Continual learning for adaptive IoT network intrusion detection via domain-incremental learning methods

초록

The proliferation of Internet of Things (IoT) devices increases exposure to network intrusions and motivates the development of Network Intrusion Detection Systems (NIDS) that can adapt to newly emerging attacks. However, models retrained on new threats often suffer from catastrophic forgetting, resulting in degraded performance on previously observed attacks. This paper evaluates continual learning (CL) strategies for neural-network-based NIDS on three IoT/network intrusion datasets (UQ-IoT-IDS-2021, Kitsune, and CIC-IDS-2017) under an incremen tal training protocol that sequentially introduces new attack types over nine stages while testing on a cumulative set of previously encountered attacks. We compare eight CL strategies spanning weight inheritance (WI), regular ization (EWC, LwF, SI), replay (ER, A-GEM, DER++), and their WI-based combination (EWC + ER) across MLP, LSTM, and Transformer architectures, under both balanced and unbalanced protocols. Across the three datasets, replay-based strategies retain final-stage macro-F1 of 0.92-0.98 with average forgetting below 0.05, whereas regularization-only and naive sequential strategies suffer macro-F1 drops of 0.30-0.55 and forgetting rates above 0.32. Replay's resource footprint is modest (peak CL state below 0.4 MB on MLP at a 100-sample-per-class buffer; training time within 1.5 & times; of weight inheritance), and the same ranking holds across the three deep architec tures and the unbalanced regime when measured by PR-AUC and false positive rate at high recall. A comparison against three unsupervised anomaly detectors (KitNET, Isolation Forest, and an autoencoder) further indicates that supervised continual learning is the more effective choice when labeled samples of new attack classes are available. The results confirm that memory-based mechanisms are central to sustaining detection performance in domain-incremental IoT NIDS scenarios.

키워드