A cross-dataset benchmark for IoT DDoS detection with semantic feature alignment and SHAP

Cross-dataset evaluation is essential for determining whether Internet of Things (IoT) Distributed Denial of Service (DDoS) detectors generalize beyond the dataset on which they are trained, yet such evaluation is obstructed by incompatible feature schemas and substantial source-target distribution shift. This study presents a reproducible benchmark that maps CICIoT2023, CIC-DDoS2019, and TON-IoT features into 15 canonical traffic semantics and evaluates machine learning (ML), deep learning (DL), and graph neural network (GNN) models under within-dataset and directional transfer settings. ML and DL models provide tabular baselines; GraphSAGE and GAT operate on behavioral k-nearest-neighbor graphs when communication identifiers are unavailable; and Shapley Additive exPlanations (SHAP) provide post hoc feature attribution. Several tabular and DL models achieve near-ceiling within-dataset scores, whereas aligned transfer is strongly directional: Logistic Regression obtains F1=0.9944 for TON-IoT→CICIoT2023 but F1=0.6667 in the reverse direction under the legacy protocol. A controlled 27-run Logistic Regression experiment using three seeds and strict source-training-only imputation and scaling further shows direction-dependent representation sensitivity: mean F1 across its three conditions ranges from 0.4857 to 0.6505 for CICIoT2023→TON-IoT, remains 0.9943 for two conditions but falls to 0.6666 with indicators for TON-IoT→CICIoT2023, and ranges from 0.7104 to 0.7255 for CIC-DDoS2019→CICIoT2023. These comparisons do not isolate a causal effect of zero filling because feature content and dimensionality also change. Semantic alignment enables comparable transfer experiments but does not eliminate dataset shift, graph-construction assumptions, or structural-missingness limitations.