Adaptive-Delta ADWIN: A Framework for Stable and Sensitive Intrusion Detection in Streaming Networks
Abstract
Intrusion Detection Systems (IDS) must adapt to network traffic streams where concept drift alters the normal and malicious behaviors. The traditional drift detectors with fixed sensitivity parameter () fail to balance responsiveness and stability, reducing detection reliability. This study introduces Adaptive−Delta ADWIN framework that adjusts through two online controllersthe Volatility Controller (VC) and AlertRate Controller (ARC) to improve the sensitivity while maintaining stability. The experiments were evaluated on the CICIDS2017 dataset using multiclass ensemble of Hoeffding Adaptive Trees, the framework achieved 0.930.95, surpassing fixed baselines by up to 6.6%. The false positive and false negative rates were reduced by 50% and 30%. Overall, the results confirm that Adaptive ADWIN enhances multiclass IDS performance between detection sensitivity and operational stability in the realtime network conditions.
Downloads
References
E. Mahdavi et al., “ITL-IDS: Incremental transfer learning for intrusion detection systems,” Knowledge-Based Systems, vol. 253, Art. no. 109542, 2022, doi: 10.1016/j.knosys.2022.109542.
O. H. Abdulganiyu, T. A. Tchakoucht, and Y. K. Saheed, “A systematic literature review for network intrusion detection system (IDS),” Int. J. Inf. Secur., vol. 22, no. 5, pp. 1125–1162, 2023, doi: 10.1007/s10207-023-00682-2.
A. Heidari and M. A. J. Jamali, “Internet of Things intrusion detection systems: A comprehensive review and future directions,” Cluster Comput., vol. 26, no. 6, pp. 3753–3780, 2023, doi: 10.1007/s10586-022-03776-z.
H. Yu et al., “Detecting group concept drift from multiple data streams,” Pattern Recognit., vol. 134, Art. no. 109113, 2023, doi: 10.1016/j.patcog.2022.109113.
J. Haug and G. Kasneci, “Learning parameter distributions to detect concept drift in data streams,” in Proc. ICPR, 2020, doi: 10.1109/ICPR48806.2021.9412499.
R. Panigrahi and S. Borah, “A detailed analysis of CICIDS2017 dataset for designing intrusion detection systems,” Int. J. Eng. Technol., vol. 7, no. 3.24, pp. 479–482, 2018.
Ö. Gözüaçık and F. Can, “Concept learning using one-class classifiers for implicit drift detection in evolving data streams,” Artif. Intell. Rev., vol. 54, no. 5, pp. 3725–3747, 2021, doi: 10.1007/s10462-020-09939-x.
A. S. Palli et al., “Online machine learning from non-stationary data streams in the presence of concept drift and class imbalance,” J. Inf. Commun. Technol., vol. 23, no. 1, pp. 105–139, 2024.
M. Fuccellaro, Concept Drift: Detection, Update and Correction, Ph.D. dissertation, Univ. Bordeaux, 2024.
M. Lima, T. S. Filho, and R. A. A. Fagundes, “A comparative study on concept drift detectors for regression,” in Proc. Brazilian Conf. Intell. Syst., 2021, doi: 10.1007/978-3-030-91702-9_26.
A. Chaudhari et al., “A systematic review of literature: Concept drift detection techniques,” SSRN, 2023, doi: 10.2139/ssrn.4939983.
S. B. Mannapur, “Understanding data drift and concept drift in machine learning systems,” 2025, doi: 10.32628/CSEIT25111239.
D. N. Assis and V. M. A. Souza, “ADWIN-U: Adaptive windowing for unsupervised drift detection on data streams,” Knowl. Inf. Syst., 2025, doi: 10.1007/s10115-025-02523-1.
O. A. Mahdi et al., “Online concept drift detector: Optimally balancing delay detection, runtime, memory, and accuracy,” Procedia Comput. Sci., vol. 237, pp. 559–567, 2024, doi: 10.1016/j.procs.2024.05.140.
T. Mehmood et al., “LSTMDD: An optimized LSTM-based drift detector,” PeerJ Comput. Sci., vol. 10, Art. no. e1827, 2024, doi: 10.7717/peerj-cs.1827.
S. Agrahari and A. K. Singh, “Comparison-based analysis of window approaches for concept drift detection,” Appl. Intell., vol. 55, no. 1, 2025, doi: 10.1007/s10489-024-05890-4.
H. Mehmood et al., “Concept drift adaptation techniques in distributed environment,” Smart Cities, vol. 4, no. 1, pp. 349–371, 2021, doi: 10.3390/smartcities4010021.
