Drift-Aware Continual Generative Behavioral Detection for Zero-Day Cyberattacks: Reproducible Temporal Evaluation and SIEM-Ready Alerting

1. Introduction

Zero-day attacks remain among the most disruptive cybersecurity threats because defenders lack prior signatures, patches, or stable indicators of compromise at the time of exploitation. Contemporary detection, therefore, increasingly relies on behavior-driven models that learn standard Framework and network dynamics and flag deviations at multiple levels of granularity—from flows and sessions to graph-structured interactions. Recent work has demonstrated that modeling temporal dependencies can substantially improve practical detection in dynamic environments [1].

Despite these advances, two persistent methodological problems frequently undermine reported performance and hinder publication in top-tier venues. First, operational network traffic is non-stationary: user behavior, infrastructure, and attacker tactics evolve, causing concept drift and degrading static models over time. Empirical evidence on long-horizon traffic shows that models often require careful update strategies to remain reliable under drift [2]. Second, the evaluation framework can inadvertently introduce data and pattern leakage—particularly when preprocessing or feature engineering is applied before time-aware splitting—leading to inflated accuracy and poor external validity [3].

This extension addresses both issues by integrating drift detection and adaptation with generative modeling and a leakage-aware evaluation protocol. For adaptation, we build on recent drift-aware malicious traffic detection that explicitly couples drift detection with model adjustment in streaming settings [4]. For representation and augmentation, we leverage emerging generative formulations for intrusion detection—such as diffusion-based approaches—to enrich minority behaviors and stabilize continual training without relying on unrealistic resampling [5]. To strengthen trustworthiness, we also account for known security and privacy concerns that arise when deploying deep learning-based defenses in production [6].

Finally, high-impact deployments require that detection outputs be actionable: alerts must be prioritized, correlated, and auditable within SOC tooling. We, therefore, frame the proposed framework as SIEM-ready by design, producing calibrated risk scores and metadata suited to downstream correlation and response workflows, aligned with recent evidence on AI integration in SIEM for real-time cyber defense [7] and complementary cyber-risk optimization frameworks [8].

Existing drift-aware IDS approaches primarily focus on adaptation but often neglect long-term retention of rare attack patterns. Generative IDS approaches improve balance but generally lack continual adaptation mechanisms. SIEM-oriented systems emphasize operational deployment but rarely incorporate drift-aware learning and zero-day preservation in a unified framework.

1.1. Research Gap and Technical Challenges

Despite recent advances in behavioral IDS, three important limitations remain. First, many studies use a temporally shuffled evaluation workflow, resulting in data leakage and overly optimistic performance estimates. Second, drift-aware IDS methods adapt to traffic changes but often suffer from catastrophic forgetting of rare attack behaviors. Third, generative IDS approaches improve class balance but are rarely integrated with continual adaptation and SIEM-oriented risk calibration within a unified operational framework. These limitations motivate the development of DC-GenAIS.

Technical challenges include:

• Detecting concept drift without excessive retraining.
• Preserving zero-day attack knowledge during adaptation.
• Preventing temporal leakage during evaluation.
• Producing calibrated outputs suitable for SIEM deployment.

1.2. Contributions

This paper introduces DC-GenAIS, a drift-aware continual generative behavioral detection framework for zero-day cyberattacks.

The main contributions are:

• A unified drift-aware continual generative behavioral detection framework.
• A leakage-aware temporal evaluation protocol.
• A controlled generative replay mechanism for mitigating catastrophic forgetting.
• SIEM-ready risk calibration and alerting.
• Comprehensive evaluation under static, streaming, drift, and zero-day scenarios.

2. Background and Related Work

This paper presents the Generative AI–Driven Information Framework (GenAIS) within four closely related research threads:

• Generative modeling for cyber defense.
• Behavioral detection and multi-step reasoning for zero-day threats.
• Concept drift and continual learning for network intrusion detection.
• Operational security integration (e.g., SIEM/alert correlation and calibrated risk scoring).

The goal is not to re-survey the entire field, but to identify the specific gaps that prevent publication-quality claims and reproducible evaluation.

