An Open-Set Classification Framework with Dynamic Retraining Adaptation for Intrusion Detection

• Giovanna Vieira Souza UFMG
• Fernando Nakayama UFMG
• Michele Nogueira UFMG

DOI: https://doi.org/10.5753/sbrc.2026.19386

Abstract

The effectiveness of network attack detection is often compromised by the nature of closed-set classifiers, which are intrinsically incapable of handling unknown threats. Open-set classification allows for the identification of new samples to mitigate this problem; however, traditional models operate statically, failing to incorporate knowledge from new discoveries and, consequently, suffering from performance degradation over time. This paper proposes a semi-supervised open-set classification framework aiming to overcome this limitation, structured with a short-term module for immediate response and a long-term module for continuous learning. In the latter, unknown instances are analyzed to identify new classes and, as a central contribution, the model is incrementally retrained. The proposed framework was evaluated on two distinct datasets subjected to stability, plasticity, and robustness tests, with final postretraining accuracies reaching 89.88%.

References

Agrahari, S. and Singh, A. K. (2021). Concept drift detection in data stream mining: A literature review. Journal of King Saud University - Computer and Information Sciences, 34:9523–9540.

Bendale, A. and Boult, T. (2015). Towards open world recognition. Conference on Computer Vision and Pattern Reocgnition, páginas 1893–1902.

Dahanayaka, T., Ginige, Y., Huang, Y., Jourjon, G., and Seneviratne, S. (2023). Robust open-set classification for encrypted traffic fingerprinting. Comp. Networks, 236:1–15.

Fernandes, G. (2008). Detecção e classificação de anomalias no tráfego de redes de computadores. Trabalho de conclusão de curso, Universidade Federal de Santa Catarina.

Fu, Y., Liu, Z., and Lyu, J. (2025). Reason and discovery: A new paradigm for open set recognition. IEEE Trans. Pattern Anal. Mach. Intell., 47(7):5586–5599.

Geng, C., Huang, S.-j., and Chen, S. (2020). Recent advances in open set recognition: A survey. IEEE Trans. Netw. Service Manag., 43(10):3614–3631.

Geng, C., Huang, S.-j., and Chen, S. (2025). Reliable open-set network traffic classification. IEEE Trans. Inf. Forensics Security, 20(10):2313–2328.

Ginige, Y., Dahanayaka, T., and Seneviratne, S. (2024). TrafficGPT: An llm approach for open-set encrypted traffic classification. In Proceedings of the 19th Asian Internet Engineering Conference, p. 26–35. Association for Computing Machinery.

Jochem, I., Andreoni, M., Antonio, G., and Carlos, O. (2018). Um sistema de detecção de ameaças distribuídas de rede baseado em aprendizagem por grafos. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos, páginas 1187–1200.

Liu, Y.-C., Ma, C.-Y., Dai, X., Tian, J., Vajda, P., He, Z., and Kira, Z. (2022). Open-set semi-supervised object detection. In Proceedings of the European Conference on Computer Vision (ECCV).

Passoni, L. M. (2024). Detecção de anomalias em redes de computadores e equipamentos iot. In Engenharia de Computação: Inovação Digital e Desenvolvimento Tecnológico, páginas 338–356. Editora Científica Digital.

Rocha, M. and Silva, D. (2020). Detecção de tráfego anômalo de rede utilizando clusterização em big data. Simpósio Brasileiro de Telecomunicações e Processamento de Sinais, páginas 1–5.

Scheirer, W. J., Rocha, A., Sapkota, A., and Boult, T. E. (2013). Towards open set recognition. IEEE Trans. Pattern Anal. Mach. Intell., 35(7):1757–1772.

Zhou, H., Huang, X., and Deng, L. (2024). Enhancing network traffic classification with large language models. IEEE International Conf. on Big Data, páginas 7282–7281.