{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T18:49:56Z","timestamp":1775069396210,"version":"3.50.1"},"reference-count":32,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T00:00:00Z","timestamp":1756771200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T00:00:00Z","timestamp":1756771200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/100009473","name":"Universidad de M\u00e1laga","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100009473","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1007\/s10207-025-01118-9","type":"journal-article","created":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T06:12:54Z","timestamp":1756793574000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["A Framework for Drift Detection and Adaptation in AI-driven Anomaly and Threat Detection Systems"],"prefix":"10.1007","volume":"24","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-0796-4631","authenticated-orcid":false,"given":"Antonio","family":"Lara-Gutierrez","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4564-6636","authenticated-orcid":false,"given":"Carmen","family":"Fernandez-Gago","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7280-090X","authenticated-orcid":false,"given":"Jose A.","family":"Onieva","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,9,2]]},"reference":[{"key":"1118_CR1","unstructured":"M.\u00a0Abdelaty, S.\u00a0Scott-Hayward, R.\u00a0Doriguzzi-Corin, and D.\u00a0Siracusa. Gadot: Gan-based adversarial training for robust ddos attack detection. 2022"},{"issue":"4","key":"1118_CR2","first-page":"433","volume":"2","author":"H Abdi","year":"2010","unstructured":"Abdi, H., Williams, L.J.: Principal component analysis. WIREs Comput. Stat. 2(4), 433\u2013459 (2010)","journal-title":"WIREs Comput. Stat."},{"key":"1118_CR3","unstructured":"Aguiar, G.J., Cano, A.: Enhancing concept drift detection in drifting and imbalanced data streams through meta-learning. In 2023 IEEE International Conference on Big Data (BigData). IEEE, Dec. (2023)"},{"key":"1118_CR4","unstructured":"Anderson, J.P.: Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., Fort Washington, Pennsylvania, 1980. Technical report prepared for the U.S. Air Force Electronic Systems Division"},{"key":"1118_CR5","first-page":"278","volume":"127","author":"JP Barddal","year":"2017","unstructured":"Barddal, J.P., Gomes, H.M., Enembreck, F., Pfahringer, B.: A survey on feature drift adaptation: Definition, benchmark, challenges and future directions. J. Syst. Softw. 127, 278\u2013294 (2017)","journal-title":"J. Syst. Softw."},{"key":"1118_CR6","first-page":"249","volume":"106","author":"M Buda","year":"2018","unstructured":"Buda, M., Maki, A., Mazurowski, M.A.: A systematic study of the class imbalance problem in convolutional neural networks. Neural Netw. 106, 249\u2013259 (2018)","journal-title":"Neural Netw."},{"issue":"6","key":"1118_CR7","first-page":"1","volume":"54","author":"Z Cai","year":"2021","unstructured":"Cai, Z., Xiong, Z., Xu, H., Wang, P., Li, W., Pan, Y.: Generative adversarial networks: A survey toward private and secure applications. ACM Comput. Surv. 54(6), 1\u201338 (2021)","journal-title":"ACM Comput. Surv."},{"key":"1118_CR8","first-page":"321","volume":"16","author":"NV Chawla","year":"2002","unstructured":"Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: Synthetic minority over-sampling technique. J Artif. Intell. Res. 16, 321\u2013357 (2002)","journal-title":"J Artif. Intell. Res."