Drift-Aware Continual Generative Behavioral Detection for Zero-Day Cyberattacks: Reproducible Temporal Evaluation and SIEM-Ready Alerting

Abstract

Zero-day cyberattacks remain difficult to detect because their behavioral characteristics are not represented in the data available during model training. In addition, intrusion detection models operating in dynamic environments are vulnerable to concept drift, while continual-learning approaches may suffer from catastrophic forgetting. Many published evaluations are further affected by temporal leakage, which can lead to overly optimistic performance estimates. This study proposes DC-GenAIS, a drift-aware continual generative behavioral detection framework for adaptive intrusion detection. The framework combines concept-drift monitoring, bounded model adaptation, and drift-triggered generative replay to preserve rare attack behaviors while adapting to changing traffic distributions. To improve experimental validity, a leakage-aware temporal evaluation protocol is employed, including chronological data partitioning, train-only preprocessing, and time-separated model selection. The framework also produces calibrated risk scores and structured alert metadata through a SIEM-oriented integration interface. The proposed framework was evaluated on the CICIDS2017, UNSW-NB15, and NSL-KDD benchmark datasets under static, streaming, concept-drift, and leave-one-attack-family-out (LOAFO) evaluation settings. Results indicate improved robustness under distributional shifts, lower false-alert rates, and stronger generalization to previously unseen attack behaviors compared with representative baseline approaches. The findings further demonstrate the importance of leakage-aware temporal evaluation for obtaining reliable estimates of intrusion-detection performance. Overall, the study highlights the value of integrating drift monitoring, continual adaptation, and generative replay within a reproducible framework for behavioral intrusion detection in evolving cybersecurity environments.