Data-driven mitigation of catastrophic forgetting in dynamic physical layer attack detection

2026-07-01

AI Summary

This work addresses the catastrophic forgetting problem in dynamic attack detection models when encountering novel physical-layer attacks, which often leads to the loss of previously acquired detection capabilities. To mitigate this issue without increasing model complexity, the authors propose a data balancing mechanism that triggers a resampling strategy—combining historical and current attack data—based on a predefined accuracy degradation threshold during incremental training. Evaluated on an optical network security dataset, the proposed approach significantly enhances adaptation efficiency, reducing average adaptation time by 37%. Moreover, it restores detection performance using 6% fewer data batches compared to network-expansion-based baselines, effectively balancing model adaptability with the retention of historical knowledge.

Abstract

Optical networks are critical infrastructure that underpins global communications, and detecting security breaches that jeopardize them is essential to maintaining worldwide connectivity. As malicious actors continuously evolve their attack techniques, dynamically updated intrusion detection models have become a key component of modern defense mechanisms. By incorporating newly acquired telemetry data, these models can adapt to emerging threats while maintaining high detection performance. However, when previously encountered attacks reappear after a prolonged period of absence, adaptive models may fail to recognize them due to the phenomenon of catastrophic forgetting. In contrast, statically trained models can reliably detect attacks represented in the original training data but lack the ability to adapt to previously unseen attack patterns. Consequently, intrusion detection systems face a fundamental tradeoff between adaptability to evolving threats and long-term retention of previously acquired knowledge. In this work, we propose a data-driven mechanism to cope with catastrophic forgetting in dynamic attack detection systems. Our approach balances the model update datasets by using parts of past attack data. We utilize a threshold-based mechanism to trigger data balancing after accuracy drops due to an active attack change. Applied to an experimental optical network security dataset, the proposed approach reduces the average model adaptation time by 37% compared to its dynamic counterpart that does not employ data balancing. Compared to a baseline from the literature that relies on neural network depth increasing, our approach requires 6% fewer data batches to adapt to changing conditions and regain performance.

Problem

• catastrophic forgetting
• dynamic attack detection
• intrusion detection
• optical network security
• model adaptability

Innovation

• catastrophic forgetting
• data-driven mitigation
• dynamic attack detection
• optical network security
• model adaptation