},{"key":"1118_CR9","unstructured":"Denning, D.E.: An intrusion-detection model. IEEE Trans. Softw. Eng., SE-13(2):222\u2013232, (1987)"},{"issue":"12","key":"1118_CR10","first-page":"170","volume":"11","author":"KA ElDahshan","year":"2022","unstructured":"ElDahshan, K.A., AlHabshy, A.A., Hameed, B.I.: Meta-heuristic optimization algorithm-based hierarchical intrusion detection system. Computers 11(12), 170 (2022)","journal-title":"Computers"},{"issue":"7","key":"1118_CR11","first-page":"706","volume":"35","author":"R Fan","year":"2011","unstructured":"Fan, R., Zhong, M., Wang, S., Zhang, Y., Andrew, A., Karagas, M., Chen, H., Amos, C., Xiong, M., Moore, J.: Entropy-based information gain approaches to detect and to characterize gene-gene and gene-environment interactions\/correlations of complex diseases. Genet. Epidemiol. 35(7), 706\u2013721 (2011)","journal-title":"Genet. Epidemiol."},{"key":"1118_CR12","first-page":"99837","volume":"10","author":"A Halbouni","year":"2022","unstructured":"Halbouni, A., Gunawan, T.S., Habaebi, M.H., Halbouni, M., Kartiwi, M., Ahmad, R.: Cnn-lstm: Hybrid deep neural network for network intrusion detection system. IEEE Access 10, 99837\u201399849 (2022)","journal-title":"IEEE Access"},{"issue":"2","key":"1118_CR13","first-page":"1691","volume":"14","author":"R Harwahyu","year":"2024","unstructured":"Harwahyu, R., Ndolu, F.H.E., Overbeek, M.V.: Three layer hybrid learning to improve intrusion detection system performance. Int. J Electr. Computer Eng. (IJECE) 14(2), 1691 (2024)","journal-title":"Int. J Electr. Computer Eng. (IJECE)"},{"issue":"9","key":"1118_CR14","first-page":"1263","volume":"21","author":"H He","year":"2009","unstructured":"He, H., Garcia, E.A.: Learning from imbalanced data. IEEE Trans. Knowl. Data Eng. 21(9), 1263\u20131284 (2009)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"1118_CR15","unstructured":"Lanvin, M., Gimenez, P.-F., Han, Y., Majorczyk, F., M\u00e9, L., Totel, \u00c9.: Errors in the cicids2017 dataset and the significant differences in detection performances it makes. In International Conference on Risks and Security of Internet and Systems (CRiSIS), Lecture Notes in Computer Science, Cham, (2022). Springer Nature Switzerland. Partially supported by the Cyber Excellence Pole (PEC: DGA, Brittany Region)"},{"key":"1118_CR16","unstructured":"Liu, L., Engelen, G., Lynar, T., Essam, D., Joosen, W.: Error prevalence in nids datasets: A case study on cic-ids-2017 and cse-cic-ids-2018. In Proceedings of the 2022 IEEE Conference on Communications and Network Security (CNS), pages 254\u2013262, Austin, TX, USA, (2022). IEEE"},{"key":"1118_CR17","first-page":"1","volume":"1","author":"J Lu","year":"2018","unstructured":"Lu, J., Liu, A., Dong, F., Gu, F., Gama, J., Zhang, G.: Learning under Concept Drift: A Review. IEEE Trans. Knowl. Data Eng. 1, 1 (2018)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"1","key":"1118_CR18","first-page":"521","volume":"45","author":"JG Moreno-Torres","year":"2012","unstructured":"Moreno-Torres, J.G., Raeder, T., Alaiz-Rodr\u00edguez, R., Chawla, N.V., Herrera, F.: A unifying view on dataset shift in classification. Pattern Recogn. 45(1), 521\u2013530 (2012)","journal-title":"Pattern Recogn."},{"key":"1118_CR19","first-page":"2803","volume":"235","author":"D Mulimani","year":"2024","unstructured":"Mulimani, D., Patil, P., Totad, S., Benni, R.: Online detection and adaptation of concept drift in streaming data classification. Procedia Computer Sci. 235, 2803\u20132811 (2024)","journal-title":"Procedia Computer Sci."