Domain adaptation (DA) is crucial for transferring models trained in one domain to perform well in a different, often unseen domain. Traditional methods, including unsupervised domain adaptation (UDA) and source-free domain adaptation (SFDA), have made significant progress. However, most existing DA methods rely heavily on Batch Normalization (BN) layers, which are not optimal in source-free settings, where the source domain is unavailable for comparison. In this study, we propose a novel method, ESBN, which addresses the challenge of domain shift by adjusting the placement of normalization layers and replacing BN with Batch-free Normalization (BFN). Unlike BN, BFN is less dependent on batch statistics and provides more robust feature representations through instance-specific statistics. We systematically investigate the effects of different BN layer placements across various network configurations and demonstrate that selective replacement with BFN improves generalization performance. Extensive experiments on multiple domain adaptation benchmarks show that our approach outperforms state-of-the-art methods, particularly in challenging scenarios such as Open-Partial Domain Adaptation (OPDA).

With the rapid development of technology, the scale of traffics in industrial control networks is increasing day by day. More malicious traffics brought terrible impacts on industrial areas. Modbus plays a momentous role in the communications of Industrial Control Systems (ICS), but it’s vulnerable to Denial of Service attacks(DoS). Traditional methods cannot perform well on fine-grained detection tasks which could contribute to locating targets of DoS and preventing the destruction. Considering the temporal locality and high dimension of malicious traffic, we proposed a Neural Network architecture named MODLSTM, which consists of three parts: input preprocessing, feature recoding, and traffic classification. By virtue of the design, MODLSTM can perform high-precision identification and fine-grained classification of DOS attacks in the Modbus/TCP-based system. To test our model’s performances, we conducted experiments on our traffic dataset collected from the industrial control network, and the models achieved excellent performances in comparison with previous work(accuracy increased by 0.74%). The results show that our proposed method has satisfactory abilities to detect DoS attacks related to Modbus, it could help to build a reliable firewall to address the DoS traffic in industrial environments.