2.1. Generative Models as Instruments for Robustness

Recent cybersecurity literature increasingly uses generative models for two purposes: (a) producing rare or structurally diverse attack variants to mitigate class imbalance and improve generalization, and (b) learning rich latent representations that can detect distributional shifts. Diffusion-based and transformer-like generators have become especially attractive for modeling complex sequential data and high-dimensional feature spaces, including malicious traffic patterns. However, many generative approaches are evaluated under weak protocols that inadvertently leak test information into preprocessing steps, inflating measured performance and undermining credibility [3].

A key implication for an extension paper is that a generative component alone is not a sufficient novelty claim; this must be tied to a rigorous protocol (time-ordered splits, train-only preprocessing, and drift-aware model updates) and a framework-level integration narrative that connects generated artifacts to actionable security outputs (e.g., calibrated risk and alert correlation).

2.2. Behavioral Detection

In the context of behavioral detection for zero-day and multi-step attacks, Zero-day attacks often manifest as partial behavioral deviations rather than exact replays of seen signatures. Accordingly, our evaluation targets generalization under attack-family hold-out and emphasizes calibrated scores and drift-aware updates, complementing temporal modeling approaches for dynamic network systems [1].

2.3. Concept Drift, Catastrophic Forgetting, and Continual Evaluation

A significant barrier to acceptance in high-ranked venues is the mismatch between static offline training and the realities of evolving traffic. Concept drift surveys emphasize that feature dynamics and shifting normal baselines can cause rapid degradation in intrusion detection performance, even when the underlying model is strong [9]. Continual learning approaches—especially replay-based strategies—are increasingly used to tackle drift while controlling catastrophic forgetting [4]. For publishable evaluation, this requires explicit reporting of update cadence, drift triggers, and stability/variance across runs, not just a single aggregate score.

2.4. Transitioning from Detection to Operations

To shift from detection to operations for calibrated risk, SIEM integration, and auditability, operational settings require low false-alert volumes, meaningful prioritization, and clear audit trails. Work that bridges ML detection with SIEM processes demonstrates that alert correlation and risk calibration can reduce analyst burden and improve real-time usability [7]. For a journal-ready manuscript, the proposed GenAIS must therefore be described as an information framework with explicit interfaces (inputs, outputs, update logic, logging, and governance) rather than a standalone model.

3. Materials and Methods

3.1. Problem Definition and Assumptions

Let {x_t} denote a time-ordered stream of network observations (flows, sessions, or aggregated windows) with optional labels y_t∈ {0,1,…,K}, where 0 indicates benign traffic and 1…K indicate known attack categories. A zero-day event is modeled as traffic whose behavioral pattern is not represented in the labeled training distribution at time t=0, either because it belongs to an unseen class or because it is a novel variant that changes the conditional distribution P(x|y). The objective is to produce a decision function f_t(x) that (i) maintains high detection quality under evolving P_t(x) and P_t(y), (ii) controls operational false positives, and (iii) provides calibrated risk scores suitable for prioritization and correlation in a SIEM framework.

We assume that (a) traffic arrives in chronological order; (b) labels may be delayed (e.g., analyst-confirmed incidents) and sparsely available; and (c) a limited memory budget is available to store representative historical samples for replay or calibration. These assumptions align with long-running enterprise deployments and address the external-validity concerns raised when results rely only on static, fully labeled datasets [4,9].

3.2. Framework Overview

Figure 1 presents the proposed Drift-Aware Continual Generative Behavioral Detection (DC-GenAIS) framework. The framework Structure extends the base GenAIS by adding two acceptance-critical components: (i) explicit concept-drift monitoring with bounded updates, and (ii) leakage-aware evaluation and train-only preprocessing rules that prevent optimistic bias [3]. The figure shows an overview of the DC-GenAIS framework, where the framework uses network traffic flow data/logs to detect behaviors, and then concept drift is monitored using a PSI metric to trigger updates. Continuous updates involve the use of LoRA/switches and limited adaptation where a generative module is used to increase the p_synth ratio and a reboot buffer.

3.3. Data Preparation and Evaluation Protocol Framework

The evaluation methodology consists of two related protocols:

• Time-Ordered Protocol: used for static offline evaluation.
• Streaming Protocol: used for continual-learning and drift experiments.

Both protocols share the same leakage-aware preprocessing rules described in this section.

