SOURCE-LINKED INTELLIGENCE

Candidate Comparability Before Promotion: Conditional Validation in Adaptive Network Intrusion Detection

arXiv · AI, language, vision and robotics · article · Sep 3, 2026 · UTC

Adaptive network intrusion detection systems retrain classifiers after drift alarms, but an alarm detects change; it does not establish that a challenger should replace the deployed incumbent. Promotion is security-relevant because it changes the model responsible for subsequent attack detection, and evaluating it has a methodological problem: promotion conclusions may depend on how the challenger was constructed and on how much evidence supports it. We test that dependence on CICIDS2017, UNSW-NB15 and ToN-IoT with self-contained challenger pipelines, nested candidate-size controls, a common-h

Read original source ↗ Open in workspace

recordType

paper

region

Global