TY - GEN
T1 - Continual Drift Detection and Adaptation for Cybersecurity Applications
AU - Zhang, Mingrui
AU - Du, Lei
AU - Wang, Mengjiao
AU - Gu, Zhaoquan
N1 - Publisher Copyright:
© The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd. 2026.
PY - 2026
Y1 - 2026
N2 - In the field of cybersecurity, the continuous evolution of user behavior and attackers’ tactics leads to dynamic changes in data distribution over time, resulting in a decline in the performance of security detection models. This paper introduces an innovative continual drift detection and adaption cybersecurity framework called CDDA. CDDA combines contrastive learning, unsupervised clustering, and uncertainty sampling to effectively optimize the embedding space, accurately detect malicious samples, and efficiently sample while reducing the labeling burden on security analysts. The experiments are conducted on two publicly available multi-temporal datasets - APIGraph and Kyoto. The experimental results show that CDDA significantly reduces the false negative rate from 26% to 11% and improves the F1 score from 80% to 90%.
AB - In the field of cybersecurity, the continuous evolution of user behavior and attackers’ tactics leads to dynamic changes in data distribution over time, resulting in a decline in the performance of security detection models. This paper introduces an innovative continual drift detection and adaption cybersecurity framework called CDDA. CDDA combines contrastive learning, unsupervised clustering, and uncertainty sampling to effectively optimize the embedding space, accurately detect malicious samples, and efficiently sample while reducing the labeling burden on security analysts. The experiments are conducted on two publicly available multi-temporal datasets - APIGraph and Kyoto. The experimental results show that CDDA significantly reduces the false negative rate from 26% to 11% and improves the F1 score from 80% to 90%.
KW - Concept drift
KW - Continuous learning
KW - Contrastive learning
UR - https://www.scopus.com/pages/publications/105020720486
U2 - 10.1007/978-981-95-3456-2_21
DO - 10.1007/978-981-95-3456-2_21
M3 - 会议稿件
AN - SCOPUS:105020720486
SN - 9789819534555
T3 - Lecture Notes in Computer Science
SP - 303
EP - 317
BT - Advanced Data Mining and Applications - 21st International Conference, ADMA 2025, Proceedings
A2 - Yoshikawa, Masatoshi
A2 - Meng, Xiaofeng
A2 - Cao, Yang
A2 - Xiao, Chuan
A2 - Chen, Weitong
A2 - Wang, Yanda
PB - Springer Science and Business Media Deutschland GmbH
T2 - 21st International Conference on Advanced Data Mining and Applications, ADMA 2025
Y2 - 22 October 2025 through 24 October 2025
ER -