Scholarlink

<p>Static intrusion detection systems fail to maintain performance in evolving network environments because they are trained once on historical data and cannot adapt to concept drift in modern attack traffic. This study investigates an adaptive intrusion detection system based on incremental learning with the Random Forest algorithm and a&#xa0;controlled forgetting mechanism that replaces a&#xa0;subset of trees at each update instead of fully retraining the model. Experiments were conducted on the CIC-IDS-2017 and CIC-IDS-2018 datasets in four scenarios: a&#xa0;static baseline without updating, adaptive incremental learning with quality control, adaptive learning without imbalance constraints, and adaptive learning with strict data filtering. The results demonstrate that the incremental system surpasses the static baseline in terms of the F1-score, achieving average values of 0.846 on CIC-IDS-2017 and 0.760 on CIC-IDS-2018 in the unrestricted adaptive scenario, thereby mitigating the collapse in detection performance caused by concept drift. Compared to a&#xa0;static baseline trained only on the initial week, the adaptive configuration maintains a&#xa0;non-zero F1-score on most post-baseline intervals of CIC-IDS-2018, where the static model degrades to near-zero values. A&#xa0;structured set of hypotheses is formulated and tested to evaluate the contribution of the adaptive system components.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Adaptive intrusion detection system based on incremental learning and dynamic threshold calibration

  • 期刊论文

  • 发表日期：

    2026年7月8日

查看全文
  • Anton Gribachev,
  • Alexey Ruchay

摘要

Static intrusion detection systems fail to maintain performance in evolving network environments because they are trained once on historical data and cannot adapt to concept drift in modern attack traffic. This study investigates an adaptive intrusion detection system based on incremental learning with the Random Forest algorithm and a controlled forgetting mechanism that replaces a subset of trees at each update instead of fully retraining the model. Experiments were conducted on the CIC-IDS-2017 and CIC-IDS-2018 datasets in four scenarios: a static baseline without updating, adaptive incremental learning with quality control, adaptive learning without imbalance constraints, and adaptive learning with strict data filtering. The results demonstrate that the incremental system surpasses the static baseline in terms of the F1-score, achieving average values of 0.846 on CIC-IDS-2017 and 0.760 on CIC-IDS-2018 in the unrestricted adaptive scenario, thereby mitigating the collapse in detection performance caused by concept drift. Compared to a static baseline trained only on the initial week, the adaptive configuration maintains a non-zero F1-score on most post-baseline intervals of CIC-IDS-2018, where the static model degrades to near-zero values. A structured set of hypotheses is formulated and tested to evaluate the contribution of the adaptive system components.