Continual Learning-Based Detection of Emerging Cyberattacks in Dynamic Network Environment

Abstract

Modern computer networks continuously change because of cloud services, IoT devices, mobile users, distributed applications, and evolving communication patterns. Conventional machine-learning intrusion detection systems are commonly trained on historical traffic and may degrade when traffic distributions or attack behaviors change. This paper proposes a Continual Learning-Based Emerging Cyberattack Detection Framework (CL-ECAF) for dynamic network environments. The framework integrates network-flow preprocessing, feature extraction, drift detection, incremental learning, experience replay, and knowledge-preservation mechanisms. The system continuously monitors incoming traffic, identifies distributional changes, and updates the detection model when newbehavioral patterns appear. Replay samples help retain knowledge of earlier attacks, while regularization or knowledge distillation reduces catastrophic forgetting. The framework can be evaluated with temporally ordered CICIDS2017 and UNSW-NB15 traffic. Evaluation should include precision, recall, F1-score, false-positive rate, detection latency, adaptation time, forgetting, throughput, and memory usage. The proposed design provides a practical foundation for adaptive network intrusion detection capable of learning emerging threats without repeatedly rebuilding the complete model.