HOIDS: Concept drift aware hybrid online intrusion detection system

Most Intrusion Detection Systems (IDS) based on machine learning operate under the assumption of a closed environment, where the statistical properties of the data remain constant over time. However, in real-world scenarios, this assumption is rarely valid. The data generation process is often non-stationary, leading to shifts in the statistical distribution of the data over time. This phenomenon, known as concept drift, causes significant performance degradation in static systems, which often require manual retraining by human operators, leaving networks resources vulnerable in the meantime. To address these challenges, we propose an Intrusion Detection System that adopts an online learning and drift-aware approach, incorporating concept drift detection and adaptation algorithms to handle evolving environments. One of the main challenges posed by concept drift is the need for frequent retraining, which increases the cost of real-time data labeling. As a solution to this problem, the system we designed employs a hybrid approach, combining supervised and unsupervised algorithms. The higher performance of supervised models is leveraged for detection, while unsupervised techniques are used to filter and minimize the amount of data requiring human review, thus reducing labeling costs. The system has been extensively evaluated on real-world datasets, demonstrating its capability of outperforming other state-of-the-art methods, achieving an F1-score of 0.961 while reducing the labeling cost to 0.92% of the dataset, compared to 100% required by systems with comparable detection performance. Thanks to its adaptive handling of concept drift and efficient filtering mechanisms, the system proved to be an effective and practical solution for real-world intrusion detection scenarios.