XGB-KLD: A DRIFT-AWARE ADAPTIVE INTRUSION DETECTION FRAMEWORK FOR DYNAMIC NETWORK ENVIRONMENTS

Abstract

The rising sophisticated and frequency of cyberattacks poses tremendous challenges for traditional intrusion detection systems (IDS), which often have problems in adapting themselves to dynamic network environments and evolving attack patterns. This study proposes a novel XGB-KLD framework which integrates XGBoost( XGB) for high accuracy classification and Kullback - Leibler Divergence (KLD) for concept drift detection. The proposed method employs NSL-KDD dataset to monitor the network traffic and dynamically detect the distributional shifts and retrain the model only when the drift is identified, which makes the model more efficient and reduces unnecessary computation. Extensive experiments show that XGB-KLD performs significantly better than traditional machine learning and deep learning methods such as MDGWO-NSA, CIADI with an accuracy of 96.5%, precision of 95.3%, recall of 94.8% and F1-score of 95.0%. K-fold-cross validation is used for checking the robustness of the framework and an ablation study for validation of the contributions of both KLD and drift-awareness. By statistical significance tests, it can be shown that improvements over baseline models are very significant (p < 0.01). The results show the effectiveness of XGB-KLD as drift-aware, adaptive IDS, which is capable of maintaining high performance in dynamic and imbalanced network environments.