💻 computer science

ADAPT-IDS: An Unsupervised Multi-Metric Framework forReliable Concept Drift Detection and Adaptive Intrusion Detectionin Evolving Network Streams

This paper presents ADAPT-IDS, an unsupervised multi-metric framework that reliably detects concept drift in evolving network streams using a weighted evidence-fusion mechanism and persistence-based confirmation, subsequently triggering adaptive model retraining with minimal manual annotation to maintain high intrusion detection performance.

Original authors: ROHIT THAKUR, Raj Kumari

Published 2026-09-29

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: ROHIT THAKUR, Raj Kumari

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The digital world is a living, breathing ecosystem that never stops moving. Every time a new app is launched, a cloud service is updated, or a device is connected, the flow of data across networks changes. This constant evolution creates a problem for the digital sentinels designed to protect these networks: intrusion detection systems. These systems act as security guards, trained to spot malicious activity by recognizing specific patterns of behavior. However, they are often trained on a snapshot of the past. As the network changes, the patterns of normal traffic shift, and the patterns of attack evolve. A system that worked perfectly yesterday might miss a new threat today simply because the environment it is watching has changed. This phenomenon, known as concept drift, is the silent enemy of static security models. If a security system cannot adapt to these shifts, it begins to sound false alarms or, worse, fails to see real attacks entirely. The challenge for researchers is to build a system that can learn from these changes without needing a human expert to constantly re-label every single piece of data, a task that is often too slow and expensive to be practical.

In a recent study, researchers Rohit Thakur and Raj Kumari from Panjab University proposed a solution called ADAPT-IDS, a framework designed to keep intrusion detection systems reliable even as the network landscape shifts beneath them. Their approach treats the problem in two distinct stages: first, it watches for signs that the network is changing, and second, it only updates its security model when those changes are proven to be lasting. The system does not rely on a single way of measuring change. Instead, it uses four different signals to get a complete picture of what is happening. One signal measures how much the overall shape of the data has shifted, another looks at how far the average values have moved, a third checks if the differences are statistically significant, and a fourth measures how many data points are behaving unlike the normal, safe traffic the system has learned to recognize. By combining these four perspectives, the system builds a robust case for whether a change is real or just a temporary glitch.

The researchers were careful to avoid the common trap of reacting to every small fluctuation. Network traffic naturally ebbs and flows; a sudden spike in activity might be a harmless surge of users rather than a new attack. To prevent the system from constantly resetting itself based on these temporary blips, ADAPT-IDS requires proof of persistence. The system does not trigger an update the moment it sees a change. Instead, it waits to see if the signs of change appear repeatedly over a short period. Only when the evidence confirms that the network has settled into a new, different state does the system decide to adapt. This patience ensures that the security model is not destabilized by noise, but only by genuine, sustained shifts in the environment.

Once the system confirms that a real change has occurred, it faces the difficult task of updating itself without a full set of new labels. In a perfect world, a human expert would verify every new piece of traffic to tell the system if it is safe or dangerous. In reality, this is impossible for the massive volume of data flowing through modern networks. ADAPT-IDS solves this by using a selective labeling strategy. When an update is needed, the system asks for human labels on only a small, carefully chosen sample of the new traffic. To fill in the rest of the training data, it uses a clever trick: it identifies traffic that looks highly confident to be safe based on its own internal understanding of normal behavior. It then mixes these high-confidence safe samples with the small batch of human-verified samples to create a balanced training set. This allows the system to learn from the new environment while remembering what it learned before, ensuring it does not forget how to spot old threats while learning new ones.

The researchers tested this framework on a massive, real-world dataset containing nearly two million network traffic records, arranged in the exact order they happened over time. They split the data so that the first 200,000 records were used to build the initial security model, and the remaining 1.8 million records were processed as a continuous stream. As the system watched this stream, it identified 327 moments where the traffic looked different enough to be a potential change. However, thanks to its persistence rule, it only confirmed 73 of these as real, lasting shifts that required an update. This meant the system only had to retrain itself 73 times, rather than reacting to every single blip. During these updates, it requested human labels for only about 7.7% of the traffic, leaving the vast majority of the data to be processed automatically.

