Citation

Rasheed, Mohammad M. and Alobaedy, Mustafa Muwafak (2026) Behavioral instability in anomaly-based intrusion detection systems under concept drift: from blindness to sensitivity inflation. International Journal of Advanced Technology and Engineering Exploration, 13 (140). pp. 275-302. ISSN 23945443

Text 19.pdf - Published Version Restricted to Repository staff only Download (1MB)

Abstract

Anomaly-based intrusion detection systems (IDS) are commonly evaluated under the assumption that network traffic remains stationary over time. However, in real-world deployments, they are constantly faced with concept drift. This drift may make the overall performance of the detectors, e.g., the F1-score, look fine and mask substantial variations in detector behaviour. The goal of this study is not to conclude if concept drift affects overall performance, but to describe how it affects the anomaly detection performance over time and what are the different failure modes of the behaviour. For this purpose, three datasets for intrusion detection, namely CIC-IoT-2023, Edge-industrial IoT (Edge-IIoTset), and UNSW-NB15, with different class distributions are used and evaluated with a common temporal evaluation framework. The results show that concept drift doesn't lead to a consistent decrease in performance. In contrast, it results in specific behaviour changes, such as total blindness, sensitivity inflation and relatively stable detection. In all experimental conditions, the isolation forest (IF) was the most unstable in terms of behaviours. Its recall was still close to zero on EdgeIIoTset dataset while Gaussian mixture model (GMM) and autoencoder (AE) were able to detect the attacks with nearperfect accuracy in the attack-contaminated segments. The results indicate that the overall performance of an IDS may mask failure modes that are operationally relevant and that a time-based behavioural assessment more realistically assesses IDS reliability in a dynamic cyber security context.

Item Type:	Article
Uncontrolled Keywords:	Concept drift, Intrusion detection system (IDS)
Subjects:	Q Science > QA Mathematics > QA71-90 Instruments and machines > QA75.5-76.95 Electronic computers. Computer science
Divisions:	Faculty of Computing and Informatics (FCI)
Depositing User:	Ms Rosnani Abd Wahab
Date Deposited:	03 Sep 2026 02:02
Last Modified:	03 Sep 2026 02:02
URII:	http://shdl.mmu.edu.my/id/eprint/16573

Downloads

Edit (login required)