Deep Learning-Based Adaptive Intrusion Detection for Next-Generation Network Security

Abstract

Next-generation network environments, including 5G/6G radio access networks, dense Internet-of-Things (IoT) deployments, and software-defined infrastructures, dramatically expand the attack surface and generate highly dynamic, non-stationary traffic patterns that render static, signature-based intrusion detection systems (IDS) increasingly ineffective. This paper proposes an adaptive deep learning-based intrusion detection framework that combines a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN-BiLSTM) architecture with an attention mechanism for joint spatial-temporal feature learning, coupled with an online concept-drift detection module that triggers incremental model retraining whenever the statistical distribution of network traffic deviates from the learned baseline. The framework was evaluated on a combined corpus exceeding 3.2 million labeled flow records drawn from three benchmark intrusion datasets, replayed through a simulated software-defined networking (SDN) testbed under controlled concept-drift conditions. The proposed model achieved a detection accuracy of 99.1% and an F1-score of 98.8%, sustaining an average per-flow inference latency of 4.2 ms under moderate load, and outperformed CNN-only, LSTM-only, Random Forest, and Support Vector Machine baselines by 1.2 to 7.7 percentage points in accuracy. The adaptive retraining mechanism was able to recover detection accuracy from a 6.3-point degradation to within 0.4 points of baseline, on average, after a simulated concept drift occurred, while a non-adaptive static model exhibited persistent degradation from 6.3 points below the baseline. Having been assessed by the CVSS, it also proves to be very robust against attacks such as evasion, adversarial perturbation, or traffic mimicry. The results show that deep spatio-temporal representation learning and lightweight online adaptation have the potential to be a practical and scalable strategy for self-adapting intrusion detection for next-generation network environments.