The results of this approach were striking. By adapting only when necessary and using a mix of human and automated learning, the system maintained a high level of accuracy. It correctly identified malicious traffic with a precision of nearly 99.94%, meaning it almost never raised a false alarm. It also successfully detected about 85.88% of the actual attacks, a strong performance given the evolving nature of the data. The system achieved an overall accuracy of 97.46% and a balanced accuracy of 92.93%, demonstrating that it could handle the shifting landscape without losing its footing. The researchers also tested the system on a different dataset to ensure these results were not a fluke, and it performed similarly well, confirming that the method works across different types of network traffic.

This work highlights a crucial shift in how we think about digital security. Instead of building a static fortress that eventually becomes obsolete, the researchers have shown that a system can be designed to evolve alongside the threats it faces. The key insight is that adaptation does not require constant human intervention or a complete overhaul of the system every time the network changes. By using multiple signals to detect change, waiting for that change to prove itself, and then learning efficiently from a small amount of new information, the system remains sharp and reliable. The study suggests that the future of intrusion detection lies in this kind of intelligent, measured adaptation, where the system knows when to listen to the noise and when to learn from the signal. While the researchers note that more testing is needed to compare this approach directly with other methods and to see how it holds up in real-time, the findings offer a promising path forward for securing networks that are constantly in flux.

Technical Summary: ADAPT-IDS

Problem Statement

Intrusion Detection Systems (IDSs) operating in evolving network environments face a critical challenge: concept drift. As network traffic patterns, application behaviors, and attack techniques change over time, the statistical distribution of incoming data diverges from the data used during initial model training. This phenomenon leads to a gradual degradation in detection performance, manifesting as increased false alarms and missed attacks.

Existing solutions often rely on error-based drift detection, which requires timely ground-truth labels—a constraint that is impractical in high-volume network streams where expert verification is costly or delayed. Furthermore, many adaptive approaches trigger immediate model updates upon detecting statistical deviations. This can lead to instability, as transient traffic fluctuations (e.g., temporary bursts or routine variations) may be mistaken for persistent environmental changes, resulting in unnecessary retraining and potential model instability. There is a need for a framework that can detect drift without continuous labeling, distinguish persistent changes from noise, and adapt the IDS efficiently using limited supervision.

Methodology

The paper proposes ADAPT-IDS, an unsupervised multi-metric framework designed for reliable concept drift detection and adaptive intrusion detection. The architecture decouples drift monitoring from model adaptation, operating through a chronological, prequential evaluation protocol.

1. Unsupervised Multi-Metric Drift Monitoring

The core of the framework is a label-independent monitoring layer that evaluates incoming traffic batches against a reference window using four complementary statistical indicators:

Jensen–Shannon Divergence (JS): Measures the global distributional similarity between reference and current traffic.
Standardized Distributional Difference (ED): Captures changes in feature-level location relative to reference variability.
Statistical Drift Significance (DS): Uses the Kolmogorov–Smirnov (KS) test to evaluate feature-level distributional changes, applying multiple-testing corrections.
Residual Exceedance Rate (RS): Measures the proportion of observations deviating from a learned benign traffic profile using a reconstruction model.

These four signals are combined via a weighted evidence-fusion mechanism to produce a single drift score ( $D_t$ ). The framework imposes minimum-effect constraints (e.g., $JS \ge 0.01$ , $ED \ge 0.05$ ) to ensure that statistically significant but practically negligible changes do not trigger adaptation.

2. Persistence-Based Confirmation

To prevent over-reaction to transient fluctuations, ADAPT-IDS introduces a persistence criterion. A candidate drift event is generated when the fused score exceeds a calibrated threshold. However, model adaptation is only triggered if a sequence of candidate events satisfies a temporal persistence rule: at least $K$ candidate alarms must occur within a window of $W$ consecutive batches. In the experimental configuration, $W=5$ and $K=3$ . This ensures that only sustained distributional changes initiate the adaptation process.

