Aram Kim

A Label-Efficient Adaptive Retraining Framework for Network Intrusion Detection Under Streaming Arrival Bias

Network intrusion detectors degrade when operational traffic diverges from their training domain, yet unconditional retraining wastes scarce labeling effort. Using CIC-IDS2017 and CSE-CIC-IDS2018 as source and target domains, with the target replayed chronologically, we report two findings. First, degradation is hetero...