Adaptive Aerospace Intrusion Detection Using HyperNEAT-Driven Neural Network Evolution

As cyberspace continues to expand and diversify, protecting networked systems from malicious activity remains a fundamental challenge across science and engineering. Intrusion detection systems (IDSs) play a critical role in maintaining the security and reliability of modern digital infrastructure. Many existing anomaly-based intrusion detection systems rely on traditional machine learning techniques, such as clustering and decision trees, to identify deviations from normal traffic behavior. While effective in static settings, these approaches often struggle to adapt to evolving threats and complex, nonlinear patterns in network traffic, and they frequently require significant manual model design. The problem addressed in this paper is how to design an intrusion detection approach that can autonomously adapt its internal structure to better capture evolving patterns in network traffic. Here we show that a neuroevolutionary approach based on Hypercube-based NeuroEvolution of Augmenting Topologies (HyperNEAT) can evolve neural network architectures that improve anomaly detection without manual architectural tuning. Building on prior work using NEAT for intrusion detection, this study investigates HyperNEAT’s ability to exploit geometric relationships among network features through Compositional Pattern Producing Networks (CPPNs). Using the NSL-KDD dataset and three distinct fitness formulations, we evaluate HyperNEAT’s effectiveness in detecting anomalous traffic and compare its performance to traditional machine learning–based IDS methods. The results quantify the extent to which geometry-aware neuroevolution improves detection capability. More broadly, this work demonstrates the potential of neuroevolutionary algorithms to serve as adaptive, self-organizing alternatives to manually designed IDS models. By reducing reliance on predefined architectures, HyperNEAT offers a promising direction for building intrusion detection systems that can respond more effectively to emerging and unknown cyber threats.