Resilience Against Adversarial Concept Drift in Port Scanning: Batch vs. Incremental Paradigms for Green AI

Menendez J.; Aliaga P. · 16th ITU Kaleidoscope Academic Conference - AI and Frontier Technologies for Good, ITU K 2026 - Proceedings (2026) · DOI: 10.23919/ituk70038.2026.11632618

Resumen

The current cybersecurity landscape faces a critical challenge: adversarial actors employing AI-driven 'Low-and-Slow' tactics to induce concept drift, rendering traditional static defenses obsolete. This research moves beyond static model comparison to propose a model-agnostic adaptive defense architecture. This agent-centric framework utilizes a statistical watchdog to detect distributional shifts and autonomously trigger mitigation protocols. Adopting a quantitative approach with an experimental transversal design, we harmonized the UNSW-NB15 and CIC-IDS-2017 datasets (2.23 million records) to simulate a 'Super Evasive' adversarial environment. To validate the architectural universality, the agent was instantiated with two distinct learning paradigms: a static Random Forest (RF) and a dynamic Hybrid CNN-LSTM. Results demonstrate that while the architecture successfully restored security in both scenarios, the operational cost varies drastically. The static paradigm required full retraining (356.57 seconds), creating a dangerous 6-minute window of exposure. in contrast, the dynamic CNN-LSTM leveraged neural plasticity via incremental fine-tuning, achieving recovery in just 2.61 seconds. These findings confirm that the proposed agent achieves a 136.5x speed-up in Time-to-Recovery (TTR), confirming that incremental learning paradigms are indispensable for real-time, resource-efficient defense (green AI) in future digital ecosystems.

Instituciones: Universidad Nacional de Ingeniería