CROSS‐IoT: A Zeek‐Driven Data Harmonization Pipeline for Robust Cross‐Domain Attack Detection

ABSTRACT The vast scale of the Internet of Things (IoT) adoption has increased vulnerability to sophisticated cyberattacks. Intrusion detection systems (IDSs) remain vital for network attack detection, yet most existing studies rely on models trained in single, isolated environments. These frameworks often overfit localized statistical distributions, resulting in poor out‐of‐distribution generalization across heterogeneous IoT settings. Existing datasets remain fragmented due to inconsistent testbeds and feature extraction methods, limiting the development of scalable and interoperable security models. To address this limitation, we propose CROSS‐IoT, a Zeek‐driven data harmonization pipeline for cross‐domain intrusion detection. The framework unifies heterogeneous traffic from five prominent datasets, namely, CICIoT2023, CICIoMT2024, IoT‐23, Edge‐IIoTset, and MedBIoT, into a standardized feature space. Using Zeek, CROSS‐IoT extracts protocol‐inclusive, domain‐flexible features and supports reproducible cross‐domain evaluation through unified training, cross‐dataset testing, and cross‐domain transfer. CROSS‐IoT achieves 95.16% unified‐test accuracy with an AUC of 0.987, maintains 95%–99% accuracy across cross‐dataset evaluations, and reaches 97.87% accuracy on unseen CICIoMT2024 traffic. Compared with single‐dataset transfer baselines, CROSS‐IoT provides more stable cross‐domain performance, highlighting the benefit of harmonized multi‐domain training. The main contribution is a reproducible benchmarking pipeline for transferable IDS evaluation across heterogeneous IoT domains. CROSS‐IoT establishes a standardized foundation for reproducible cross‐domain IoT IDS research.