Cross-Version Domain Adaptation and Open-Set Attack Screening for Transferable Wi-Fi Intrusion Detection

<title>Abstract</title> <p>While conventional Wi-Fi IDS models often demonstrate high reliability on identically distributed datasets, they typically suffer severe performance degradation under real-world cross-environment traffic shifts. This study examines AWID2-to-AWID3 cross-version transferability as a source-target adaptation problem for Wi-Fi IDS. The proposed design links IEEE 802.11 semantic feature harmonization with manual AWID2--AWID3 feature mapping, management-frame indicators, DANN alignment, and CORAL-based covariance matching. A small labeled AWID3 support subset is used to recalibrate the known-class boundaries. Separately, confidence-based screening is applied to AWID3 attack families that do not exist in the AWID2 label space. On the held-out reduced AWID3 known-class subset, the framework reached 99.47\% accuracy, 0.95 macro-F1, and 0.99 weighted-F1. The framework maintained near-perfect recall---0.99 for deauthentication and 1.00 for evil-twin traffic---reducing the proposed model's Weighted Error Cost to 517 during deployment-oriented evaluation. Model-level inference achieved an average latency of 0.0012 ms per packet and throughput exceeding 814{,}000 packets per second on the reported workstation. For unknown-to-source attacks, the framework flagged anomalies in all eight AWID3-only attack families. Packet-level detection ranged from 71.2\% to 91.4\%, and file-level coverage reached 504/505 files at $\tau = 0.99$. At the same threshold, 10.1\% of the 50{,}000 held-out known-normal packets were flagged as false positives. From a network security management perspective, the framework supports the operational deployment of Wi-Fi intrusion detection across changing network environments by reducing the need for extensive target-domain labeling and retraining. Its open-set screening component provides early warning of previously unseen attacks, while its low inference latency supports real-time network monitoring.</p>