Network intrusion detection adapts automatically to changing cyber threats
Navigating the Latent Manifold: Proactive Concept Drift Adaptation for Resilient NIDS
Cryptography and Security
Summary
Network intrusion detection systems protect computers from harmful attacks. Many current systems struggle when the types of network behavior change over time, causing mistakes. The authors created DriftXpert, which detects changes by analyzing hidden patterns in data and updates itself carefully to remember old threats while learning new ones. This approach helps the system stay accurate and reliable as cyber threats evolve. Tests with real-world data show it works well in practice.
Network intrusion detection system (NIDS)Concept driftLatent manifoldAnomaly detectionCatastrophic forgettingFeature mappingModel adaptationMachine learningCybersecurityRepresentation consistency
Authors
Chao Zha, Zifeng Kang, Tian Liu, Dakun Shen, Ruyun Zhang
Abstract
Network intrusion detection systems (NIDS) are critical for cybersecurity, safeguarding services and data from potential attacks. However, existing AI-based NIDS often assume static data distributions and fail to handle concept drift, leading to degraded performance and increased false positives in dynamic network environments. To address this issue, we propose DriftXpert, a novel NIDS for drift-adaptive detection. Specifically, we propose a decoupled two-stage offline adaptive framework. In Phase 1, we introduce an unsupervised anomaly metric based on latent manifold deviation. By performing outlier analysis within the latent space, the framework achieves high-sensitivity detection of network traffic concept drift. In Phase 2, to mitigate catastrophic forgetting under non-stationary distributions, we design a representation consistency alignment strategy. This strategy constrains the feature mapping between the legacy model and the drifted distribution, ensuring the model captures emerging attack characteristics while retaining discriminative power over known patterns. Furthermore, we incorporate cross-epoch neuron weight aggregation and selective freezing mechanisms to enable fine-grained knowledge transfer in the parameter space, effectively balancing model plasticity and stability. Extensive experiments on public datasets demonstrate that DriftXpert effectively adapts to drifted data without catastrophic forgetting. Furthermore, real-world evaluations on enterprise network further confirm its robustness and practical applicability, contributing to improved security protection for millions of users.