AN ADAPTIVE DEEP INTRUSION DETECTION SYSTEM FOR ZERO-DAY ATTACKS

Abstract

 The escalating sophistication of network-based attacks, particularly zero-day exploits that evade signature-based defenses, has exposed the limitations of conventional Intrusion Detection Systems (IDS). Signature-matching engines such as Snort and Suricata remain blind to threats for which no rule yet exists, leaving networks vulnerable during the critical window between exploit release and patch deployment. This paper proposes an Adaptive Deep Intrusion Detection System (AD-IDS) that fuses unsupervised deep learning with reinforcement-learning-driven adaptation to detect previously unseen attack patterns in real time. The system captures live packets using Scapy, extracts a rich set of statistical and flow-based traffic features, and feeds them into a deep Autoencoder trained exclusively on benign traffic to model normal network behavior. Reconstruction error is used as an anomaly score, and a dynamic threshold adaptation mechanism continuously recalibrates the decision boundary using an exponentially weighted moving statistic to accommodate concept drift and diurnal traffic variation. A Deep Reinforcement Learning (DRL) agent, implemented using a Deep Q-Network, observes the anomaly-scoring environment and learns to adjust sensitivity, issue alerts, and prioritize investigation queues so as to minimize a cost function that jointly penalizes false positives and false negatives. The complete pipeline was implemented in Python and evaluated on the NSL-KDD and CICIDS2017 benchmark datasets as well as on live traffic captured in a controlled laboratory testbed. Experimental results show that the proposed AD-IDS achieves a detection accuracy of 97.8% and an F1-score of 0.965 on known attack classes, while maintaining a true positive rate above 91% on held-out zero-day-simulated attack categories that were withheld from training, substantially outperforming static-threshold autoencoder baselines and classical machine-learning classifiers. The results demonstrate that combining representation learning, adaptive statistical thresholds, and reinforcement-learning-based decision policies yields a practical, self-tuning IDS capable of responding to the evolving threat landscape without continuous manual retraining.