ADAWU-IDS: a dynamic adaptive weight update mechanism for concept drift-aware network intrusion detection systems

Network intrusion detection systems deployed in dynamic environments are vulnerable to concept drift, where changes in traffic distributions can degrade detection performance over time. This paper proposes ADAWU-IDS, an interpretable and validation-calibrated drift-response framework for concept drift-aware network intrusion detection. The framework combines Multi-Scale Drift Index (MSDI)-based drift-severity estimation, Adaptive Drift-Aware Weight Updating (ADAWU), and validation-selected response control within a chronological evaluation pipeline. Unlike fixed-response adaptive designs, ADAWU-IDS does not assume that stronger intervention is always beneficial. Candidate response configurations are calibrated on a held-out validation stream and then fixed before final chronological testing. MSDI is used as an auxiliary drift-severity signal rather than as a standalone binary drift detector, while ADAWU adjusts ensemble contributions according to recent predictive behavior, drift severity, and temporal relevance. Under a chronological CICIDS2017 protocol, the validation-selected configuration, denoted as ADAWU-IDS-Calibrated, shows modest improvements over Static LSTM in Weighted F1 and Attack F1. However, these improvements are not statistically significant at the p< 0.05 level, and the calibrated framework does not consistently improve Attack Recall or reduce the false-negative rate. Classical online ensemble baselines, including Dynamic Weighted Majority, Online Bagging, and Leveraging Bagging, achieve stronger raw predictive performance under the same protocol. The ablation results show that mandatory hierarchical retraining can over-adapt to short-term chunk behavior and harm attack detection. Therefore, hierarchical response is reformulated as an optional response action selected through validation calibration. Overall, ADAWU-IDS provides a transparent and configurable framework for analyzing drift-response behavior in intrusion detection, with practical value in drift-severity interpretation, response calibration, and component-level diagnosis. The evaluation reports paired statistical tests, ablation analysis, segment-wise drift-window results, computational cost, and drift-detection diagnostics. The implementation is available at: https://anonymous.4open.science/r/ADAWU-IDS-800B.