Evolving Intelligent Network Attack Classifier Under Label Distribution Shift

The next-generation internet is being reshaped by the growing intelligence and connectivity of artificial intelligence of things (AIoT) devices. This evolution emphasizes the importance of AI-enabled network intrusion detection systems (NIDS) in intelligent network environments. Two major technical challenges in developing such systems are addressing class imbalance and adapting to label distribution shifts after deployment. Class imbalance, caused by the dominance of normal traffic and the scarcity and uneven distribution of attack types, often results in low performance for minority attack type classes. In addition, evolving attack patterns necessitate efficient and continuous model post-training, despite the limited and unlabeled data available in the post-deployment phase. This study proposes a unified training framework consisting of a two-step pre-training scheme and an adaptive post-training scheme. In Step I of pre-training, balanced contrastive pair selection is performed to account for class imbalance, while Step II refines the representations of hard-to-distinguish samples located near decision boundaries using latent features. In the post-training phase, the framework leverages both model outputs and latent representations to generate reliable pseudo-labels for learning. A key insight of this work is that a well-structured latent representation space enables reliable pseudo-labeling during post-training. Extensive simulations across eight online label shift scenarios with three datasets demonstrate that the proposed method achieves up to an$\bf {8.6}\%$improvement in accuracy and F1-score over eight state-of-the-art approaches, along with a significant reduction in post-training complexity.