Year: 2025
Type: article
Abstract: As cyber threats grow increasingly sophisticated, traditional Intrusion Detection System (IDS) struggle to maintain robustness when facing unknown zero-day attacks. This paper proposes an adaptive IDS framework based on lightweight model repair, which rapidly restores detection performance using a small set of synthetically generated zero-day samples. The architecture combines an autoencoder with a classifier head, jointly trained on the NSL-KDD dataset. This framework was evaluated against four canonical zero-day attack variants via controlled feature manipulation. To address the performance degradation, multiple minimal-scope repair strategies are tested. Repair strategies target three scopes: the decoder's final layer, the classifier head, or both components. The choice of repair scope is informed by empirical performance under different adaptation scenarios. According to the experiment results, fine-tuning only the classifier head can restore the recall to over 98% with strong generalization ability. Unified pooled repair and leave-one-out evaluations further verify the robustness and adaptability of the method across diverse attack scenarios.
Author: Zijie Liu
Institution: University of California, Davis
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W4413183436