  The network security analyzers use intrusion detection systems (IDSes) to
distinguish malicious traffic from benign ones. The deep learning-based IDSes
are proposed to auto-extract high-level features and eliminate the
time-consuming and costly signature extraction process. However, this new
generation of IDSes still suffers from a number of challenges. One of the main
issues of an IDS is facing traffic concept drift which manifests itself as new
(i.e., zero-day) attacks, in addition to the changing behavior of benign
users/applications. Furthermore, a practical DL-based IDS needs to be conformed
to a distributed architecture to handle big data challenges.
  We propose a framework for adapting DL-based models to the changing
attack/benign traffic behaviors, considering a more practical scenario (i.e.,
online adaptable IDSes). This framework employs continual deep anomaly
detectors in addition to the federated learning approach to solve the
above-mentioned challenges. Furthermore, the proposed framework implements
sequential packet labeling for each flow, which provides an attack probability
score for the flow by gradually observing each flow packet and updating its
estimation. We evaluate the proposed framework by employing different deep
models (including CNN-based and LSTM-based) over the CIC-IDS2017 and
CSE-CIC-IDS2018 datasets. Through extensive evaluations and experiments, we
show that the proposed distributed framework is well adapted to the traffic
concept drift. More precisely, our results indicate that the CNN-based models
are well suited for continually adapting to the traffic concept drift (i.e.,
achieving an average detection rate of above 95% while needing just 128 new
flows for the updating phase), and the LSTM-based models are a good candidate
for sequential packet labeling in practical online IDSes (i.e., detecting
intrusions by just observing their first 15 packets).
