TRUST-IDS: Shift-Aware, Adversarially Robust and Explainable Network Intrusion Detection via Multi-Objective Evolutionary Configuration

Machine-learning intrusion detectors that score highly on benchmarks often degrade in deployment, where they meet unseen attack families, evasive adversaries and analysts who need stable explanations. We present TRUST-IDS, which fuses a LightGBM branch hardened by constraint-aware adversarial augmentation with a quantile-calibrated k-nearest-neighbour novelty branch. NSGA-II configures its hyper-parameters, augmentation strength, fusion weight and threshold to maximise macro-F1 and robust detection and to minimise complexity, using a validation split that withholds entire attack families; a knee-point rule selects the deployed configuration. On NSL-KDD (five seeds), TRUST-IDS reached 91.90% accuracy on KDDTest+ and 86.11% on KDDTest-21, versus 79.64% and 61.30% for the best baseline. It detected 88.19% of unseen attack types (baseline 45.65%) and retained 89.0% detection under a black-box evasion attack at ε = 0.05 (baseline 60.7%), at the cost of a 12.59% false-positive rate. On UNSW-NB15, shift-aware selection over-fired because benign test traffic had drifted; with conventional selection, the architecture matched the best baseline accuracy (87.45%) with a six-fold smaller booster and improved robustness over LightGBM at every budget. A label-free novelty-quantile diagnostic distinguishes these two regimes.