Drift-Aware Continual Generative Behavioral Detection for Zero-Day Cyberattacks: Reproducible Temporal Evaluation and SIEM-Ready Alerting

This paper discusses the world of zero-day cyberattacks, which exploit unknown vulnerabilities that often slip past traditional defenses that rely on signatures. This situation has led to a push for behavioral detection methods that can adapt to new attack patterns. However, many intrusion detection systems that use machine learning are still tested on data that's been shuffled over time, which can lead to misleading results and a failure to account for changes in real-world traffic. To address these issues, we introduce a drift-aware continual generative behavioral-detection framework. This framework does three key things: it maintains an up-to-date baseline of normal behavior, uses generative techniques to maintain visibility into rare but significant patterns even when conditions change, and provides risk scores that are ready for Security Information and Event Management (SIEM) systems to support triage and correlation in security operations. To ensure our methods are robust, we have developed a reproducible evaluation protocol that relies on strict time-ordered data splits, stress tests focused on drift, and reporting that emphasizes practical aspects like latency, update frequency, and auditability. Our framework is designed to work with publicly available network traffic data and encourages transparent studies and sharing of findings for independent verification. By merging ongoing adaptation with careful evaluation and practical alerting, our approach aims to fill critical gaps that often hinder the reliability and readiness of cybersecurity research in high-stakes environments.