P. Wang et al., “Noise tolerant drift detection method,” Inf. Sci., vol. 609, pp. 1318–1333, 2022, doi: 10.1016/j.ins.2022.07.065.
M. Z. A. Mayaki and M. Riveill, “Autoregressive-based drift detection method,” in Proc. IJCNN, 2022, doi: 10.1109/IJCNN55064.2022.9892066.
Y. Zhao et al., “Stratified and time-aware sampling based adaptive ensemble learning,” Appl. Intell., vol. 51, no. 6, pp. 3121–3141, 2021, doi: 10.1007/s10489-020-01851-9.
T. Arjunan, “Real-time detection of network traffic anomalies in big data environments,” IJRASET, vol. 12, no. 9, 2024, doi: 10.22214/ijraset.2024.58946.
L. Hu, Y. Lu, and Y. Feng, “Concept drift detection based on deep neural networks and autoencoders,” Appl. Sci., vol. 15, no. 6, Art. no. 3056, 2025, doi: 10.3390/app15063056.
T. Mehmood et al., “DRIFTNET-EnVACK,” IEEE Access, vol. 12, pp. 80020–80034, 2024, doi: 10.1109/ACCESS.2024.3409433.
S. Kronberg, “Concept drift detection in document classification,” 2024.
H. Moharram, A. Awad, and P. M. El-Kafrawy, “Optimizing ADWIN for steady streams,” in Proc. ACM/SAC, 2022.
D. Morales-Brotons, T. Vogels, and H. Hendrikx, “Exponential moving average of weights in deep learning,” arXiv, 2024, doi: 10.48550/arXiv.2411.18704.
J. Li, R. Song, and H. Zhang, “Dynamic aircraft conflict alert,” in J. Phys.: Conf. Ser., vol. 1813, 2021, doi: 10.1088/1742-6596/1813/1/012022.
A. Esteban et al., “Simultaneous fault prediction in evolving industrial environments,” Appl. Intell., vol. 55, no. 13, 2025, doi: 10.1007/s10489-025-06786-7.
A. Esteban et al., “Hoeffding adaptive trees for multi-label classification,” Knowl.-Based Syst., vol. 304, 2024, Art. no. 112561, doi: 10.1016/j.knosys.2024.112561.
M. M. Saeed, “A real-time adaptive network intrusion detection,” Neural Comput. Appl., vol. 34, no. 8, pp. 6227–6240, 2022.
A. Abid, F. Jemili, and O. Korbaa, “Real-time data fusion for intrusion detection,” Cluster Comput., vol. 27, no. 2, pp. 2217–2238, 2024, doi: 10.1007/s10586-023-04087-7.
H. I. Bensaoula and S. N. Bahloul, “Enhanced Green Accelerated Hoeffding Trees,” Comput. Sci., vol. 33, no. 2, 2025, doi: 10.56415/csjm.v33.09.
A. Al-Shammari, “Ensemble diversification using improved Hoeffding trees,” J. Al-Qadisiyah Comput. Sci. Math., vol. 16, no. 2, 2024, doi: 10.29304/jqcsm.2024.16.21569.
C. Manapragada, M. Salehi, and G. I. Webb, “Extremely fast Hoeffding adaptive tree,” in Proc. ICDM, 2022, doi: 10.1109/ICDM54844.2022.00042.
M. Cui et al., “Multi-class intrusion detection in SDN,” Cluster Comput., vol. 27, no. 7, pp. 9937–9956, 2024, doi: 10.1007/s10586-024-04477-5.
S.-M. Tseng, Y.-Q. Wang, and Y.-C. Wang, “Multi-class intrusion detection based on transformer,” Future Internet, vol. 16, no. 8, Art. no. 284, 2024, doi: 10.3390/fi16080284.
D. Stiawan et al., “CICIDS-2017 dataset feature analysis,” IEEE Access, vol. 8, pp. 132911–132921, 2020, doi: 10.1109/ACCESS.2020.3009843.
N. A. S. Abdullah et al., “Machine learning algorithm for fake news detection,” Indones. J. Electr. Eng. Comput. Sci., vol. 35, no. 3, 2024, doi: 10.11591/ijeecs.v35.i3.pp1732-1743.
L. Melgar-García et al., “Identifying novelties and anomalies,” Eng. Appl. Artif. Intell., vol. 123, 2023, Art. no. 106326.
J. A. Ilemobayo et al., “Hyperparameter tuning in machine learning: A comprehensive review,” J. Eng. Res. Rep., vol. 26, no. 6, 2024.
M. A. K. Raiaan et al., “A systematic review of hyperparameter optimization techniques,” Decis. Anal. J., vol. 11, 2024, Art. no. 100470.
