Abstract
Cross-dataset network intrusion detection faces challenges arising from distribution shifts, heterogeneous feature fields, changing attack distributions, and unreliable explanations across data sources. To address these problems, this paper proposes a fuzzy-enhanced cost-aware Low-Rank Adaptation (LoRA) inference model with multiple security experts. The model uses Qwen2.5-7B-Instruct as a shared backbone and constructs five lightweight LoRA security experts for normal traffic, volumetric attacks, code execution attacks, web application attacks, and reconnaissance behaviors. A cost-aware router selects the appropriate expert by jointly considering neural adaptability, fuzzy consistency derived from raw traffic features, inference cost, and runtime load. To improve evaluation reliability, the model further integrates a leakage-free data protocol with separate raw and standardized feature streams, as well as a traffic-semantic consistency verification module. Across four experimental corpora derived from three independently collected data sources, the proposed method achieves a Macro-F1 of 0.887 on the pooled test set. Parameters are selected on the validation set subject to a contradiction rate of no more than 0.05 and a low-confidence trigger rate of no more than 0.10, and are then held fixed for testing. The contradiction rate among test outputs meeting the verification score threshold is 0.048. This metric reflects output consistency under the selected conditions and does not constitute an independent assessment of explanation quality.