International Journal of Advanced Technology and Engineering Exploration ISSN (Print): 2394-5443    ISSN (Online): 2394-7454 Volume-13 Issue-140 July-2026
  1. 4923
    Citations
  2. 2.8
    CiteScore
Behavioral instability in anomaly-based intrusion detection systems under concept drift: from blindness to sensitivity inflation

Mohammad M. Rasheed1 and Mustafa Muwafak Alobaedy2

Government College of Engineering,University of Information Technology and Communications,Baghdad, 10013,Iraq1
Centre for Image and Vision Computing,Multimedia University, Persiaran Multimedia, Cyberjaya, 63100,Selangor,Malaysia2
Corresponding Author : Mustafa Muwafak Alobaedy

Recieved : 28-March-2026; Revised : 19-July-2026; Accepted : 21-July-2026

Abstract

Anomaly-based intrusion detection systems (IDS) are commonly evaluated under the assumption that network traffic remains stationary over time. However, in real-world deployments, they are constantly faced with concept drift. This drift may make the overall performance of the detectors, e.g., the F1-score, look fine and mask substantial variations in detector behaviour. The goal of this study is not to conclude if concept drift affects overall performance, but to describe how it affects the anomaly detection performance over time and what are the different failure modes of the behaviour. For this purpose, three datasets for intrusion detection, namely CIC-IoT-2023, Edge-industrial IoT (Edge-IIoTset), and UNSW-NB15, with different class distributions are used and evaluated with a common temporal evaluation framework. The results show that concept drift doesn't lead to a consistent decrease in performance. In contrast, it results in specific behaviour changes, such as total blindness, sensitivity inflation and relatively stable detection. In all experimental conditions, the isolation forest (IF) was the most unstable in terms of behaviours. Its recall was still close to zero on Edge-IIoTset dataset while Gaussian mixture model (GMM) and autoencoder (AE) were able to detect the attacks with near-perfect accuracy in the attack-contaminated segments. The results indicate that the overall performance of an IDS may mask failure modes that are operationally relevant and that a time-based behavioural assessment more realistically assesses IDS reliability in a dynamic cyber security context.

Keywords

Concept drift, Intrusion detection system (IDS), Anomaly-based intrusion detection, Isolation forest (IF), Temporal evaluation, Behavioral analysis.

Cite this article

Rasheed MM, Alobaedy MM. Behavioral instability in anomaly-based intrusion detection systems under concept drift: from blindness to sensitivity inflation. International Journal of Advanced Technology and Engineering Exploration. 2026;13(140):275-302. DOI : 10.19101/IJATEE.2026.131340379

