New DCAD Framework Enhances Network Anomaly Detection

• •DCAD framework addresses network anomaly detection challenges.
• •Integrates anomaly detection with real-time model updates.
• •Demonstrated improved performance over traditional static detectors.

The Dynamic Continual Anomaly Detection (DCAD) framework has been proposed to address the challenges of network traffic anomaly detection, particularly in the face of concept drift. Traditional methods struggle with evolving network conditions, leading to high false positive rates and missed novel attacks. The DCAD framework integrates anomaly detection, concept-drift detection, and incremental learning using an Autoencoder trained on normal traffic. It also utilizes an ADWIN drift monitor for real-time model updates and a replay buffer for knowledge retention. The framework was evaluated against static detectors like SVM, Random Forest, and Isolation Forest, demonstrating improved accuracy and stability. This research highlights the importance of adaptive solutions in cybersecurity to keep pace with rapidly changing network environments.