Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
To counteract concept drift in network intrusion detection without continuous model retraining, this work shifts intervention upstream by selecting feature spaces based on a model-agnostic temporal stability metric termed t-robustness. By jointly penalizing step-by-step distributional shifts and cumulative divergence from an initial baseline, the metric isolates structurally stable graph community and spectral representations of endpoint connectivity. On the UGR16 benchmark under completely frozen model conditions, t-robust feature spaces achieve a terminal retained expectancy of 0.6025, substantially outperforming both standard graph community features (0.5230) and raw NetFlow baselines (0.3831).
Network intrusion detectors can survive non-stationary drift without model updates by filtering for feature-level temporal divergence rather than reacting with post-hoc retraining.
In network traffic, legitimate behaviours and attack techniques evolve jointly - the phenomenon known as'concept drift'[1]. Every detector is thereby left obsolete between two updates, and always one step behind adversaries. In this work, we propose to move the point of intervention from the model, repaired after the drift, to the feature space, selected before learning. We therefore introduce t-robustness, a stability score defined for each feature independently of any detection model, comparable across an entire feature space. It combines the step-by-step distance between successive statistical states of a feature, and its cumulative divergence from its initial state, so that a slow monotonic drift cannot pass for stability. The candidates are drawn from abnormal network connectivity patterns left by scans, DoS and communications between endpoints, read through graph community metrics and spectral metrics. The evaluation is performed on the UGR16 dataset, across three learning scenarios and a control scenario, as well as without model update, and demonstrate that t-robust feature spaces sustain detection where the baselines collapse: retained expectancy at the last test interval reaches 0.6025, against 0.5230 for graph community features and 0.3831 for the base NetFlow features.