},{"key":"1118_CR20","unstructured":"Nelson, B., Barreno, M., Chi, F.J., Joseph, A.D., Rubinstein, B.I.P., Saini, U., Sutton, C., Tygar, J.D., Xia, K.: Exploiting machine learning to subvert your spam filter. In Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, LEET\u201908, USA, (2008). USENIX Association"},{"key":"1118_CR21","first-page":"128596","volume":"11","author":"MS Noori","year":"2023","unstructured":"Noori, M.S., Sahbudin, R.K.Z., Sali, A., Hashim, F.: Feature drift aware for intrusion detection system using developed variable length particle swarm optimization in data stream. IEEE Access 11, 128596\u2013128617 (2023)","journal-title":"IEEE Access"},{"key":"1118_CR22","unstructured":"Pesaranghader, A., Viktor, H.L.: Fast Hoeffding Drift Detection Method for Evolving Data Streams, page 96\u2013111. Springer International Publishing, (2016)"},{"key":"1118_CR23","first-page":"156","volume":"82","author":"M Ring","year":"2019","unstructured":"Ring, M., Schl\u00f6r, D., Landes, D., Hotho, A.: Flow-based network traffic generation using generative adversarial networks. Comput. Secur. 82, 156\u2013172 (2019)","journal-title":"Comput. Secur."},{"key":"1118_CR24","unstructured":"Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), pages 108\u2013116, (2018)"},{"key":"1118_CR25","unstructured":"Sheikhi, S., Kostakos, P.: A novel anomaly-based intrusion detection model using psogwo-optimized bp neural network and ga-based feature selection. Sens. 22(23), 9318 (2022)"},{"key":"1118_CR26","unstructured":"Turukmane, A.V., Devendiran, R.: M-multisvm: An efficient feature selection assisted network intrusion detection system using machine learning. Comput. Secur. 137, 103587 (2024)"},{"key":"1118_CR27","first-page":"138432","volume":"9","author":"T Wisanwanichthan","year":"2021","unstructured":"Wisanwanichthan, T., Thammawichai, M.: A double-layered hybrid approach for network intrusion detection system using combined naive bayes and svm. IEEE Access 9, 138432\u2013138450 (2021)","journal-title":"IEEE Access"},{"key":"1118_CR28","volume-title":"k-Means Clustering with Outlier Detection, Mixed Variables and Missing Values, page 216\u2013226","author":"D Wishart","year":"2003","unstructured":"Wishart, D.: k-Means Clustering with Outlier Detection, Mixed Variables and Missing Values, page 216\u2013226. Springer, Berlin Heidelberg (2003)"},{"issue":"11","key":"1118_CR29","first-page":"6515","volume":"13","author":"Q Xiang","year":"2023","unstructured":"Xiang, Q., Zi, L., Cong, X., Wang, Y.: Concept Drift Adaptation Methods under the Deep Learning Framework: A Literature Review. Appl. Sci. 13(11), 6515 (2023)","journal-title":"Appl. Sci."},{"key":"1118_CR30","first-page":"103644","volume":"137","author":"X Yuan","year":"2024","unstructured":"Yuan, X., Han, S., Huang, W., Ye, H., Kong, X., Zhang, F.: A simple framework to enhance the adversarial robustness of deep learning-based intrusion detection system. Computers & Security 137, 103644 (2024)","journal-title":"Computers & Security"},{"key":"1118_CR31","unstructured":"Zhang, H.,, Chen, X., Hu, M., Sugumaran, V.: Multilayer concept drift detection method based on model explainability. IEEE Access, page 1\u20131, (2024)"},{"key":"1118_CR32","unstructured":"Zhao, X., Fok, K.W., Thing, V.L.: Enhancing network intrusion detection performance using generative adversarial networks. Computers & Security 145, 104005 (2024)"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-01118-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-025-01118-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-01118-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T11:39:13Z","timestamp":1760614753000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-025-01118-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,2]]},"references-count":32,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2025,10]]}},"alternative-id":["1118"],"URL":"https:\/\/doi.org\/10.1007\/s10207-025-01118-9","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,2]]},"assertion":[{"value":"1 April 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"24 August 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 September 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"199"}}