  Network attacks have became increasingly more sophisticated and stealthy due
to the advances in technologies and the growing sophistication of attackers.
Advanced Persistent Threats (APTs) are a type of attack that implement a wide
range of strategies to evade detection and be under the defence radar. Software
Defined Network (SDN) is a network paradigm that implements dynamic
configuration by separating the control plane from the network plane. This
approach improves security aspects by facilitating the employment of network
intrusion detection systems. Implementing Machine Learning (ML) techniques in
Intrusion Detection Systems (IDSs) is widely used to detect such attacks but
has a challenge when the data distribution changes. Concept drift is a term
that describes the change in the relationship between the input data and the
target value (label or class). The model is expected to degrade as certain
forms of change occur. In this paper, the primary form of change will be in
user behaviour (particularly changes in attacker behaviour). It is essential
for a model to adapt itself to deviations in data distribution. SDN can help in
monitoring changes in data distribution. This paper discusses changes in
stealth attacker behaviour. The work described here investigates various
concept drift detection algorithms. An incremental hybrid adaptive Network
Intrusion Detection System (NIDS) is proposed to tackle the issue of concept
drift in SDN. It can detect known and unknown attacks. The model is evaluated
over different datasets showing promising results.
