Dynamic Adaptation of ML Algorithms for Real-time Resilience (Ensemble Learning Enhanced with LLM-Based Interpretation)

Sammanfattning

The growing complexity and volume of cyber threats necessitate adaptive Intrusion Detection Systems (IDS) capable of real-time learning. Traditional IDS models rely on static datasets and offline training, making them ineffective against zero-day attacks and dynamic threats. To address these limitations, this study explores the integration of ensemble learning and online learning techniques augmented by a lightweight retrieval-augmented Large Language Model (LLM) to enhance IDS adaptability, detection accuracy, and interpretability. the research problem this study aims to address is: In resource-constrained settings, online learning algorithms need to be effectively coupled with light-weight LLMs to build an interpretable online intrusion detection system that adapts in real time, improves detection and adaptation of unknown/novel threats, and provides human-understandable explanations while reducing retraining costs. The proposed model combines multiple online classifiers, Adaptive Random Forest, Online k-Nearest Neighbors, and Online Naïve Bayes, within a stacking-based ensemble, while the LLM acts as a second-stage verifier that filters potential false positives and generates concise natural-language explanations. This architecture supports continuous model updates without full retraining, allowing the IDS to adapt dynamically to evolving attack patterns. Evaluated on the CIC-IDS2017 dataset, the system attains 95.99% precision, 99.14% recall, and a 97.54% F1-score for known attacks when the LLM module is enabled. For previously unseen attacks, the IDS achieves 96.29% precision, 92.15% recall, and a 94.17% F1-score after online adaptation. With more features included in RAG, it achieves better performance in recall with 93.81% precision, 95.27% recall and 94.55% F1 score. These results confirm its ability to learn from new threat signals in real time. These findings demonstrate that the proposed LLM-enhanced IDS meets key requirements for real-time learning, high detection performance, and human-readable explanations, offering a practical path toward more resilient cybersecurity defenses in dynamic network environments.