Search papers, labs, and topics across Lattice.
To resolve severe performance degradation in network intrusion detection under non-stationary traffic distributions, the authors developed DriftXpert, a decoupled two-stage framework for proactive drift adaptation. The system pairs an unsupervised latent manifold outlier metric to detect distribution shifts with a representation consistency alignment loss and selective neuron freezing to navigate the stability-plasticity dilemma. Evaluated on public intrusion benchmarks and live enterprise network traffic, the method successfully learns emerging attack vectors while eliminating catastrophic forgetting of legacy threat signatures.
Network intrusion models can continuously absorb emerging zero-day attack patterns without catastrophic forgetting by pairing latent manifold drift tracking with selective parameter freezing.
Network intrusion detection systems (NIDS) are critical for cybersecurity, safeguarding services and data from potential attacks. However, existing AI-based NIDS often assume static data distributions and fail to handle concept drift, leading to degraded performance and increased false positives in dynamic network environments. To address this issue, we propose DriftXpert, a novel NIDS for drift-adaptive detection. Specifically, we propose a decoupled two-stage offline adaptive framework. In Phase 1, we introduce an unsupervised anomaly metric based on latent manifold deviation. By performing outlier analysis within the latent space, the framework achieves high-sensitivity detection of network traffic concept drift. In Phase 2, to mitigate catastrophic forgetting under non-stationary distributions, we design a representation consistency alignment strategy. This strategy constrains the feature mapping between the legacy model and the drifted distribution, ensuring the model captures emerging attack characteristics while retaining discriminative power over known patterns. Furthermore, we incorporate cross-epoch neuron weight aggregation and selective freezing mechanisms to enable fine-grained knowledge transfer in the parameter space, effectively balancing model plasticity and stability. Extensive experiments on public datasets demonstrate that DriftXpert effectively adapts to drifted data without catastrophic forgetting. Furthermore, real-world evaluations on enterprise network further confirm its robustness and practical applicability, contributing to improved security protection for millions of users.