T. Eimer, M. Lindauer, and R. Raileanu, “Hyperparameters in reinforcement learning,” in Proc. ICML, 2023.
G. Naidu, T. Zuva, and E. M. Sibanda, “A review of evaluation metrics,” in Comput. Sci. Online Conf., 2023, doi: 10.1007/978-3-031-35314-7_2.
O. Rainio, J. Teuho, and R. Klén, “Evaluation metrics and statistical tests,” Sci. Rep., vol. 14, 2024, Art. no. 6086.
P. Fergus and C. Chalmers, “Performance evaluation metrics,” in Applied Deep Learning, Springer, 2022, pp. 115–138.
A. Bandi et al., “The power of generative AI,” Future Internet, vol. 15, no. 8, Art. no. 260, 2023.
S. Ackerman et al., “Automatically detecting data drift,” arXiv, 2021, doi: 10.48550/arXiv.2111.05672.
K. R. R. Manukonda, “Performance evaluation and optimization of switched Ethernet services,” J. Technol. Innov., vol. 4, no. 2, 2023.
M. A. O. Ahmed et al., “Enhancing IoT security using gradient boosting,” Alex. Eng. J., vol. 116, pp. 472–482, 2025, doi: 10.1016/j.aej.2024.12.106.
S. H. Haji and A. B. Sallow, “IoT for smart environment monitoring,” Asian J. Res. Comput. Sci., vol. 9, no. 1, pp. 57–70, 2021.
J. Françoise, B. Caramiaux, and T. Sanchez, “Marcelle: composing interactive machine learning workflows,” in Proc. UIST, 2021.
Z. Mohseni, R. M. Martins, and I. Masiello, “SAVis: A learning analytics dashboard,” NLAI, vol. 2985, 2021.
P. Choobdar et al., “Multi-class intrusion detection using stacked autoencoders,” Wireless Pers. Commun., vol. 123, no. 1, pp. 437–471, 2022.
M. Bacevicius and A. P. Taraseviciene, “Machine learning for unbalanced intrusion detection,” Appl. Sci., vol. 13, no. 12, Art. no. 7328, 2023.
C. Hardegen et al., “Predicting network flow characteristics,” IEEE Trans. Netw. Serv. Manag., vol. 17, no. 4, pp. 2662–2676, 2020.
A. Ghavasieh and M. De Domenico, “Diversity of information pathways,” Nat. Phys., vol. 20, pp. 512–519, 2024.
Z. You et al., “A unified model for multi-class anomaly detection,” in Proc. NeurIPS, 2022.
C. Perera, “Optimizing performance in parallel computing,” J. Adv. Comput. Syst., vol. 4, no. 9, pp. 35–44, 2024.
B. Kimura et al., “Evaluating adaptive video streaming,” ACM Trans. Multimedia Comput. Commun. Appl., 2025.
A. Abuashour et al., “Comparative study of classification mechanisms,” Am. J. Biomed. Sci. Res., vol. 22, 2024.
E. B. Wegayehu and F. B. Muluneh, “Comparing ensemble deep learning models,” J. Hydrol. Reg. Stud., vol. 52, 2024.
L. Duan and W. Wang, “Early detection of struggling learners,” Enterprise Inf. Syst., vol. 18, no. 11, 2024.
E.-L. Kafita and T. Yamazaki, “Stacking ensemble models,” in WECE 2024, vol. 13553, SPIE, 2025.
Abstract views: 23 times
Download PDF: 12 times
Copyright (c) 2025 Journal of Information Systems and Informatics
This work is licensed under a Creative Commons Attribution 4.0 International License.
- I certify that I have read, understand and agreed to the Journal of Information Systems and Informatics (Journal-ISI) submission guidelines, policies and submission declaration. Submission already using the provided template.
- I certify that all authors have approved the publication of this and there is no conflict of interest.
- I confirm that the manuscript is the authors' original work and the manuscript has not received prior publication and is not under consideration for publication elsewhere and has not been previously published.
- I confirm that all authors listed on the title page have contributed significantly to the work, have read the manuscript, attest to the validity and legitimacy of the data and its interpretation, and agree to its submission.
- I confirm that the paper now submitted is not copied or plagiarized version of some other published work.
- I declare that I shall not submit the paper for publication in any other Journal or Magazine till the decision is made by journal editors.
- If the paper is finally accepted by the journal for publication, I confirm that I will either publish the paper immediately or withdraw it according to withdrawal policies
- I Agree that the paper published by this journal, I transfer copyright or assign exclusive rights to the publisher (including commercial rights)
