Quantifying Catastrophic Forgetting in IoT Intrusion Detection Systems

2026-02-27

AI Summary

This study addresses the challenge of catastrophic forgetting in intrusion detection systems (IDS) deployed in RPL-based IoT networks, where distribution shifts in attack patterns hinder generalization to emerging threats during continuous model updates. For the first time, the problem is systematically quantified, and IoT intrusion detection is formally framed as a continual domain learning task. The authors propose a method-agnostic framework that seamlessly integrates five representative continual learning strategies, including replay and synaptic intelligence. Evaluation on a large-scale dataset encompassing 48 distinct attack domains demonstrates that replay-based methods achieve the best overall performance, while synaptic intelligence offers near-zero forgetting with high training efficiency. This work substantially enhances the continual adaptability and defensive stability of IDS in resource-constrained IoT environments, revealing critical trade-offs among stability, plasticity, and computational efficiency across different continual learning approaches.

Technology Category

• Machine Learning: Life-Long and Continual Learning
• Intelligent Robots: Learning & Optimization for ROB
• Application Domains: Internet of Things, Sensor Networks & Smart Cities

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Distribution shifts in attack patterns within RPL-based IoT networks pose a critical threat to the reliability and security of large-scale connected systems. Intrusion Detection Systems (IDS) trained on static datasets often fail to generalize to unseen threats and suffer from catastrophic forgetting when updated with new attacks. Ensuring continual adaptability of IDS is therefore essential for maintaining robust IoT network defence. In this focused study, we formulate intrusion detection as a domain continual learning problem and propose a method-agnostic IDS framework that can integrate diverse continual learning strategies. We systematically benchmark five representative approaches across multiple domain-ordering sequences using a comprehensive multi-attack dataset comprising 48 domains. Results show that continual learning mitigates catastrophic forgetting while maintaining a balance between plasticity, stability, and efficiency, a crucial aspect for resource-constrained IoT environments. Among the methods, Replay-based approaches achieve the best overall performance, while Synaptic Intelligence (SI) delivers near-zero forgetting with high training efficiency, demonstrating strong potential for stable and sustainable IDS deployment in dynamic IoT networks.

Problem

• catastrophic forgetting
• IoT intrusion detection
• distribution shift
• continual learning
• RPL-based networks

Innovation

• continual learning
• catastrophic forgetting
• intrusion detection system
• IoT security
• domain shift