The framework supports both public benchmark datasets and, optionally, institution-specific traffic streams. We report all metrics per dataset and summarize across settings when appropriate to provide a consistent, reproducible evaluation.

Leakage-aware preprocessing rules are enforced as follows: (i) chronological splits are performed before any scaling, selection, resampling, or augmentation; (ii) all normalization and feature selection parameters are fitted on training data only and then applied to validation/test; (iii) class balancing (including generative augmentation) is performed only within the training split; and (iv) model selection uses a validation window that precedes the test window in time. This protocol directly addresses recent evidence that preprocessing leakage can substantially inflate intrusion detection metrics [3].

Table 1 summarizes the benchmark datasets and stream configuration used in the experiments. All reported statistics correspond to the fixed dataset snapshots used in the final runs, and all preprocessing is fitted on training data only to prevent leakage.

The protocol involves four entities: (i) training data partition, (ii) validation partition, (iii) test stream, and (iv) adaptation module. Data flow is unidirectional from training to validation and testing. During streaming evaluation, adaptation modules receive only historical observations and replay samples, ensuring no information from the future test stream is leaked backward.

3.4. Generative Behavioral Modeling Module

DC-GenAIS models attack behavior as conditional generation over a sequence or set representation of network events. Let z denote latent variables capturing attacker intent and stage, and let c denote context features (host role, protocol family, or service class). The generator Gθ produces synthetic trajectories x̃ = Gθ(z,c) that (a) approximate the training distribution of malicious behaviors, and (b) deliberately explores neighborhood perturbations to create plausible variants. This synthetic pool is used for controlled augmentation and for replay during continual updates.

To avoid overclaiming, we separate (i) detection accuracy on in-distribution traffic, (ii) robustness under attack-family hold-out (zero-day), and (iii) stability under concept drift. We also report computational latency and false-alarm rates to ensure operational relevance. Recent diffusion-based traffic modeling motivates the use of generative augmentation as a controlled, bounded component rather than a standalone IDS [5].

3.5. Drift Detection and Bounded Continual Update

A lightweight drift monitor M(·) runs on streaming summary statistics (e.g., feature-wise population stability index, embedding-distance scores, or error-rate signals). When drift exceeds a threshold τ, the framework triggers a bounded update: only a subset of parameters is adapted (e.g., last-layer adapters or low-rank modules), and a replay buffer R is sampled to mitigate catastrophic forgetting. Replay-based continual learning is supported by task-aware sampling to prioritize historically informative instances under current drift, following the motivation of recent memory-replay approaches [4].

Update cadence is controlled by two hyperparameters: the drift-monitoring threshold δ (e.g., PSI ≥ 0.22) and a minimum interval between updates Δ (e.g., Δ = 6 hours). These parameters balance responsiveness with operational stability and enable reproducible, deployment-aligned evaluation.

3.6. Risk Calibration and SIEM Interface

Instead of outputting only a binary decision, DC-GenAIS produces a calibrated risk score r(x)∈ [0,1]. Calibration is performed using a time-separated validation window and may use Platt scaling or isotonic regression. The SIEM interface emits alerts with (i) timestamp, (ii) entity identifiers (IP/host/user if available), (iii) risk score, (iv) top contributing features or explanations, and (v) model version and drift state for auditability. Recent SIEM-oriented studies emphasize that such integration details are essential for real-time threat management and analyst trust [7].

3.7. Algorithmic Summary

Algorithm 1 summarizes the DC-GenAIS workflow (streaming inference, drift monitoring, bounded update, and risk-calibrated alerting).

Algorithm 1. DC-GenAIS (high-level pseudocode).

Input:   1. Data stream {xt}\{x_t\} {xt}   2. Initial detector f0f_0 f0   3. Initial generator G0G_0 G0   4. Replay buffer RR R   5. Drift threshold τ\tau τ   6. Alert threshold α\alpha α   7. Minimum update interval Δ\Delta Δ Initialize:   1. tlast_update←0 for t = 1, 2, 3, ... do // --- Inference --- r_t ← Calibrate(f_t(x_t))           // calibrated risk score if r_t ≥ α then EmitAlert(x_t, r_t) end if // --- Drift monitoring --- δ_t ← M(x_t, f_t)              // drift statistic // --- Conditional adaptation --- if δ_t ≥ τ and (t − t_last_update) ≥ Δ then R_t ← SampleReplay(R, task-aware)     // buffer subsample S_t ← G_t(z, c)              // synthetic samples (optional, training-only) D_t ← RecentLabeled(t) ∪ R_t ∪ S_t f_{t+1} ← UpdateDetector(f_t, D_t, bounded-adapters) RecalibrateOn(TimeSeparatedValidationWindow) t_last_update ← t else f_{t+1} ← f_t end if end for

