[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82687-en":3,"doc-seo-82687-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82687,3848291630094,"Emma Wilson","https://eur-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45",8,"Research & Report","RES-DARE: Failure-Aware Expert Adaptation and Rollback-Safe Self-Repair for Intrusion Detection","Intrusion detection systems are often trained on static benchmarks, yet real deployments face traffic drift, sensor noise, workload changes, and evolving attack behaviour. Under these distribution shifts, detectors can fail silently while remaining overconfident. RES-DARE (Recursive Evolving Specialists–Digital Adaptive Reasoning Engine) introduces failure-aware continual intrusion detection with rollback-safe self-repair. Difficult and misclassified samples act as failure signals for expert specialisation rather than discarded noise. A supervised contrastive encoder, two-pass routing, failure-buffer and HDBSCAN failure-region discovery, plus a trust-risk monitor, support adaptive behaviour. AEHM-v2 provisionally activates candidate repairs and commits only when macro-F1 is preserved or improved while trust risk remains stable. Evaluation on CICIDS2017, UNSW-NB15, and TON IoT reaches macro-F1 0.9850, 0.9736, and 0.9691, with near-zero catastrophic forgetting under feature corruption.","RES-DARE: FAILURE-AWARE EXPERT ADAPTATION AND ROLLBACK-SAFE SELF-REPAIR FOR INTRUSION DETECTION  \narXiv :2607 .02687v 1 [ cs .CR] 2 Jul 2026  \nRahil Aftab   \nDepartment of Computer Science Jamia Hamdard New Delhi 110062, India [rahilaftab12@gmail.com](rahilaftab12@gmail.com)  \nAnyash Prasad   \nDepartment of Computer Science Kalinga Institute of Industrial Technology Bhubaneswar, Odisha 751024, India [anyashprasad@gmail.com](anyashprasad@gmail.com)  \nSoumya Mazumdar   \nDepartment of Computer Science and Business Systems  \nGargi Memorial Institute of Technology  \nAffiliated to Maulana Abul Kalam Azad University of Technology Balarampur, Mouza Beralia, Baruipur, Kolkata 700144, West Bengal, India [reachme@soumyamazumdar.com](reachme@soumyamazumdar.com)  \nVineet Kumar Rakesh   \nEngineering Science  \nHomi Bhabha National Institute  \nAnushaktinagar, Mumbai 400094, Maharashtra, India  \nComputer and Informatics Group  \nVariable Energy Cyclotron Centre  \n1/AF, Bidhannagar, Kolkata 700064, West Bengal, India  \n[vineet@vecc.gov.in](vineet@vecc.gov.in)  \nTapas Samanta   \nEngineering Science  \nHomi Bhabha National Institute  \nAnushaktinagar, Mumbai 400094, Maharashtra, India  \nComputer and Informatics Group  \nVariable Energy Cyclotron Centre  \n1/AF, Bidhannagar, Kolkata 700064, West Bengal, India  \n[tsamanta@vecc.gov.in](tsamanta@vecc.gov.in)  \nJuly 7, 2026  \nABSTRACT  \nIntrusion detection systems are often trained under static benchmark conditions, although deployed network environments are affected by traffic drift, sensor noise, changing workloads, and evolving attack behaviour. Under such distribution shifts, static detectors may produce confident but incorrect predictions, leading to silent and unsafe failure modes. In this paper, RES-DARE (Recursive Evolving Specialists-Digital Adaptive Reasoning Engine) is proposed as a failure-aware continual intrusion detection framework with rollback-safe self-repair. Difficult, uncertain, and misclassified samples are treated as failure signals for expert specialisation rather than being discarded as noise. A supervised contrastive encoder, two-pass expert router, failure-buffer mechanism, HDBSCAN-based failure-region discovery, and trust-risk monitor are integrated to support adaptive IDS behaviour. AEHM-v2 is introduced as a rollback-safe repair mechanism, where candidate adaptations are provisionally activated and committed only when macro-F1 is preserved or improved while trust risk remains stable. Otherwise, the system is rolled back to its last validated state. RES-DARE is evaluated on CICIDS2017, UNSW-NB15, and TON IoT, achieving macro-F1 scores of 0.9850, 0.9736, and 0.9691, respectively. Under Gaussian feature corruption at strength 0.10, RES-DARE retains an Attack-F1 of 0.7920 on CICIDS2017 and achieves near-zero catastrophic forgetting with F = 0.0015 .  \nA PREPRINT-JULY 7, 2026  \nThe results show that RES-DARE improves robustness, warning capability, and deployment safety under degraded conditions.  \nKeywords: Intrusion detection, Continual learning, mixture of experts, Self-repair, Robustness, Trust monitoring  \n1 Introduction  \nModern intrusion detection systems are increasingly deployed in environments where traffic statistics drift, sensors degrade, and attacker behaviour changes faster than static training assumptions. In this setting, a model that scores well on a clean benchmark may still fail dangerously: the most concerning case is not merely low accuracy, but confident failure under distribution shift.  \nThis paper presents RES-DARE (Recursive Evolving Specialists – Digital Adaptive Reasoning Engine), a failureaware continual IDS framework designed around three principles: failures should be treated as signals for specialisation rather than discarded as noise; adaptation must be validated before it is committed; and evaluation must measure operational robustness alongside clean metrics.  \nRES-DARE combines a frozen representation encoder, dynamic expert routing, HDBSCAN-bas","cbCaie2DrYL6kAns","https://ap.wps.com/l/cbCaie2DrYL6kAns","pdf",241002,1,12,"English","en",105,"# Introduction\n# Related Work","[{\"question\":\"What problem does RES-DARE address in intrusion detection deployments?\",\"answer\":\"It targets failure modes caused by distribution shifts such as traffic drift, sensor noise, workload changes, and evolving attack behaviour, which can make models fail confidently and silently on real networks.\"},{\"question\":\"How does RES-DARE use failures during continual learning?\",\"answer\":\"Uncertain, difficult, and misclassified samples are treated as informative failure signals for expert specialisation instead of being discarded as noise.\"},{\"question\":\"How does AEHM-v2 ensure rollback-safe self-repair?\",\"answer\":\"AEHM-v2 provisionally activates adaptation candidates and commits them only if macro-F1 is preserved or improved while trust risk stays stable; otherwise it rolls back to the last validated state.\"}]",1784182291,30,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"res-dare-failure-aware-expert-adaptation-and-rollback-safe-self-repair-for-intrusion-detection","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/res-dare-failure-aware-expert-adaptation-and-rollback-safe-self-repair-for-intrusion-detection/82687/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does RES-DARE address in intrusion detection deployments?","Question",{"text":75,"@type":76},"It targets failure modes caused by distribution shifts such as traffic drift, sensor noise, workload changes, and evolving attack behaviour, which can make models fail confidently and silently on real networks.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does RES-DARE use failures during continual learning?",{"text":80,"@type":76},"Uncertain, difficult, and misclassified samples are treated as informative failure signals for expert specialisation instead of being discarded as noise.",{"name":82,"@type":73,"acceptedAnswer":83},"How does AEHM-v2 ensure rollback-safe self-repair?",{"text":84,"@type":76},"AEHM-v2 provisionally activates adaptation candidates and commits them only if macro-F1 is preserved or improved while trust risk stays stable; otherwise it rolls back to the last validated state.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":28,"slug":121},"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]