10th WorldS4 2026

Authors - Aryan Sharma, Dipali Baviskar
Abstract - Modern computer networks are often equipped with an intrusion detection system (IDS) to detect malicious activities or cyber-attacks. Such a system must have high accuracy on known attacks, and at the same time it must be able to generalise to previously unseen attacks. However, supervised classifiers fail to generalise to new situations because they learn to map input data to output labels under a specific training distribution, and they perform poorly under a different test distribution, which is called distributional shift. In this paper, we propose a gating-based hybrid IDS that combines supervised classifiers with anomaly detectors. The gating network restricts the influence of the anomaly component to the uncertain prediction zone, i.e., the region of the output space where the classifier is uncertain, defined by a probability range of (0.15, 0.75)], and prevents unsupervised noise from affecting the confident supervised decisions. We evaluate the performance of our proposed system on three different test scenarios using the CIC-IDS-2017 dataset. The first test scenario consists of eight known attacks for which we train the classifiers on the corresponding training data, and then we test them on the corresponding test data. The second test scenario is an out-of-distribution stress test, in which we use 99% benign traffic and add DDoS and PortScan attacks to it, and test whether the system is able to detect them. The third test scenario is a zero-day test scenario in which we test the system on a previously unseen SQL Injection attack. Our findings are as follows. First, the Gating Hybrid RF+AE achieves an F1-score of 0.9778 and a precision of 0.9924 on the eight known attacks, which outperforms the standalone RF classifier with an F1-score of 0.9750. Secondly, on the out-of-distribution test scenario, both the RF and GBT classifiers fail to detect the attacks with an F1-score of 0.000, while the Gating Hybrid RF+IF achieves an F1-score of 0.405, which corresponds to a 40.5 percentage-point lift from the F1-score of the anomaly component IF. Thirdly, the Gating Hybrid RF+IF achieves an SQL Injection recall of 47.6% on the zero-day test scenario, while the standalone RF and GBT classifiers achieve an SQL Injection recall of 33.3% on average. All the abovementioned results are supported by 95% Wilson confidence intervals, and we provide root-cause analysis for the extreme results.