Adaptive-Delta ADWIN: A Framework for Stable and Sensitive Intrusion Detection in Streaming Networks

Intrusion Detection Systems (IDS) must adapt to network traffic streams where concept drift alters the normal and malicious behaviors. The traditional drift detectors with fixed sensitivity parameter () fail to balance responsiveness and stability, reducing detection reliability. This study introduces Adaptive−Delta ADWIN framework that adjusts through two online controllersthe Volatility Controller (VC) and AlertRate Controller (ARC) to improve the sensitivity while maintaining stability. The experiments were evaluated on the CICIDS2017 dataset using multiclass ensemble of Hoeffding Adaptive Trees, the framework achieved 0.930.95, surpassing fixed baselines by up to 6.6%. The false positive and false negative rates were reduced by 50% and 30%. Overall, the results confirm that Adaptive ADWIN enhances multiclass IDS performance between detection sensitivity and operational stability in the realtime network conditions.