Enhancing Robustness of Machine Learning based Intrusion Detection Systems under Distribution Shift through Stability-Constrained Learning

Abstract

Machine learning is widely used in intrusion detection systems to identify malicious network activities, but in practical environments, the data used during training often differs from the data encountered after deployment because network traffic changes over time. As a result, models that perform well during training may behave inconsistently in real conditions, especially when small variations in input lead to noticeable changes in prediction. This work looks at intrusion detection from the perspective of prediction stability under such changing data conditions by introducing a stability constraint during training that limits how much the model output can vary when the input is slightly modified. Along with classification accuracy, the behavior of the model is examined using measures such as prediction sensitivity, output variance, and parameter magnitude so that reliability can be understood more clearly rather than relying on accuracy alone. The approach is evaluated using benchmark intrusion detection data with controlled variations that represent changes in network traffic, and the observations show that the model produces more consistent outputs and is less affected by small input changes while maintaining a similar level of detection performance, indicating that incorporating stability into the learning process can improve the reliability of intrusion detection systems in dynamic environments