Adaptive IDS via Lightweight Model Repair for Synthetic Zero-Day Attacks

As cyber threats grow increasingly sophisticated, traditional Intrusion Detection System (IDS) struggle to maintain robustness when facing unknown zero-day attacks. This paper proposes an adaptive IDS framework based on lightweight model repair, which rapidly restores detection performance using a small set of synthetically generated zero-day samples. The architecture combines an autoencoder with a classifier head, jointly trained on the NSL-KDD dataset. This framework was evaluated against four canonical zero-day attack variants via controlled feature manipulation. To address the performance degradation, multiple minimal-scope repair strategies are tested. Repair strategies target three scopes: the decoder's final layer, the classifier head, or both components. The choice of repair scope is informed by empirical performance under different adaptation scenarios. According to the experiment results, fine-tuning only the classifier head can restore the recall to over 98% with strong generalization ability. Unified pooled repair and leave-one-out evaluations further verify the robustness and adaptability of the method across diverse attack scenarios.