RES-DARE: Failure-Aware Expert Adaptation and Rollback-Safe Self-Repair for Intrusion Detection

Jul 16, 2026

Intrusion detection systems are often trained on static benchmarks, yet real deployments face traffic drift, sensor noise, workload changes, and evolving attack behaviour. Under these distribution shifts, detectors can fail silently while remaining overconfident. RES-DARE (Recursive Evolving Specialists–Digital Adaptive Reasoning Engine) introduces failure-aware continual intrusion detection with rollback-safe self-repair. Difficult and misclassified samples act as failure signals for expert specialisation rather than discarded noise. A supervised contrastive encoder, two-pass routing, failure-buffer and HDBSCAN failure-region discovery, plus a trust-risk monitor, support adaptive behaviour. AEHM-v2 provisionally activates candidate repairs and commits only when macro-F1 is preserved or improved while trust risk remains stable. Evaluation on CICIDS2017, UNSW-NB15, and TON IoT reaches macro-F1 0.9850, 0.9736, and 0.9691, with near-zero catastrophic forgetting under feature corruption.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

Introduction

Related Work

RES-DARE: FAILURE-AWARE EXPERT ADAPTATION AND ROLLBACK-SAFE SELF-REPAIR FOR INTRUSION DETECTION arXiv :2607 .02687v 1 [ cs .CR] 2 Jul 2026 Rahil Aftab Department of Computer Science Jamia Hamdard New Delhi 110062, India [rahilaftab12@gmail.com](rahilaftab12@gmail.com) Anyash Prasad Department of Computer Science Kalinga Institute of Industrial Technology Bhubaneswar, Odisha 751024, India [anyashprasad@gmail.com](anyashprasad@gmail.com) Soumya Mazumdar Department of Computer Science and Business Systems Gargi Memorial Institute of Technology Affiliated to Maulana Abul Kalam Azad University of Technology Balarampur, Mouza Beralia, Baruipur, Kolkata 700144, West Bengal, India [reachme@soumyamazumdar.com](reachme@soumyamazumdar.com) Vineet Kumar Rakesh Engineering Science Homi Bhabha National Institute Anushaktinagar, Mumbai 400094, Maharashtra, India Computer and Informatics Group Variable Energy Cyclotron Centre 1/AF, Bidhannagar, Kolkata 700064, West Bengal, India [vineet@vecc.gov.in](vineet@vecc.gov.in) Tapas Samanta Engineering Science Homi Bhabha National Institute Anushaktinagar, Mumbai 400094, Maharashtra, India Computer and Informatics Group Variable Energy Cyclotron Centre 1/AF, Bidhannagar, Kolkata 700064, West Bengal, India [tsamanta@vecc.gov.in](tsamanta@vecc.gov.in) July 7, 2026 ABSTRACT Intrusion detection systems are often trained under static benchmark conditions, although deployed network environments are affected by traffic drift, sensor noise, changing workloads, and evolving attack behaviour. Under such distribution shifts, static detectors may produce confident but incorrect predictions, leading to silent and unsafe failure modes. In this paper, RES-DARE (Recursive Evolving Specialists-Digital Adaptive Reasoning Engine) is proposed as a failure-aware continual intrusion detection framework with rollback-safe self-repair. Difficult, uncertain, and misclassified samples are treated as failure signals for expert specialisation rather than being discarded as noise. A supervised contrastive encoder, two-pass expert router, failure-buffer mechanism, HDBSCAN-based failure-region discovery, and trust-risk monitor are integrated to support adaptive IDS behaviour. AEHM-v2 is introduced as a rollback-safe repair mechanism, where candidate adaptations are provisionally activated and committed only when macro-F1 is preserved or improved while trust risk remains stable. Otherwise, the system is rolled back to its last validated state. RES-DARE is evaluated on CICIDS2017, UNSW-NB15, and TON IoT, achieving macro-F1 scores of 0.9850, 0.9736, and 0.9691, respectively. Under Gaussian feature corruption at strength 0.10, RES-DARE retains an Attack-F1 of 0.7920 on CICIDS2017 and achieves near-zero catastrophic forgetting with F = 0.0015 . A PREPRINT-JULY 7, 2026 The results show that RES-DARE improves robustness, warning capability, and deployment safety under degraded conditions. Keywords: Intrusion detection, Continual learning, mixture of experts, Self-repair, Robustness, Trust monitoring 1 Introduction Modern intrusion detection systems are increasingly deployed in environments where traffic statistics drift, sensors degrade, and attacker behaviour changes faster than static training assumptions. In this setting, a model that scores well on a clean benchmark may still fail dangerously: the most concerning case is not merely low accuracy, but confident failure under distribution shift. This paper presents RES-DARE (Recursive Evolving Specialists – Digital Adaptive Reasoning Engine), a failureaware continual IDS framework designed around three principles: failures should be treated as signals for specialisation rather than discarded as noise; adaptation must be validated before it is committed; and evaluation must measure operational robustness alongside clean metrics. RES-DARE combines a frozen representation encoder, dynamic expert routing, HDBSCAN-bas

FAQs

What problem does RES-DARE address in intrusion detection deployments?

It targets failure modes caused by distribution shifts such as traffic drift, sensor noise, workload changes, and evolving attack behaviour, which can make models fail confidently and silently on real networks.

How does RES-DARE use failures during continual learning?

Uncertain, difficult, and misclassified samples are treated as informative failure signals for expert specialisation instead of being discarded as noise.

How does AEHM-v2 ensure rollback-safe self-repair?

AEHM-v2 provisionally activates adaptation candidates and commits them only if macro-F1 is preserved or improved while trust risk stays stable; otherwise it rolls back to the last validated state.

Jul 16, 2026

Upload by Emma Wilson