Network intrusion detection robust to changing attack patterns
Navigating the Latent Manifold: Proactive Concept Drift Adaptation for Resilient NIDS
Cryptography and Security
Summary
Network intrusion detection systems protect computers from hackers. But when hacker methods change over time, these systems can get confused and make mistakes. The authors propose a method called DriftXpert that notices when the patterns of network traffic change and updates itself carefully to stay accurate. DriftXpert learns new threats without forgetting old ones, helping keep networks safer even as attacks evolve.
What this means in practice
- •For enterprise network security teams: Improve detection of cyberattacks by adapting to evolving network traffic without losing accuracy on previous threats.
- •For cybersecurity product developers: Develop next-generation intrusion detection tools that maintain performance amid non-stationary network environments.$Commercial implications: Enables creation of adaptive security products sold to organizations needing resilient network protection.
Authors
Chao Zha, Zifeng Kang, Tian Liu, Dakun Shen, Ruyun Zhang
Abstract
Network intrusion detection systems (NIDS) are critical for cybersecurity, safeguarding services and data from potential attacks. However, existing AI-based NIDS often assume static data distributions and fail to handle concept drift, leading to degraded performance and increased false positives in dynamic network environments. To address this issue, we propose DriftXpert, a novel NIDS for drift-adaptive detection. Specifically, we propose a decoupled two-stage offline adaptive framework. In Phase 1, we introduce an unsupervised anomaly metric based on latent manifold deviation. By performing outlier analysis within the latent space, the framework achieves high-sensitivity detection of network traffic concept drift. In Phase 2, to mitigate catastrophic forgetting under non-stationary distributions, we design a representation consistency alignment strategy. This strategy constrains the feature mapping between the legacy model and the drifted distribution, ensuring the model captures emerging attack characteristics while retaining discriminative power over known patterns. Furthermore, we incorporate cross-epoch neuron weight aggregation and selective freezing mechanisms to enable fine-grained knowledge transfer in the parameter space, effectively balancing model plasticity and stability. Extensive experiments on public datasets demonstrate that DriftXpert effectively adapts to drifted data without catastrophic forgetting. Furthermore, real-world evaluations on enterprise network further confirm its robustness and practical applicability, contributing to improved security protection for millions of users.