Candidate Comparability Before Promotion: Conditional Validation in Adaptive Network Intrusion Detection
Adaptive network intrusion detection systems retrain classifiers after drift alarms, but an alarm detects change; it does not establish that a challenger should replace the deployed incumbent. Promotion is security-relevant because it changes the model responsible for subsequent attack detection, and evaluating it has a methodological problem: promotion conclusions may depend on how the challenger was constructed and on how much evidence supports it. We test that dependence on CICIDS2017, UNSW-NB15 and ToN-IoT with self-contained challenger pipelines, nested candidate-size controls, a common-harness comparison of nine update policies, and a final sensitivity confining every exact feature ...
| Authors | Roberto Fernández-Barrios, Iker Pastor-López, Amaia Pikatza-Huerga et al. |
|---|---|
| Primary category | cs.CR |
| Published | 3 September 2026 |
| Last updated at source | 3 September 2026 |
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 17 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.