IID-DAKD: An Incremental Intrusion Detection Method for Encrypted Traffic Based on Dual Augmentation and Fusion Knowledge Distillation

To address the pronounced degradation in detection accuracy of encrypted traffic intrusion models after incremental updates, which is primarily caused by catastrophic forgetting and task-level overfitting during incremental learning, this paper proposes a novel incremental intrusion detection method for encrypted traffic based on dual augmentation and fusion knowledge distillation, termed IID-DAKD. First, both known and previously unseen attacks identified during detection are leveraged to update a representative sample set. An encrypted traffic representative sample augmentation strategy based on Gaussian noise is then devised to reduce storage requirements and classifier bias, thereby effectively mitigating catastrophic forgetting. Second, a self-supervised learning framework driven by encrypted traffic class augmentation is constructed to alleviate representation bias and suppress task-level overfitting. Finally, three complementary knowledge distillation strategies are jointly employed to extract and transfer attack classification knowledge from the old model to the updated model, further improving detection accuracy and robustness while enhancing training efficiency. Extensive experimental results demonstrate that the proposed IID-DAKD approach alleviates catastrophic forgetting and task-level overfitting while maintaining symmetrical knowledge transfer during incremental learning, enabling efficient model updates and high detection accuracy for encrypted traffic intrusion detection.