让入侵检测系统自动识别错误并自我修复,避免误判导致安全漏洞。
RES-DARE: Failure-Aware Expert Adaptation and Rollback-Safe Self-Repair for Intrusion Detection
- 用失败信号驱动专家模型动态进化,不丢弃难分类样本。
- 在多个数据集上实现超96%的宏平均F1,抗干扰能力显著提升。
- 支持回滚修复,防止错误更新破坏系统稳定性,适合实际部署。
入侵检测系统常在静态环境下训练,但实际网络环境存在流量漂移、传感器噪声、负载变化和攻击行为演进等分布偏移问题。静态检测器可能对错误预测表现过度自信,引发无声且危险的失效模式。本文提出RES-DARE(递归演化专家-数字自适应推理引擎),一种具备故障感知能力的持续入侵检测框架,支持安全回滚的自修复机制。将困难、不确定及误分类样本视为故障信号,用于专家专业化,而非当作噪声丢弃。通过监督对比编码器、双通道专家路由器、故障缓冲机制、基于HDBSCAN的故障区域发现以及信任风险监控器,实现自适应检测行为。引入AEHM-v2作为安全修复机制:候选更新先临时激活,仅当宏观F1保持或提升且信任风险稳定时才提交;否则回滚至上次验证状态。在CICIDS2017、UNSW-NB15和TON_IoT数据集上,分别获得0.9850、0.9736和0.9691的宏平均F1。在特征高斯扰动强度为0.10时,仍保持CICIDS2017上0.7920的攻击类F1, catastrophic forgetting指标低至F=0.0015。结果表明,RES-DARE在退化条件下显著提升鲁棒性、预警能力和部署安全性。
原文摘要 · Abstract (English)
Intrusion detection systems are often trained under static benchmark conditions, although deployed network environments are affected by traffic drift, sensor noise, changing workloads, and evolving attack behaviour. Under such distribution shifts, static detectors may produce confident but incorrect predictions, leading to silent and unsafe failure modes. In this paper, RES-DARE (Recursive Evolving Specialists-Digital Adaptive Reasoning Engine) is proposed as a failure-aware continual intrusion detection framework with rollback-safe self-repair. Difficult, uncertain, and misclassified samples are treated as failure signals for expert specialisation rather than being discarded as noise. A supervised contrastive encoder, two-pass expert router, failure-buffer mechanism, HDBSCAN-based failure-region discovery, and trust-risk monitor are integrated to support adaptive IDS behaviour. AEHM-v2 is introduced as a rollback-safe repair mechanism, where candidate adaptations are provisionally activated and committed only when macro-F1 is preserved or improved while trust risk remains stable. Otherwise, the system is rolled back to its last validated state. RES-DARE is evaluated on CICIDS2017, UNSW-NB15, and TON\_IoT, achieving macro-F1 scores of 0.9850, 0.9736, and 0.9691, respectively. Under Gaussian feature corruption at strength 0.10, RES-DARE retains an Attack-F1 of 0.7920 on CICIDS2017 and achieves near-zero catastrophic forgetting with F = 0.0015. The results show that RES-DARE improves robustness, warning capability, and deployment safety under degraded conditions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。