Atypical Cyberattack Flow Detection Using Machine Learning Driven Intrusion Detection Systems with Concept Drift Monitoring

Abstract

Modern cyberattacks increasingly manifest as atypical, low frequency, and adaptive traffic flows that evade traditional
signature based intrusion detection systems. Machine learning
driven intrusion detection systems have demonstrated strong detection capabilities under static assumptions, yet their performance
deteriorates as adversarial behavior, network workloads, and data
distributions evolve over time. This study investigates the detection
of atypical cyberattack flows through a multi stage intrusion
detection architecture that integrates representation learning,
ensemble classification, and explicit concept drift monitoring.
The proposed framework emphasizes resilience to behavioral
shifts while maintaining interpretability and operational stability.
Experimental evaluation across heterogeneous attack scenarios
demonstrates improved detection robustness, reduced false positives, and sustained performance under evolving traffic conditions