unauthorized access methods left by attackers. \\ \cline{2-3}  & DoS & Flooding a system to disrupt its services. \\ \cline{2-3}  & Exploits & Attacks exploiting known vulnerabilities. \\ \cline{2-3}  & Generic & General or unspecified attacks. \\ \cline{2-3}  & Reconnaissance & Preparing for future attacks by gathering information. \\ \cline{2-3}  & Shellcode & Malicious code for executing arbitrary commands. \\ \hline \multirow{8}{*}{CIC-IDS2017} & DoS & Flooding the target with traffic to disrupt services. \\ \cline{2-3}  & PortScan & Scanning target ports to find potential vulnerabilities. \\ \cline{2-3}  & DDoS & Distributed denial of service attacks from multiple sources. \\ \cline{2-3}  & Patator & Brute-force attacks against SSH and FTP services. \\ \cline{2-3}  & Web Attack & Attacks targeting web applications and services. \\ \cline{2-3}  & Botnet & Activities related to botnets, including command and control traffic. \\ \cline{2-3}  & Infiltration & Unauthorized access and data exfiltration attempts. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of the attack types in each dataset. We employ several standard evaluation metrics for binary classification tasks, including accuracy, accuracy, recall, and F1-score. We present the results of our experiments in Table 3, including the performance metrics for each transfer learning task (identified by the **TaskID (#)**). In various transfer learning scenarios, the prediction accuracy is consistently high, i.e., achieving 98%, and the recall achieves as high as 93%. On the other hand, the precision and F1-score only achieve medium rate (above 43% and 59%, respectively).