A DRIFT-AWARE CYBERATTACK DETECTION FRAMEWORK FOR RESOURCE-CONSTRAINED NETWORKS USING ADAPTIVE LEARNING AND UNCERTAINTY-BASED ALERTS

Intrusion detection models deployed on resource-constrained networks face two practical difficulties that are oftenstudied in isolation. Attack behaviour changes over time, so a model trained once tends to lose accuracy as thetraffic distribution shifts, and the volume of generated alerts can exceed the capacity of the analysts who must acton them. This study presents a detection framework that addresses both concerns within a single streamingpipeline. An incremental ensemble classifier is paired with an adaptive windowing drift monitor that governswhen the model updates, and a predictive-uncertainty gate decides whether each flagged flow is raised as anautomated alert or routed to analyst review. The framework was evaluated on the CICIDS2017 flow dataset usinga chronological prequential protocol that preserves the order of traffic and exposes the model to shifting attackmixes. Under this protocol the proposed framework reached a prequential F1-score of 0.951 for the attack class,compared with 0.936 for an adaptive random forest and 0.862 for a static offline model. After each induceddistribution change the static model settled at a lower accuracy, whereas the proposed framework returned to itsprior range within a few evaluation windows. At a gating threshold of 0.40 the precision of automated alerts roseto 0.976 while 15 percent of flows were referred for review. The detector operated within a 256 MB memoryprofile and sustained roughly 1,390 flows per second. These results describe behaviour for the evaluated datasetand configuration and are not presented as evidence of universal improvement.