Cross-domain generalization failure in lightweight IDS models for IIoT

The rise of artificial intelligence applied to cybersecurity has driven the development of lightweight intrusion detection systems (IDS) for industrial environments such as IIoT. However, most evaluations are limited to validating these models within the same network where they were trained, hiding a critical problem: cross-domain generalization. A recent study shows that lightweight architectures, trained on a single dataset and evaluated without retraining on structurally different networks, suffer a drastic drop in performance. The main cause lies in these models learning shortcuts based on network port features, which are abundant in the attack traffic of the source domain but practically absent in the target domains. This is not a minor failure; it reveals that apparent local accuracy is a mirage when considering real-world deployment. The research also shows that the evaluation protocol used can even invert which target network appears more challenging, depending on whether balanced class distributions or natural environment distributions are used. Robustness against adversarial attacks is independent of generalization capability, and recovery through limited exposure to the target domain varies considerably depending on the architecture. These findings have profound implications for any organization seeking to deploy AI-based IDS in critical infrastructures. It is not enough to achieve high accuracy in the lab; it is necessary to validate behavior under realistic conditions, with data from unseen networks and imbalanced class distributions. This is where Q2BSTUDIO's expertise makes the difference. As a company specialized in cybersecurity and pentesting, we understand that effective security requires solutions that adapt to the heterogeneity of production environments. Our artificial intelligence services for companies allow us to design models that are not only lightweight for the edge but also incorporate robust generalization strategies, such as the use of invariant features, adversarial data augmentation, or domain adaptation techniques. Additionally, we integrate custom applications and custom software to deploy these systems in cloud infrastructures, whether with AWS and Azure cloud services, ensuring scalability and low operating costs. Continuous monitoring and analysis of attack patterns can be enhanced with business intelligence services and tools like Power BI, which transform telemetry data into actionable dashboards. Even AI agents can orchestrate automated incident responses, learning from each new domain without the need for full retraining. The path to a reliable IDS in IIoT involves not only improving the model architecture but also changing how we assess its readiness for the real world. At Q2BSTUDIO, we work with a comprehensive approach that combines artificial intelligence, cybersecurity, and custom development so that companies can trust their detection systems, even when crossing unforeseen network boundaries.