The algorithm interprets:

• Processes a data stream (x_t) in real time.
• Uses a detector (f_t) to produce a prediction/score.
• Calibrates this into a risk score (r_t) and raises alerts when high.
• Monitors distribution/concept drift via a drift statistic (\delta_t).
• When drift is large and enough time has passed, it:
• Uses a replay buffer (R) and possibly synthetic data from a generator (G_t).
• Updates the detector (f_t \to f_{t+1}) using bounded changes.
• Re-computes calibration on a recent validation window.
• Continues this for all time steps (t).

4. Experimental Evaluation

4.1. Evaluation Scenarios

To establish credibility beyond a single static benchmark, we evaluate DC-GenAIS under three complementary settings: (S1) offline training/testing with strict time-ordered splits for comparability with prior IDS literature; (S2) drifted stream evaluation without updates to quantify degradation under non-stationarity; and (S3) drifted stream evaluation with bounded continual updates to measure recovery and stability. This design avoids optimistic bias from temporally shuffled splits and isolates the contribution of drift monitoring, replay, and generative augmentation.

For each dataset, the stream is split chronologically into Train/Validation/Test without shuffling to avoid temporal leakage. Unless stated otherwise, we use a 70%/10%/20% time-based split and preserve diurnal cycles instead of randomizing records.

4.2. Baselines and Ablations

We benchmark against a mix of classical and deep-learning IDS baselines, including Random Forest and XGBoost, an autoencoder-based anomaly detector, and sequence models (LSTM and Transformer). These baselines capture a representative spectrum of capacity and deployment cost.

We conduct an ablation study to isolate the contribution of each subsystem: drift monitoring, continual updates, generative augmentation, and calibration. This prevents attributing improvements to the full framework without evidence and clarifies which modules matter most under streaming drift.

Random Forest and XGBoost were selected as strong classical machine-learning baselines that remain widely used in operational IDS deployments due to their interpretability and efficiency. Autoencoders were included as representative unsupervised anomaly-detection approaches commonly employed for unknown-attack discovery. LSTM and Transformer models were chosen because they capture temporal dependencies in network traffic and represent contemporary deep-learning IDS architectures. Finally, TS-IDS was incorporated as a recent self-supervised state-of-the-art intrusion-detection benchmark, allowing comparison against modern representation-learning approaches.

4.3. Metrics

Primary detection metrics are PR-AUC (to account for class imbalance) and Macro-F1 (to reflect balanced performance across classes). We additionally track FA·h⁻¹ (false alerts per hour) and latency (ms per flow) as deployment-oriented metrics. For drift scenarios, we report mean detection delay (minutes) and the number of online updates triggered by the drift monitor.

For the static, time-ordered offline evaluation (Section 5.1 and baseline comparisons), we report mean ± standard deviation across five independent runs (five seeds) and use the same seeds across configurations to ensure fair comparisons and to quantify variability. For the streaming drift and ablation analyses (Section 5.2 and Section 5.3), we report point estimates under the fixed streaming protocol to reflect operational behavior; we provide full reproducibility settings (hardware, seeds, and hyperparameters) in Section 6

4.4. Implementation Details

To enable replication, we report the full experimental environment, including hardware (CPU/GPU), training and inference configuration, random seeds, and all operational hyperparameters. These details are summarized in Table 2 and referenced consistently throughout Section 4.

Table 2 summarizes the hyperparameters and operational settings used in the experiments. Values correspond to the configuration used to generate all reported results, enabling exact replication.

5. Results

5.1. Overall Detection Performance (Static Evaluation)

Table 3 reports the overall detection performance of DC-GenAIS on CICIDS2017, UNSW-NB15, and NSL-KDD (sanity check) using mean ± standard deviation across five independent runs (five seeds).

