Home / Current Issue / Paper 1725116
DCAD: A Dynamic Continual Anomaly Detection Framework for Adaptive Network Traffic Analysis under Concept Drift
Subject area: Science,Engineering and Technology · Area of research: Computer Engineering
DOI: 10.64388/ire1725116
Abstract
Machine-learning-based network anomaly detectors are usually trained once on historical traffic, yet real traffic keeps changing as applications, software, and attack techniques evolve, a problem known as concept drift. Detectors that ignore drift raise false alarms and miss novel attacks, and periodic manual retraining is costly. This paper proposes the Dynamic Continual Anomaly Detection (DCAD) framework, which couples a preprocessing layer, an ADWIN-based concept-drift monitor, an incremental learning engine, a replay-based knowledge-retention layer, and a threshold-based decision layer. An Autoencoder trained only on normal traffic serves as the detection engine and flags flows whose reconstruction error exceeds a validation-selected threshold. On the NSL-KDD benchmark, the Autoencoder detector is compared with SVM, Random Forest, and Isolation Forest. It achieved the highest accuracy (83.4% versus 78.1%, 77.1%, and 70.6%), a false positive rate of 3.7%, an attack recall of 73.7%, and the lowest per-sample inference time. Over ten consecutive evaluation segments its accuracy fell by 1.8 percentage points, against 3.2 and 3.1 for SVM and Random Forest. A streaming experiment with ADWIN-triggered incremental updates illustrates the adaptation mechanism. The limitations of the evaluation, including a single dataset and the absence of an end-to-end drift-adaptation test of the Autoencoder, are discussed.
Keywords
Anomaly detection, autoencoder, concept drift, continual learning, network intrusion detection, NSL-KDD
How to cite this paper
@article{1725116,
author = {Muhammad Mustapha Maihaja, Nyangwarimam Obadiah Ali},
title = {DCAD: A Dynamic Continual Anomaly Detection Framework for Adaptive Network Traffic Analysis under Concept Drift},
journal = {Iconic Research And Engineering Journals},
year = {2026},
volume = {10},
number = {5},
pages = {2841-2852},
issn = {2456-8880},
url = {https://www.irejournals.com/formatedpaper/1725116.pdf},
abstract = {Machine-learning-based network anomaly detectors are usually trained once on historical traffic, yet real traffic keeps changing as applications, software, and attack techniques evolve, a problem known as concept drift. Detectors that ignore drift raise false alarms and miss novel attacks, and periodic manual retraining is costly. This paper proposes the Dynamic Continual Anomaly Detection (DCAD) framework, which couples a preprocessing layer, an ADWIN-based concept-drift monitor, an incremental learning engine, a replay-based knowledge-retention layer, and a threshold-based decision layer. An Autoencoder trained only on normal traffic serves as the detection engine and flags flows whose reconstruction error exceeds a validation-selected threshold. On the NSL-KDD benchmark, the Autoencoder detector is compared with SVM, Random Forest, and Isolation Forest. It achieved the highest accuracy (83.4% versus 78.1%, 77.1%, and 70.6%), a false positive rate of 3.7%, an attack recall of 73.7%, and the lowest per-sample inference time. Over ten consecutive evaluation segments its accuracy fell by 1.8 percentage points, against 3.2 and 3.1 for SVM and Random Forest. A streaming experiment with ADWIN-triggered incremental updates illustrates the adaptation mechanism. The limitations of the evaluation, including a single dataset and the absence of an end-to-end drift-adaptation test of the Autoencoder, are discussed.},
keywords = {Anomaly detection, autoencoder, concept drift, continual learning, network intrusion detection, NSL-KDD},
month = {November},
doi = {https://doi.org/10.64388/ire1725116}
}