DCAD: A Dynamic Continual Anomaly Detection Framework for Adaptive Network Traffic Analysis under Concept Drift

Machine-learning-based network anomaly detectors are usually trained once on historical traffic, yet real traffic keeps changing as applications, software, and attack techniques evolve, a problem known as concept drift. Detectors that ignore drift raise false alarms and miss novel attacks, and periodic manual retraining is costly. This paper proposes the Dynamic Continual Anomaly Detection (DCAD) framework, which couples a preprocessing layer, an ADWIN-based concept-drift monitor, an incremental learning engine, a replay-based knowledge-retention layer, and a threshold-based decision layer. An Autoencoder trained only on normal traffic serves as the detection engine and flags flows whose reconstruction error exceeds a validation-selected threshold. On the NSL-KDD benchmark, the Autoencoder detector is compared with SVM, Random Forest, and Isolation Forest. It achieved the highest accuracy (83.4% versus 78.1%, 77.1%, and 70.6%), a false positive rate of 3.7%, an attack recall of 73.7%, and the lowest per-sample inference time. Over ten consecutive evaluation segments its accuracy fell by 1.8 percentage points, against 3.2 and 3.1 for SVM and Random Forest. A streaming experiment with ADWIN-triggered incremental updates illustrates the adaptation mechanism. The limitations of the evaluation, including a single dataset and the absence of an end-to-end drift-adaptation test of the Autoencoder, are discussed.