Candidate Comparability Before Promotion: Conditional Validation in Adaptive Network Intrusion Detection

Adaptive network intrusion detection systems retrain classifiers after drift alarms, but an alarm detects change; it does not establish that a challenger should replace the deployed incumbent. Promotion is security-relevant because it changes the model responsible for subsequent attack detection,...