CD-AHAL: A Concept Drift-Aware Hybrid Active Learning Framework for Network Intrusion Detection

Abstract

This paper proposes a solution to the challenges posed by the proliferation of IoT devices, which has expanded cyber attack surfaces characterized by continuous changes over time (Concept Drift). Traditional Network Intrusion Detection Systems (NIDS) often suffer from severe performance degradation when facing novel attacks due to a lack of adaptability. This paper introduces CD-AHAL, a hybrid security framework that integrates a CNN–BiGRU–Attention deep learning architecture with an Uncertainty-aware Active Learning strategy, employing an automatic labeling mechanism via a simulated Oracle. The system is evaluated through a two-stage process: (1) Offline training to establish a foundational knowledge base; and (2) Online evaluation on a synthetic data stream exhibiting concept drift. To demonstrate comprehensive effectiveness, we compare CD-AHAL against three baseline architectural variants—CNN-GRU, CNN-Attention, and GRU-Attention—operating in a static (non-updating) mode. Experimental results demonstrate that while static models suffer from accuracy degradation in changing environments, CD-AHAL is capable of autonomously detecting drift and rapidly recovering performance, thereby maintaining superior average Accuracy and F1-Score.