Majority Voting Versus Learned-Threshold Score Aggregation for Verifying IoT Security Events Under Non-IID Heterogeneity

Intrusion detectors for Internet of Things (IoT) systems are usually trained per device or site, so a verification layer must combine alerts from detectors built on different populations and base rates. This study compares two ways of turning such alerts into a decision: majority voting with a fixed threshold, and score aggregation with a threshold learned on labeled calibration data. Seven detectors trained separately on TON_IoT device populations voted on 56,000 shared events, and each rule was compared with the detector local to the event through an amplification factor A. Fixed-threshold majority voting amplified error in the point estimate (A=1.12 for 1−MCC), whereas learned-threshold aggregation reduced it (A≈0.62); device-level intervals, however, included neutrality. An equal-weight score with a learned threshold matched reliability-, margin-, and hybrid-weighted rules, so the improvement came from threshold placement rather than from weighting. In this setting, about 500 labeled target events sufficed to place the threshold, whereas source-domain reliability estimates were biased by up to 0.22 although their 95% sampling half-width was at most 0.011. Gains concentrated in devices with weak local detectors and shrank under natural prevalence. Under degraded validators, fixed-threshold voting was the most fragile rule. A synthetic vote layer overstated amplification, and a federated detector showed a shared threshold collapsing under domain shift.