3. Selective Labeling and Adaptive Retraining

Once persistent drift is confirmed, the framework activates a selective-label adaptation procedure:

Oracle Labeling: A limited subset of samples (up to 2,000 per event) is submitted for expert (oracle) labeling.
High-Confidence Benign Selection: An additional set of samples (up to 500) is automatically selected based on low reconstruction error, assuming they belong to the benign class.
Balanced Replay Buffer: These labeled and high-confidence benign samples are combined with retained historical data in a class-balanced replay buffer (capped at 10,000 benign and 10,000 attack samples).
Model Update: The supervised IDS (implemented as a HistGradientBoosting classifier) is retrained using this balanced buffer.
Reference Rebaselining: The reference distribution is updated using recent traffic batches to reflect the new operating regime, preventing the accumulation of obsolete baselines.

The entire process follows a prediction-before-adaptation sequence, ensuring that predictions for a batch are generated before any adaptation triggered by that batch occurs, thereby preventing data leakage.

Key Contributions

The paper outlines five primary contributions:

Unsupervised Multi-Metric Drift Detection: A label-independent mechanism fusing JS divergence, standardized distributional difference, statistical drift significance, and residual exceedance to characterize evolving traffic.
Persistence-Aware Drift Confirmation: A temporal mechanism that separates isolated candidate events from persistent changes, reducing false adaptation triggers.
Selective-Label Adaptive IDS: A strategy that restricts manual labeling to confirmed adaptation events, combining oracle labels with high-confidence benign samples to maintain class balance.
Chronological Prequential Evaluation: A rigorous evaluation protocol on large temporal streams that prevents future information from influencing past predictions.
Empirical Analysis: A comprehensive evaluation of drift detection behavior, adaptation frequency, labeling efficiency, and feature sensitivity under evolving conditions.

Experimental Results

The framework was evaluated on chronologically ordered subsets of the CIC-IDS-2018 and CIC-IDS-2017 datasets.

CIC-IDS-2018 Evaluation:

Dataset: 1,897,150 instances processed in 380 batches.
Drift Detection: Identified 327 candidate drift events, of which 73 satisfied the persistence criterion and triggered adaptation.
Performance: Achieved 97.46% accuracy, 99.94% precision, 85.88% detection rate, 92.38% F1-score, and 0.912 MCC. The false-alarm rate was exceptionally low at 0.0119%.
Labeling Efficiency: Oracle labeling was required for only 7.70% of the evaluation stream instances.

CIC-IDS-2017 Verification:

Dataset: 312,212 instances processed in 63 batches.
Performance: Achieved 94.46% accuracy, 99.97% precision, and 94.24% F1-score.
Adaptation: 13 persistent drift events were confirmed, triggering 13 model updates.
Labeling Efficiency: Oracle labeling accounted for 8.33% of the stream.

Feature ablation studies indicated that removing the destination port feature slightly improved detection rates but increased false alarms, while removing the protocol feature had no measurable impact under the tested configuration.

Significance and Claims

The authors position ADAPT-IDS as a practical solution for the operational constraints of network security, specifically the high cost of continuous labeling and the instability caused by reacting to transient traffic noise.

The paper claims that the framework successfully addresses two critical requirements for streaming IDSs:

Detecting changes without relying on continuously available labels by utilizing unsupervised multi-metric monitoring.
Limiting model updates to situations where persistent evidence of change has been observed, thereby avoiding unnecessary retraining.

The authors explicitly state that the results demonstrate the feasibility of this approach under the evaluated settings. They maintain a modest stance, noting that the findings should not be interpreted as proof of universal superiority over existing concept-drift-aware IDS frameworks. They emphasize that direct comparisons with established methods (such as HOIDS, ADWIN, or DDM) under identical chronological protocols and preprocessing conditions are necessary to establish relative advantages. The work is presented as a structured integration of existing statistical and learning components into a cohesive, label-efficient adaptation pipeline.