Data-driven mitigation of catastrophic forgetting in dynamic physical layer attack detection
2026-07-01 • Networking and Internet Architecture
Networking and Internet Architecture
AI summaryⓘ
The authors focus on keeping optical networks safe from attacks by making detection models that update themselves with new data. However, these models can forget old attacks if those attacks don't show up for a long time. To solve this, the authors propose mixing in old attack data when updating the model, triggered when the model's accuracy drops. Their approach helps the model adapt faster and remember old attacks better compared to other methods.
Optical networksIntrusion detectionCatastrophic forgettingAdaptive modelsData balancingTelemetry dataModel accuracyNeural networksAttack detectionDynamic updating
Authors
Aleksandra Knapińska, Marija Furdek
Abstract
Optical networks are critical infrastructure that underpins global communications, and detecting security breaches that jeopardize them is essential to maintaining worldwide connectivity. As malicious actors continuously evolve their attack techniques, dynamically updated intrusion detection models have become a key component of modern defense mechanisms. By incorporating newly acquired telemetry data, these models can adapt to emerging threats while maintaining high detection performance. However, when previously encountered attacks reappear after a prolonged period of absence, adaptive models may fail to recognize them due to the phenomenon of catastrophic forgetting. In contrast, statically trained models can reliably detect attacks represented in the original training data but lack the ability to adapt to previously unseen attack patterns. Consequently, intrusion detection systems face a fundamental tradeoff between adaptability to evolving threats and long-term retention of previously acquired knowledge. In this work, we propose a data-driven mechanism to cope with catastrophic forgetting in dynamic attack detection systems. Our approach balances the model update datasets by using parts of past attack data. We utilize a threshold-based mechanism to trigger data balancing after accuracy drops due to an active attack change. Applied to an experimental optical network security dataset, the proposed approach reduces the average model adaptation time by 37% compared to its dynamic counterpart that does not employ data balancing. Compared to a baseline from the literature that relies on neural network depth increasing, our approach requires 6% fewer data batches to adapt to changing conditions and regain performance.