BRIDGE and TCH-Net: Heterogeneous Benchmark and Multi-Branch Baseline for Cross-Domain IoT Botnet Detection

Despite years of progress in IoT botnet detection, the field has been quietly building on a shaky foundation: the overwhelming majority of published systems are evaluated on a single dataset, producing performance estimates that simply do not hold when the network environment changes. Compounding this, the heterogeneous feature spaces of available IoT security datasets have made principled multi-dataset training practically impossible without either discarding semantic interpretability or introducing silent data integrity violations. No prior work has addressed both problems together with a formally specified, reproducible methodology. This paper makes two primary contributions toward fixing that. First, we introduce BRIDGE (Benchmark Reference for IoT Domain Generalisation Evaluation), the first formally specified heterogeneous multi-dataset benchmark for IoT intrusion detection, unifying five structurally distinct publicly available datasets, CICIDS-2017, CIC-IoT-2023, Bot-IoT, Edge-IIoTset, and N-BaIoT, through a 46-feature semantic canonical vocabulary grounded in CICFlowMeter nomenclature, with genuine-equivalence-only feature mapping, explicit zero-filling for absent features, and full per-dataset coverage disclosure spanning 15% to 93%. A leave-one-dataset-out (LODO) evaluation protocol reveals, for the first time with a formally reproducible methodology, just how large the generalisation gap really is: all five evaluated deep learning architectures achieve mean LODO F1 in the range 0.39–0.47, and we establish the first formally quantified community generalisation baseline at mean LODO F1 = 0.5577, which is a finding that we believe will reframe the research agenda from single-benchmark optimisation toward cross-environment generalisation and domain adaptation. Second,we propose TCH-Net as a strong and well-characterised baseline for BRIDGE: a multi-branch neural architecture integrating a three-path Temporal branch with residual convolutional-BiGRU, stride-downsampled BiGRU, and full-resolution pre-LayerNorm Transformer encoders for multi-scale attack pattern capture, a provenance-conditioned Contextual branch, and an aggregate Statistical branch, fused via a novel Cross-Branch Gated Attention Fusion (CB-GAF) mechanism with learnable per-branch sigmoid gates that enable dynamic, feature-wise cross-branch information mixing. Evaluated across five independent random seeds on BRIDGE, TCH-Net achieves F1 = 0.8296 ± 0.0028, AUC = 0.9380 ± 0.0025, and MCC = 0.6972 ± 0.0056, outperforming all twelve baseline models with statistical significance (p < 0.05, paired Wilcoxon signed-rank test) and attaining the highest cross-dataset LODO F1 among all evaluated architectures. BRIDGE, its canonical vocabulary specification, and the complete experimental pipeline are publicly released at https://github.com/Ammar-ss/TCH-Net to facilitate reproducible community evaluation and progress on the cross-dataset generalisation challenge that BRIDGE makes, for the first time, precisely measurable.