Figure 2 illustrates an example drift timeline for the CICIDS2017 stream, highlighting drift onset, detection (PSI ≥ τ), and the bounded update trigger, along with the corresponding PR-AUC trajectory.

5.2. Drift Impact and Adaptation Gains (Stream Evaluation)

Table 4 reports a streaming evaluation on CICIDS2017 under a concept-drift scenario, summarizing performance before drift, during drift, and after online adaptation. The drift monitor detects the shift after approximately 18 ± 3 minutes, triggering four bounded updates using a replay buffer of 5000 samples per update with a synthetic ratio of 0.2.

5.3. Ablation and Component Contribution

Table 5 reports an ablation study on CICIDS2017 under the drifted streaming setting, isolating the contribution of each subsystem. We keep the streaming protocol fixed and remove one component at a time to quantify its effect on PR-AUC, Macro-F1, and FA·h⁻¹. Unless otherwise stated, the synthetic-to-real ratio in replay is set to ρ_synth = 0.2, which is used consistently across experiments for reproducibility.

Table 6 reports a paired Wilcoxon signed-rank test across five seeds, comparing DC-GenAIS to each baseline under the time-ordered protocol on PR-AUC and Macro-F1.

5.4. Baseline Comparisons

Table 7 and Table 8 compare DC-GenAIS with strong classical and deep-learning baselines on CICIDS2017 and UNSW-NB15 using PR-AUC, Macro-F1, FA/h, and latency.

To strengthen contemporary relevance, we additionally compare against TS-IDS [14], a recent self-supervised intrusion detection baseline, to contextualize DC-GenAIS against representation-learning approaches reported in the intrusion-detection literature.

Baselines were selected according to four criteria:

• strong classical IDS performance (RF, XGBoost);
• unsupervised anomaly detection capability (Autoencoder);
• temporal modeling ability (LSTM, Transformer);
• contemporary self-supervised IDS performance (TS-IDS).

5.5. Zero-Day Generalization (Leave-One-Attack-Family-Out)

To evaluate zero-day generalization, we adopted a Leave-One-Attack-Family-Out (LOAFO) protocol on CICIDS2017, where each attack family was excluded from training and treated as unseen during testing. The corresponding performance results are summarized in Table 9.

To verify the robustness of the framework across datasets, the same LOAFO evaluation was conducted on UNSW-NB15. The resulting zero-day detection performance for unseen attack categories is presented in Table 10.

5.6. Statistical Significance Analysis

To verify that the observed gains are not driven by random initialization, we perform paired Wilcoxon signed-rank tests across five seeds under the strict time-ordered evaluation protocol. Comparisons are computed between DC-GenAIS and each baseline using identical splits on PR-AUC and Macro-F1. As summarized in Table 6, DC-GenAIS achieves statistically significant improvements (p < 0.01) against all evaluated baselines, supporting the robustness of the proposed approach under the evaluated conditions.

6. Discussion

6.1. The Importance of Drift-Aware Data Generation

Empirically, our experiments support the claim that combining drift-aware continual updates with conditional generation improves robustness under non-stationarity while maintaining operational efficiency. In the CICIDS2017 drift scenario, PR-AUC drops from 0.94 to 0.72 during drift and recovers to 0.85 after bounded updates, while FA/h decreases from 11.8 to 5.4 after the update (Table 4). The ablation results further show that removing drift monitoring or continual updating increases false alerts and degrades PR-AUC, confirming that both components are necessary for stable deployment (Table 5).

We avoid overstating generalization beyond the evaluated benchmarks and explicitly scope claims to the tested attack-family hold-out protocol and drift scenario. Extending the framework to live deployments requires validation on anonymized production traffic and analyst-in-the-loop feedback.

6.2. Comparison with Framework-Level Defenses

Compared with purely model-centric IDS studies, DC-GenAIS is designed and evaluated as an information framework: it defines ingestion, update logic, risk calibration, logging, and a SIEM interface. Framework-level temporal graph detection demonstrates that modeling evolving network structure can yield strong performance in dynamic networks [1], while cyber risk optimization emphasizes actionability and decision support [8]. DC-GenAIS complements these directions by providing (i) drift-triggered bounded updates, (ii) calibrated risk scoring to enable prioritization, and (iii) a leakage-aware protocol that prevents common evaluation errors [3].

