Preregistered analysis plan — Cross-domain knowledge sharing for joint network intrusion and malware detection

Abstract

Preregistered analysis plan for a confirmatory re-run assessing whether multi-task learning genuinely transfers knowledge between network intrusion detection (CICIDS2017) and memory-based malware detection (CIC-MalMem-2022). The plan fixes in advance: the co-primary hypotheses; the metric (macro-F1 over a set of evaluable classes determined from the partitions alone); the primary design for each task (10-fold grouped cross-validation for the network task; leave-one-family-out over 15 sub-families for the malware task); the 10 training seeds; the statistical tests and their multiplicity corrections; the leakage-resistant grouping keys; the hyperparameter search budget — identical across all model families; and the decision rule. Three secondary hypotheses are also declared: differential performance inflation from random splitting across model families; equivalence between the multi-task gain and that of a negative control with permuted auxiliary labels; and underestimation of uncertainty by intervals computed over seeds rather than folds. This deposit precedes the confirmatory run. It follows an editorial rejection prompted by an outcome-dependent sampling decision in an earlier submission, now reclassified as exploratory.