A Comprehensive Survey on Concept-Drift-Resilient Network Intrusion Detection Systems

Abstract

The evolution of computer networks for service provision, through new devices and architectures, renders past traffic patterns obsolete. The shift in the statistical properties of data is known as concept drift (CD) and is bound to affect automated pattern recognition-based systems. Network intrusion detection systems (NIDS) are widely studied security solutions that model and monitor network traffic behavior, alerting when malicious activities are detected. The lack of adaptability to evolving networks renders NIDS ineffective over time, leading to operational instability and increased vulnerability. In this survey, we aim to present an empirical literature review on state-of-the-art CD-resilient NIDS. The essential steps involved in developing such systems are comprehensively examined: benchmark datasets, NIDS development, drift detection and adaptation, and dynamic performance evaluation. An increasing trend in academic output has underscored the critical importance of this evolving field since 2022. We support its research by identifying open issues and highlighting future investigation directions.