Machine learning (ML)–based intrusion detection systems (IDS) often degrade when deployed across heterogeneous networks due to domain shifts in traffic and configuration. To mitigate this degradation, conventional domain adaptation (DA) methods aim to align source and target data distributions; however, they require access to source data during deployment—an impractical constraint that undermines scalability and reusability. To overcome this limitation, we propose TRANSFA-IDS (Transformer Source-Free Adaptation for IDS), which removes the need for source data during adaptation while preserving the knowledge encoded in the source-trained model. TRANSFA-IDS transforms tabular flow records into structured color image embeddings and employs a compact Vision Transformer with a Deep Support Vector Data Description (Deep-SVDD) head to learn domain-invariant representations of benign behavior. During deployment, it adapts to new environments using only a small portion of unlabeled target traffic by fine-tuning the last Transformer block, efficiently realigning feature distributions without retraining. Experiments across cross-dataset settings (CICIDS2018↔UNSW-NB15) show that TRANSFA-IDS achieves AUROC scores up to 0.908 and 0.873, outperforming traditional non-adaptive unsupervised baselines by over 40% while adapting more than twice as fast as conventional adaptive unsupervised. These results demonstrate that source-free adaptation can deliver both high accuracy and deployment practicality for scalable IDS across diverse network environments.

The integration of artificial intelligence (AI) with the Internet of Things (IoT) marks a significant advancement in sixth-generation (6G) networks. The complexity of these AIoT services has promoted an as-a-service model, where service providers offer tailored architectures to meet varied application needs. Despite the critical importance of optimizing both training and inference in service architectures, this aspect remains under-explored. Our study introduces service scenarios such as ‘no shared (NS)’, where tenants manage their data and models independently, ‘data shared (DS)’, where tenants provide data for collective training, and ‘parameter sharing (PS)’, where only model parameters are shared. We utilize a tandem queue model to simulate the communication and computing demands across cloud-edge-fog architectures. Our proposed Cost and Delay Resource Allocation (CDRA) method significantly reduces costs, with edge and fog-based training and inference lowering costs by up to 44% compared to cloud setups. The evaluation shows that the NS scenario is resource-intensive but offers high privacy, DS is cost-effective and improves model accuracy, and PS balances privacy with longer wait times. These findings provide service providers with a comprehensive comparison of service scenarios and architectures, offering guidance for strategic and economically sound decisions in the ever-evolving landscape of AIoT.

The rise of AI solutions has driven the emergence of AI as a Service (AIaaS), offering cost-effective and scalable solutions by outsourcing AI functionalities to specialized providers. Within AIaaS, three key components are essential: segmenting AI services into preprocessing, training, and inference tasks; utilizing GPU-CPU heterogeneous systems where GPUs handle parallel processing and CPUs manage sequential tasks; and minimizing latency in a distributed architecture consisting of cloud, edge, and fog computing. Efficient task scheduling is crucial to optimize performance across these components. In order to enhance task scheduling in AIaaS, we propose a user-experience-and-performance-balanced reinforcement learning (UXP-RL) algorithm. The UXP-RL algorithm considers 11 factors, including queuing task information. It then estimates resource release times and observes previous action outcomes, to select the optimal AI task for execution on either a GPU or CPU. This method effectively reduces the average turnaround time, particularly for rapid inference tasks. Our experimental findings show that the proposed RL-based scheduling algorithm reduces average turnaround time by 27.66% to 57.81% compared to the heuristic approaches such as SJF and FCFS. In a distributed architecture, utilizing distributed RL schedulers reduces the average turnaround time by 89.07% compared to a centralized scheduler.

An Intrusion Detection System (IDS) employing machine learning (ML) solutions is crucial for identifying network intrusions. To minimize operational expenses and enhance performance, enterprises have begun outsourcing IDS management to service providers, giving rise to the concept of Intrusion Detection as a Service (IDaS). Earlier research primarily aimed at enhancing the accuracy of ML-based IDS models or expediting their computational process. However, from the service provider's perspective, an optimal architecture ensuring minimal computation cost and processing delay is crucial to increasing revenue. This study evaluates the performance of IDaS in a multi-tier architecture, utilizing traffic split offloading to enhance performance by mapping three in-sequence ML-based IDS tasks (pre-processing, binary detection, multi-class classification) to the architectures as the offloading destinations. We employ a simulated annealing-based traffic offloading and cost allocation (SA-TOCA) algorithm to determine the offloading ratio for each traffic path and the cost requirements for each tier. The results indicate that the edge-cloud architecture is 15% and four times more cost-effective compared to the fog-edge and fog-cloud architectures, respectively, and it demonstrates superior performance in minimizing processing delays. Offloading the majority of traffic to the edge and the remainder to the cloud proves to be an efficient strategy, reducing both computation costs and average delays.

Intrusion Detection Systems (IDS) play an important role in detecting network intrusions. Because intrusions have many variants and zero-day attacks, traditional signature- and anomaly-based IDS often fail to detect them. On the other hand, solutions based on Machine Learning (ML), have better capabilities for detecting variants. In this work, we adopt an ML-based IDS which uses three in-sequence tasks, pre-processing, binary detection, and multi-class detection, with a multi-tier architecture with one-, two-, and three-tier architectural configurations. We then mapped three in-sequence tasks into these architectures, resulting in ten task assignments. We evaluated these with queueing theory to determine which tasks assignments were more appropriate for particular service providers. With simulated annealing, we obtained the computation capacity by allocating the total cost appropriate to each tier, based on the fixed parameter set with the objective of minimizing overall delay. These investigations showed that using only the edge and allocating all tasks to it gave the best performance. Furthermore, a two-tier architecture with edge and cloud components was also sufficient for IDS as a Service with the delay that was three times better than for other task assignments. Our results also indicate that more than 85% of the total capacity was allocated and spread across nodes in the lowest tier for pre-processing to reduce delays.

An intrusion detection system (IDS), traditionally an example of an effective security monitoring system, is facing significant challenges due to the ongoing digitization of our modern society. The growing number and variety of connected devices are not only causing a continuous emergence of new threats that are not recognized by existing systems, but the amount of data to be monitored is also exceeding the capabilities of a single system. This raises the need for a scalable IDS capable of detecting unknown, zero-day, attacks. In this paper, a novel multi-stage approach for hierarchical intrusion detection is proposed. The proposed approach is validated on the public benchmark datasets, CIC-IDS-2017 and CSE-CIC-IDS-2018. Results demonstrate that our proposed approach besides effective and robust zero-day detection, outperforms both the baseline and existing approaches, achieving high classification performance, up to 96% balanced accuracy. Additionally, the proposed approach is easily adaptable without any retraining and takes advantage of n-tier deployments to reduce bandwidth and computational requirements while preserving privacy constraints. The best-performing models with a balanced set of thresholds correctly classified 87% or 41 out of 47 zero-day attacks, while reducing the bandwidth requirements up to 69%.