A Label-Efficient Adaptive Retraining Framework for Network Intrusion Detection Under Streaming Arrival Bias

Network intrusion detectors degrade when operational traffic diverges from their training domain, yet unconditional retraining wastes scarce labeling effort. Using CIC-IDS2017 and CSE-CIC-IDS2018 as source and target domains, with the target replayed chronologically, we report two findings. First, degradation is heterogeneous: some classifier–shift pairs recover through threshold recalibration alone, so severity cannot be inferred from distributional change. Second, where behavioral diversity accumulates gradually, a fixed budget of exact-duplicate groups (EDGs) recovers the detector when drawn from the whole target period, and it fails when drawn from the first hours whether in arrival order or at random. We call this effect arrival bias. We propose a label-efficient framework that escalates through threshold recalibration, buffered few-shot source–target retraining, and full target-domain retraining. Time-ordered cross-validation sets the label budget and collection horizon, and a diversity precondition withholds deployment when validation cannot certify a candidate. Across 7 attack classes, 4 classifiers, and 10 group-aware partitions, the policy meets the operational recall target in 24 of 28 attack–classifier combinations, against 9 for recalibration alone, 8 for online active learning even with unrestricted pool access, and 0 for CORAL. Nineteen combinations select an identical level in all ten partitions. The required level is strongly classifier-dependent, not a property of the shift alone.