Concept Drift Analysis Based on Isolation Forest for Effectively Detecting Network Attack in IoT Scenarios

In the era of the Internet of Things, massive network data streams are continuously generated, with distributions that evolve unpredictably over time. This dynamic nature poses significant challenges for effective analysis. To address this, we propose a novel double-layer concept drift detection algorithm based on isolation forest, termed IF-DLDD, designed to identify multiple types of concept drift. The framework consists of a detection layer, where isolation forest detects anomalies across consecutive sliding windows, and a verification layer, where a T-test is employed to precisely localize drift points and reduce false alarms. We evaluate IF-DLDD on both noisy synthetic datasets and the real-world CIC-IDS2017 intrusion detection dataset. The results demonstrate that IF-DLDD achieves timely and accurate detection across diverse drift types, maintaining a high detection rate with low false positives and strong noise robustness. In network intrusion detection tasks, IF-DLDD effectively identifies all attack drifts with minimal false positives and detection delays under practical parameter settings. These findings highlight IF-DLDD as a promising and practical approach for concept drift detection in dynamic data streams.