References
[1]
Thakkar A, Lohiya R. A review on challenges and future research directions for machine learning-based intrusion detection system. Archives of Computational Methods in Engineering. 2023; 30(7):4245-69.
[Crossref] [Google Scholar]
[2]
Morshedi R, Matinkhah SM. A comprehensive review of deep learning techniques for anomaly detection in IoT networks: methods, challenges, and datasets. Engineering Reports. 2025; 7(9):1-29.
[Crossref] [Google Scholar]
[3]
Mallidi SK, Ramisetty RR. Optimizing intrusion detection for IoT: a systematic review of machine learning and deep learning approaches with feature selection and data balancing. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery. 2025; 15(2): e70008.
[Crossref] [Google Scholar]
[4]
Sommer R, Paxson V. Outside the closed world: on using machine learning for network intrusion detection. In symposium on security and privacy 2010 (pp. 305-16). IEEE.
[Crossref] [Google Scholar]
[5]
Arp D, Quiring E, Pendlebury F, Warnecke A, Pierazzi F, Wressnegger C, et al. Dos and don'ts of machine learning in computer security. In 31st USENIX security symposium 2022 (pp. 3971-88).
[Crossref] [Google Scholar]
[6]
Gama J, Žliobaitė I, Bifet A, Pechenizkiy M, Bouchachia A. A survey on concept drift adaptation. ACM Computing Surveys. 2014; 46(4):1-37.
[Crossref] [Google Scholar]
[7]
Shyaa MA, Ibrahim NF, Zainol Z, Abdullah R, Anbar M, Alzubaidi L. Evolving cybersecurity frontiers: a comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems. Engineering Applications of Artificial Intelligence. 2024; 137:1-34.
[Crossref] [Google Scholar]
[8]
Jordaney R, Sharad K, Dash SK, Wang Z, Papini D, Nouretdinov I, et al. Transcend: detecting concept drift in malware classification models. In 26th USENIX security symposium 2017 (pp. 625-42).
[Google Scholar]
[9]
Pendlebury F, Pierazzi F, Jordaney R, Kinder J, Cavallaro L. {TESSERACT}: eliminating experimental bias in malware classification across space and time. In 28th USENIX security symposium 2019 (pp. 729-46).
[Google Scholar]
[10]
Andresini G, Pendlebury F, Pierazzi F, Loglisci C, Appice A, Cavallaro L. Insomnia: towards concept-drift robustness in network intrusion detection. In proceedings of the 14th ACM workshop on artificial intelligence and security 2021 (pp. 111-22). ACM.
[Crossref] [Google Scholar]
[11]
Yang S, Zheng X, Li J, Xu J, Wang X, Ngai EC. Recda: concept drift adaptation with representation enhancement for network intrusion detection. In proceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining 2024 (pp. 3818-28). ACM.
[Crossref] [Google Scholar]
[12]
Rasheed MM, Faaeq MK. Behavioral detection of scanning worm in cyber defense. In proceedings of the future technologies conference 2018 (pp. 214-25). Cham: Springer International Publishing.
[Crossref] [Google Scholar]
[13]
Gama J, Medas P, Castillo G, Rodrigues P. Learning with drift detection. In Brazilian symposium on artificial intelligence 2004 (pp. 286-95). Berlin, Heidelberg: Springer Berlin Heidelberg.
[Crossref] [Google Scholar]
[14]
Chu R, Jin P, Qiao H, Feng Q. Intrusion detection in the IoT data streams using concept drift localization. AIMS Mathematics. 2023; 9(1):1535-61.
[Crossref] [Google Scholar]
[15]
Shyaa MA, Zainol Z, Abdullah R, Anbar M, Alzubaidi L, Santamaría J. Enhanced intrusion detection with data stream classification and concept drift guided by the incremental learning genetic programming combiner. Sensors. 2023; 23(7):1-34.
[Crossref] [Google Scholar]
[16]
Xu L, Ding X, Peng H, Zhao D, Li X. ADTCD: an adaptive anomaly detection approach toward concept drift in IoT. IEEE Internet of Things Journal. 2023; 10(18):15931-42.
[Crossref] [Google Scholar]
[17]
Mohale VZ, Obagbuwa IC. Evaluating machine learning-based intrusion detection systems with explainable AI: enhancing transparency and interpretability. Frontiers in Computer Science. 2025; 7:1-23.
[Crossref] [Google Scholar]
[18]
Hashim A, Rasheed M, Abdullah S. Analysis of bluetooth low energy based indoor localization system using machine learning algorithms. Journal of Engineering Science and Technology. 2021; 16(4):2816-24.
[Google Scholar]
[19]
Barbero F, Pendlebury F, Pierazzi F, Cavallaro L. Transcending transcend: revisiting malware classification in the presence of concept drift. In IEEE symposium on security and privacy (SP) 2022 (pp. 805-23). IEEE.
[Crossref] [Google Scholar]
[20]
Haque A, Soliman H. A transformer-based autoencoder with isolation forest and XGBoost for malfunction and intrusion detection in wireless sensor networks for forest fire prediction. Future Internet. 2025; 17(4):1-12.
[Crossref] [Google Scholar]
[21]
Bifet A, Gavalda R. Learning from time-changing data with adaptive windowing. In proceedings of the SIAM international conference on data mining 2007 (pp. 443-8). Society for Industrial and Applied Mathematics.
[Crossref] [Google Scholar]
[22]
Bagui SS, Khan MP, Valmyr C, Bagui SC, Mink D. Model retraining upon concept drift detection in network traffic big data. Future Internet. 2025; 17(8):1-24.
[Crossref] [Google Scholar]
[23]
Hussein SA, Répás SR. A hybrid intrusion detection framework using deep autoencoder and machine learning models. AI. 2026; 7(2):1-31.
[Crossref] [Google Scholar]
[24]
Bachar M, Khiat A, El GK. Hybrid autoencoder and isolation forest for IoT anomaly detection with a novel model. Engineering, Technology & Applied Science Research. 2026; 16(1):31123-9.
[Crossref] [Google Scholar]
[25]
Seth S, Chahal KK, Singh G. Concept drift–based intrusion detection for evolving data stream classification in ids: approaches and comparative study. The Computer Journal. 2024; 67(7):2529-47.
[Crossref] [Google Scholar]
[26]
Horchulhack P, Viegas EK, Lopez MA. A stream learning intrusion detection system for concept drifting network traffic. In 6th cyber security in networking conference (CSNet) 2022 (pp. 1-7). IEEE.
[Crossref] [Google Scholar]
[27]
Wahab OA. Intrusion detection in the IoT under data and concept drifts: online deep learning approach. IEEE Internet of Things Journal. 2022; 9(20):19706-16.
[Crossref] [Google Scholar]
[28]
Neto EC, Dadkhah S, Ferreira R, Zohourian A, Lu R, Ghorbani AA. CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors. 2023; 23(13):1-26.
[Crossref] [Google Scholar]
[29]
Ferrag MA, Friha O, Hamouda D, Maglaras L, Janicke H. Edge-IIoTset: a new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning. IEEE Access. 2022; 10:40281-306.
[Crossref] [Google Scholar]
[30]
Moustafa N, Slay J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In military communications and information systems conference (MilCIS) 2015 (pp. 1-6). IEEE.
[Crossref] [Google Scholar]
[31]
Liu FT, Ting KM, Zhou ZH. Isolation forest. In eighth international conference on data mining 2008 (pp. 413-22). IEEE.
[Crossref] [Google Scholar]
[32]
Reynolds DA. Gaussian mixture models. Encyclopedia of Biometrics. 2009; 741(659-63):3.
[Google Scholar]
[33]
Youden WJ. Index for rating diagnostic tests. Cancer. 1950; 3(1):32-5.
[Crossref] [Google Scholar]