SA-SOINN: a self-adaptive neural network for continuous intrusion detection in dynamic environments

Intrusion detection in modern networks remains challenging due to constantly evolving traffic patterns and sophisticated attacks. Conventional Intrusion Detection Systems (IDS), which rely on static models and periodic retraining, struggle to maintain accuracy under non-stationary data distributions. This paper introduces the Self-Adaptive Self-Organizing Incremental Neural Network (SA-SOINN), a continuous learning framework for intrusion detection. SA-SOINN extends the SOINN architecture with a variance-aware controller that profiles incoming data streams in real time and dynamically switches between unsupervised and semi-supervised learning modes. This design enables the model to autonomously adapt its structure and parameters while maintaining a balance between structural stability and adaptive responsiveness. Evaluated on the NSL-KDD and CIC-IDS-2017 datasets in a single-pass learning setting without retraining, SA-SOINN achieves balanced precision and recall, outperforming conventional supervised and unsupervised baselines. Furthermore, its CPU-aware multithreaded design ensures computational efficiency, underscoring its suitability for scalable, real-time anomaly detection in evolving network infrastructures.