A Four-Stage Bayesian Incremental Learning Framework for Intrusion Detection in Real-World IoT Environment

In real-world Internet of Things (IoT) environments, intrusion detection systems (IDSs) often struggle to recognize new operating conditions and emerging threats. Moreover, attackers typically conduct multistage infiltration campaigns over months or even years, employing diverse techniques at different stages. This prolonged attack process, combined with the lack of prior knowledge, requires IDS to process data streams overextended time periods, during which models must not only identify novel attack patterns but also retain memory of early intrusion characteristics. In this article, we propose a four-stage Bayesian incremental learning framework (FBIL) to address two core challenges in real-world IoT environments: knowledge retention and data distribution shift. The proposed framework preserves existing knowledge through gradient projection combined with nearest class mean (NCM)-based sample selection and adapts to new tasks via a subsequent post-training stage. Furthermore, a Pareto-optimal-based gradient-guided model merging mechanism is introduced to automatically balance old and new knowledge without manual hyperparameter tuning. Experimental results on the Kyoto-2006 (2006–2015) and CICIDS (2017–2019) datasets demonstrate that FBIL achieves strong performance across multiple tasks over long time horizons while significantly reducing catastrophic forgetting, thereby enabling the continuous evolution of intrusion detection capabilities in real-world IoT environments.