6.3. Reproducibility and Reporting Obligations

For high-ranked venues, transparency around tuning and cost is critical. We therefore report key hyperparameters, seeds, latency, and false-alarm rates, and we present a clear separation between training-time and streaming-time compute.

Cost–Benefit Analysis. While DC-GenAIS incurs additional compute overhead relative to static models—primarily due to drift monitoring and bounded updates—the framework delivers substantial operational gains. The 47–73% reduction in false alerts per hour, coupled with improved zero-day detection rates, translates into significantly lower analyst workload and reduced incident triage time. Furthermore, update operations remain lightweight, as only a small subset of parameters is adapted, and replay sampling avoids full retraining.

Overall, the marginal computational cost is justified by the improved stability and operational performance.

6.4. Practical Deployment Considerations

Deployment considerations include integration with existing SOC workflows, alert fatigue management, and governance. A conservative operational path is to deploy DC-GenAIS initially in “shadow mode” to observe false-alert behavior and drift signals without triggering automated actions. Subsequent phased rollouts can enable human-in-the-loop confirmation to create delayed labels for continual learning. SIEM-focused work suggests that such integration can improve response efficiency by correlating alerts and prioritizing high-risk events [7].

6.5. SIEM

The SIEM component is currently conceptual and intended as an operational integration layer rather than an independently evaluated subsystem.

Performance claims are bounded by the evaluated benchmarks and drift scenario. If the deployment distribution shifts substantially (e.g., encryption changes, new protocols), additional feature engineering or telemetry adaptation is required [10].

Recent surveys on generative AI in cybersecurity motivate privacy-aware, operationally grounded designs for generative defenses [11]. We therefore couple generative components with calibration and drift-aware protocols rather than relying on generation alone.

7. Threats to Validity and Limitations

Threat Model. The attacker is assumed to have no direct access to the model weights but may observe alerts, induce distributional shifts, or generate new attack variants. The threat model includes (i) adaptive adversaries capable of probing the detector, (ii) zero-day patterns unseen during initial training, and (iii) benign-behavior drift caused by legitimate user or framework changes. DC-GenAIS is designed to operate under these conditions through drift-triggered updates, bounded parameter recalibration, and replay-driven memory retention.

Internal validity threats include (i) data leakage from preprocessing, feature selection, or augmentation performed before splitting; (ii) hyperparameter tuning on the test window; and (iii) non-representative drift simulation. The leakage-aware protocol in Section 3.3 is designed to mitigate these risks [3].

External validity threats include differences between benchmark datasets and real enterprise traffic (encrypted payloads, sensor coverage gaps, or domain-specific protocols). The drift-aware design and SIEM interface improve realism but do not fully substitute for evaluation on anonymized production data.

Construct validity threats include reliance on aggregate accuracy metrics without operational measures; the paper therefore prioritizes false alerts per hour, detection delay, and latency alongside F1/AUC.

All numerical results in Section 5 are computed from the reported runs (five seeds), and the manuscript reports mean ± standard deviation to avoid overfitting conclusions to a single split or initialization.

Limitations of Generative Modeling. Although generative augmentation improves coverage of minority behaviors, the generator may fail to capture extremely rare or highly obfuscated adversarial patterns. Additionally, diffusion-based sampling may introduce subtle distributional artifacts if used excessively, which justifies the use of conservative synthetic ratios and drift-aware recalibration.

8. Conclusions and Future Work

This extension introduced DC-GenAIS, a drift-aware continual generative behavioral detection framework for zero-day and evolving cyber threats. The framework strengthens the base GenAIS by adding (i) explicit drift monitoring with bounded updates, (ii) replay and controlled generative augmentation to mitigate catastrophic forgetting and class imbalance, (iii) leakage-aware evaluation and train-only preprocessing rules, and (iv) a calibrated risk and SIEM-ready interface designed for operational SOC workflows.

Future work will focus on (a) validating the framework on anonymized production telemetry with delayed labels, (b) expanding generation to cover multi-domain signals (logs, alerts, and host telemetry), and (c) exploring stronger robustness to adversarial manipulation and privacy constraints in federated [12,13].