Beyond Retraining: Source-Free Adaptation for Generalizable Intrusion Detection

Machine learning (ML)–based intrusion detection systems (IDS) often degrade when deployed across heterogeneous networks due to domain shifts in traffic and configuration. To mitigate this degradation, conventional domain adaptation (DA) methods aim to align source and target data distributions; however, they require access to source data during deployment—an impractical constraint that undermines scalability and reusability. To overcome this limitation, we propose TRANSFA-IDS (Transformer Source-Free Adaptation for IDS), which removes the need for source data during adaptation while preserving the knowledge encoded in the source-trained model. TRANSFA-IDS transforms tabular flow records into structured color image embeddings and employs a compact Vision Transformer with a Deep Support Vector Data Description (Deep-SVDD) head to learn domain-invariant representations of benign behavior. During deployment, it adapts to new environments using only a small portion of unlabeled target traffic by fine-tuning the last Transformer block, efficiently realigning feature distributions without retraining. Experiments across cross-dataset settings (CICIDS2018↔UNSW-NB15) show that TRANSFA-IDS achieves AUROC scores up to 0.908 and 0.873, outperforming traditional non-adaptive unsupervised baselines by over 40% while adapting more than twice as fast as conventional adaptive unsupervised. These results demonstrate that source-free adaptation can deliver both high accuracy and deployment practicality for scalable IDS across diverse network environments.