Aleksandra Knapińska

Aleksandra Knapińska, Marija Furdek

Optical networks are critical infrastructure that underpins global communications, and detecting security breaches that jeopardize them is essential to maintaining worldwide connectivity. As malicious actors continuously evolve their attack techniques, dynamically updated intrusion detection models have become a key component of modern defense mechanisms. By incorporating newly acquired telemetry data, these models can adapt to emerging threats while maintaining high detection performance. However, when previously encountered attacks reappear after a prolonged period of absence, adaptive models may fail to recognize them due to the phenomenon of catastrophic forgetting. In contrast, statically trained models can reliably detect attacks represented in the original training data but lack the ability to adapt to previously unseen attack patterns. Consequently, intrusion detection systems face a fundamental tradeoff between adaptability to evolving threats and long-term retention of previously acquired knowledge. In this work, we propose a data-driven mechanism to cope with catastrophic forgetting in dynamic attack detection systems. Our approach balances the model update datasets by using parts of past attack data. We utilize a threshold-based mechanism to trigger data balancing after accuracy drops due to an active attack change. Applied to an experimental optical network security dataset, the proposed approach reduces the average model adaptation time by 37% compared to its dynamic counterpart that does not employ data balancing. Compared to a baseline from the literature that relies on neural network depth increasing, our approach requires 6% fewer data batches to adapt to changing conditions and regain performance.

Omran Ayoub, Davide Andreoletti, Aleksandra Knapińska et al.

Adapting to concept drift is a challenging task in machine learning, which is usually tackled using incremental learning techniques that periodically re-fit a learning model leveraging newly available data. A primary limitation of these techniques is their reliance on substantial amounts of data for retraining. The necessity of acquiring fresh data introduces temporal delays prior to retraining, potentially rendering the models inaccurate if a sudden concept drift occurs in-between two consecutive retrainings. In communication networks, such issue emerges when performing traffic forecasting following a~failure event: post-failure re-routing may induce a drastic shift in distribution and pattern of traffic data, thus requiring a timely model adaptation. In this work, we address this challenge for the problem of traffic forecasting and propose an approach that exploits adaptive learning algorithms, namely, liquid neural networks, which are capable of self-adaptation to abrupt changes in data patterns without requiring any retraining. Through extensive simulations of failure scenarios, we compare the predictive performance of our proposed approach to that of a reference method based on incremental learning. Experimental results show that our proposed approach outperforms incremental learning-based methods in situations where the shifts in traffic patterns are drastic.