Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Quantifying Catastrophic Forgetting in IoT Intrusion Detection Systems

Sourasekhar Banerjee, David Bergqvist, Salman Toor, Christian Rohner, Andreas Johnsson

TL;DR

Results show that continual learning mitigates catastrophic forgetting while maintaining a balance between plasticity, stability, and efficiency, a crucial aspect for resource-constrained IoT environments.

Abstract

Distribution shifts in attack patterns within RPL-based IoT networks pose a critical threat to the reliability and security of large-scale connected systems. Intrusion Detection Systems (IDS) trained on static datasets often fail to generalize to unseen threats and suffer from catastrophic forgetting when updated with new attacks. Ensuring continual adaptability of IDS is therefore essential for maintaining robust IoT network defence. In this focused study, we formulate intrusion detection as a domain continual learning problem and propose a method-agnostic IDS framework that can integrate diverse continual learning strategies. We systematically benchmark five representative approaches across multiple domain-ordering sequences using a comprehensive multi-attack dataset comprising 48 domains. Results show that continual learning mitigates catastrophic forgetting while maintaining a balance between plasticity, stability, and efficiency, a crucial aspect for resource-constrained IoT environments. Among the methods, Replay-based approaches achieve the best overall performance, while Synaptic Intelligence (SI) delivers near-zero forgetting with high training efficiency, demonstrating strong potential for stable and sustainable IDS deployment in dynamic IoT networks.

Quantifying Catastrophic Forgetting in IoT Intrusion Detection Systems

TL;DR

Results show that continual learning mitigates catastrophic forgetting while maintaining a balance between plasticity, stability, and efficiency, a crucial aspect for resource-constrained IoT environments.

Abstract

Distribution shifts in attack patterns within RPL-based IoT networks pose a critical threat to the reliability and security of large-scale connected systems. Intrusion Detection Systems (IDS) trained on static datasets often fail to generalize to unseen threats and suffer from catastrophic forgetting when updated with new attacks. Ensuring continual adaptability of IDS is therefore essential for maintaining robust IoT network defence. In this focused study, we formulate intrusion detection as a domain continual learning problem and propose a method-agnostic IDS framework that can integrate diverse continual learning strategies. We systematically benchmark five representative approaches across multiple domain-ordering sequences using a comprehensive multi-attack dataset comprising 48 domains. Results show that continual learning mitigates catastrophic forgetting while maintaining a balance between plasticity, stability, and efficiency, a crucial aspect for resource-constrained IoT environments. Among the methods, Replay-based approaches achieve the best overall performance, while Synaptic Intelligence (SI) delivers near-zero forgetting with high training efficiency, demonstrating strong potential for stable and sustainable IDS deployment in dynamic IoT networks.
Paper Structure (13 sections, 5 equations, 4 figures, 2 tables)

This paper contains 13 sections, 5 equations, 4 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Background
  4. Problem Statement and Formulation
  5. System Model
  6. Network, domains, and data collection
  7. Continual Learning integrated into the IDS
  8. Experimental Setup
  9. Results and Discussions
  10. Performance of the model
  11. Catastrophic Forgetting
  12. Stability, Plasticity, and Efficiency Trade--off
  13. Conclusions and Future Scope

Figures (4)

  • Figure 1: (a) Sequential training suffers from catastrophic forgetting, while (b) continual learning retains knowledge of prior attacks to sustain performance.
  • Figure 2: System model of continual learning based intrusion detection system.
  • Figure 3: T-SNE 2D-visualizations of attack domains for four IoT network attacks—Blackhole (BH), DIS-Flooding (DF), Local Repair (LR), and Worst Parent (WP)—under three attack types: base (left), on-off (center), and gradual decrease (right). Network comprises 20 nodes, simulated using Cooja bergqvist2025assessing.
  • Figure 4: Change of BWT per domain for domain sequence Random (Top left), B2W (Top right), W2B (Bottom left), Toggle (Bottom right).