Adaptive and uncertainty-aware intrusion detection with hybrid meta-learning under proxy-adversarial exposure

Enterprise communication networks face adaptive and non-stationary cyber threats that can evade conventional intrusion detection systems (IDS). Static deep learning models achieve high benchmark accuracy but degrade under distribution shifts and adversarial exposure. We propose an uncertainty-aware IDS framework for flow-based monitoring that integrates multi-agent reinforcement learning (MARL), hybrid statistical–neural meta-learning, and explicit uncertainty quantification. An adaptive proxy adversary, a synthetic feature-space agent, co-evolves with the defender in a staged curriculum to generate challenging scenarios, without requiring fully realistic attack behaviour. When the defender’s confidence falls below a calibrated threshold, flows are deferred to a prototype-based meta-learner that performs few-shot adaptation to emerging attack patterns. A dedicated uncertainty estimator regulates deferral frequency to meet real-time constraints. Experiments on CIC-IDS2017 and CSE-CIC-IDS2018 show improved robustness under proxy-adversarial exposure and cross-dataset distribution shifts. While peak accuracy is slightly lower than static deep models, the framework achieves greater resilience, interpretable decision support, and millisecond-level latency, demonstrating practical readiness for deployment in enterprise networks.