Smart Thresholds, Not Retraining: A Lighter Way to Keep IoT Defenses Sharp

Every smart thermostat, industrial sensor, and connected camera in the Internet of Things is a potential doorway for attackers, and the machine-learning models guarding those doorways face a stubborn problem: network traffic never stops changing. A detector trained last month may be quietly mis-calibrated this month as devices join the network, firmware updates shift traffic patterns, and attackers evolve their tactics. The conventional responses—leaving the model frozen or retraining it continuously—each carry a cost. A new study published in Discover Artificial Intelligence proposes a third path: keep the classifier fixed and let the decision boundary itself adapt, using a feedback loop borrowed in spirit from control engineering.

The research, led by Hung-Cuong Nguyen of Hung Vuong University and colleagues at Le Quy Don Technical University and Thai Nguyen University of Information and Communication Technology, addresses what the authors call distribution shift in streaming intrusion detection. Their framework operates on two distinct timescales. At the fast timescale, every incoming network sample is scored using online statistical estimates of feature means and variances, updated through exponential moving averages after each prediction. At the slower timescale, two families of interpretable threshold states—feature-specific abnormality thresholds and a global abnormality gate—are updated only once per non-overlapping batch of 200 samples, using batch-averaged predictive uncertainty and a bounded drift-intensity signal.

The mechanics are deliberately simple. For each of four monitored numerical features, the system computes a Z-score against pre-update statistics, ensuring that a sample never normalizes itself before being judged. A feature is flagged as abnormal when its standardized score exceeds that feature’s current threshold, and the proportion of flagged features forms an abnormality ratio. If that ratio crosses the global gate threshold, the sample is diverted away from the classifier entirely and treated as suspicious. Everything else flows through a lightweight Random Forest that was trained during an initial warm-up phase and never touched again during streaming operation.

What makes the thresholds move is a feedback law with two opposing forces. Predictive uncertainty, measured as the normalized entropy of the classifier’s output, pushes thresholds upward: when the model is confused, the gate becomes less sensitive, preventing ambiguous traffic from triggering excessive alarms. Drift intensity, estimated by comparing a recent window of 100 abnormality ratios against a non-overlapping reference window of 300 through a Hoeffding-type tolerance, pushes thresholds downward: when the traffic distribution genuinely departs from its reference state, sensitivity increases. Both signals are clipped to the interval from zero to one, and the resulting threshold updates are themselves clipped to fixed bounds, so the maximum unconstrained one-batch change is 0.025 for a feature threshold and 0.006 for the global gate.

The authors are careful about what this boundedness does and does not prove. The mathematical analysis establishes that threshold states and their one-step changes remain finite, but it explicitly does not establish convergence to an optimal boundary, closed-loop stability in a formal control-theoretic sense, or robustness against an adversary who deliberately manipulates the feedback sequence. In fact, the paper identifies a genuine security limitation: sustained traffic that repeatedly produces high uncertainty without a strong distribution-change signal can drive the detector toward a less sensitive operating point until clipping intervenes. The team treats this desensitization risk as an honest caveat rather than glossing over it.

The experimental evaluation is unusually thorough for this class of work. The framework was tested on three public IoT intrusion-detection benchmarks—RT-IoT2022, IoTID20, and CICIoT2023—with 46,000 streaming observations per dataset processed as 230 batches, repeated across five random seeds for a total of fifteen paired runs per comparison. Against Adaptive Random Forest, the strongest baseline representing continuous model-level adaptation, the proposed method scored an overall F1 of 0.9387 versus 0.9407. That small accuracy gap of roughly 0.21 percentage points was statistically detectable, and the authors decline to claim equivalence. What the fixed-classifier approach bought instead was a lower false-positive rate of 0.0312 versus 0.0349, a 24.5 percent reduction in temporal F1 variance, and a total processing cost of 2.79 milliseconds per sample versus 4.15—a 32.7 percent reduction overall and a 64.7 percent reduction in update time.

Perhaps the most striking result comes from the leave-one-attack-family-out evaluation, where entire attack categories—grouped DDoS for RT-IoT2022, Mirai for IoTID20, and Spoofing for CICIoT2023—were withheld from training entirely. Here the adaptive abnormality gate achieved an F1 of 0.800 with a false-positive rate of 0.031, outperforming fixed statistical baselines such as rolling Z-score rules, median absolute deviation, and interquartile-range detectors. This matters because conventional closed-set classifiers can only assign labels they saw during training, whereas new IoT attack families emerge constantly. The gate reframes the problem: rather than forcing unknown traffic into predefined categories, it simply asks whether a sample deviates from learned statistical patterns, with sensitivity that adjusts as the stream evolves.

A controlled-stream analysis added a stress-test dimension, imposing a predefined distribution shift at batch 120 and tracking how each method responded. The proposed method’s threshold trajectories revealed smooth, bounded evolution driven by the uncertainty component of the feedback loop, and a criterion-based recovery measure quantified how many batches were needed for F1 to return to at least 95 percent of its pre-shift level. An ablation study disentangled the contributions of the adaptive gate, the adaptive feature thresholds, and the drift signal, showing that the full configuration achieved the best combination of F1, false-positive control, and temporal stability, while no single component dominated every metric. A sensitivity analysis over a grid of feedback coefficients confirmed that the nominal settings represent a stability-oriented operating point rather than a universally optimal choice.

The authors frame their contribution not as a replacement for model adaptation but as a distinct operating point in an accuracy–stability–efficiency trade-off. For resource-constrained edge devices, where GPU acceleration is unavailable and every millisecond counts, a detector that sacrifices a sliver of peak accuracy in exchange for fewer false alarms, smoother behavior over time, and dramatically lower update cost may be exactly the right bargain. The explicit threshold states also offer a form of operational transparency: an operator can inspect how gate sensitivity evolves and, when the drift detector remains silent, know that observed threshold movement is attributable to uncertainty alone. The team acknowledges the limits of this transparency—it is not causal feature explanation—and points toward future work on feature-specific feedback controllers, hybrid schemes that trigger selective model updating under sustained change, and explicit adversarial evaluation. For now, the study offers a compelling demonstration that sometimes the smartest way to adapt a defender is not to rebuild it, but to nudge the line it draws.

Subject of Research: Feedback-guided decision-boundary adaptation for stable streaming intrusion detection in Internet of Things networks under distribution shift

Article Title: Feedback guided decision boundary adaptation for stable IoT intrusion detection under distribution shift

Article References: Nguyen, H.-C., Ta, T. M., Dao, N.-T., Nguyen, Q.-H., & Phung, T.-N. (2026). Feedback guided decision boundary adaptation for stable IoT intrusion detection under distribution shift. Discover Artificial Intelligence, 6(1), Article 1394. https://doi.org/10.1007/s44163-026-02370-1

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02370-1

Keywords: Internet of Things, intrusion detection, distribution shift, concept drift, adaptive thresholding, decision boundary, feedback control, machine learning, streaming data, anomaly detection, cybersecurity, edge computing