A temporal-evolving adaptive learning framework with integrated explainable AI dynamic behavioral pattern recognition
Concept drift, data distributions shifting over time, degrades static machine-learning classifiers built on the independent and identically distributed (i.i.d.) assumption, raising false-negative rates across network intrusion detection, financial fraud analytics, and health monitoring. Adaptive methods exist to counter drift, but nearly all sacrifice interpretability, ruling them out for regulated deployments. Temporal Evolving Adaptive Learning with Explainable Artificial Intelligence (TEAL-XAI), a Temporal Evolving Adaptive Learning framework introduced here, maintains drift robustness, interpretability, and computational efficiency simultaneously rather than trading one for the others. It rests on three components: exponential temporal decay weighting [ w t = exp(–λ ( T – t )), with an empirically validated optimal λ of 0.05]; adaptive sliding-window retraining that recalibrates its decision threshold at every window; and a closed-loop SHapley Additive exPlanations (SHAP) module whose feature attributions steer feature selection each retraining cycle, rather than only explaining results afterward. Tested against four baselines, including a four-layer Deep Neural Network (DNN), on Knowledge Discovery and Data Mining Cup 1999 (KDD Cup 1999), the Network Security Laboratory Knowledge Discovery in Databases (NSL-KDD), and the newer University of New South Wales—Network Benchmark 15 (UNSW-NB15) benchmark, TEAL-XAI reaches 99.73% accuracy, 99.71% F1-score, and 0.9998 area under the curve–receiver operating characteristic curve (AUC-ROC) on the first benchmark, with paired t -tests, Wilcoxon signed-rank tests, and McNemar's tests confirming significance ( p < 0 0.05 for all three tests; p < 0.005 for the t -test and McNemar's test). Under sudden concept drift, it is it is 9.9 and 10.5 times more resilient than Random Forest and the DNN baseline, respectively, losing 0.61 percentage points against their 6.04 and 6.41. On UNSW-NB15, it ties for the best F1-score (94.27%) among the five models. Still, it does not carry over the cross-validation and drift-resilience edge seen on the older benchmarks, a mixed result reported honestly rather than smoothed over. A six-configuration ablation study attributes gains to each component, temporal SHAP tracking shows that the explanations adapt rather than remain static, and cross-dataset transfer confirms that the framework generalizes beyond memorizing a single benchmark.
Authors
- R. Vijay Anand (ORCID: https://orcid.org/0000-0002-9615-8982)
- K. Hemachandran
Institutions
- Vellore Institute of Technology University (IN)
Publication Details
- Journal
- Frontiers in Artificial Intelligence
- Published
- 2026-10-27
- DOI
- https://doi.org/10.3389/frai.2026.1929687
- Primary Topic
- Network Security and Intrusion Detection
- Type
- article
- Field-Weighted Citation Impact
- 0.00