LEAD-Drift: Real-time and Explainable Intent Drift Detection by Learning a Data-Driven Risk Score

• URL: http://arxiv.org/abs/2602.13672v1
• Date: Sat, 14 Feb 2026 08:46:12 GMT
• Title: LEAD-Drift: Real-time and Explainable Intent Drift Detection by Learning a Data-Driven Risk Score
• Authors: Md. Kamrul Hossain, Walid Aljoby,
• Abstract summary: "Intent drift" is where a network deviates from its intended goal, often leading to silent failures.<n>We propose LEAD-Drift, a framework that detects intent drift in real time to enable proactive failure prevention.<n>Our evaluation shows LEAD-Drift provides significantly earlier warnings, improving the average lead time by 7.3 minutes.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Intent-Based Networking (IBN) simplifies network management, but its reliability is challenged by "intent drift", where the network's state gradually deviates from its intended goal, often leading to silent failures. Conventional approaches struggle to detect the subtle, early stages of intent drift, raising alarms only when degradation is significant and failure is imminent, which limits their effectiveness for proactive assurance. To address this, we propose LEAD-Drift, a framework that detects intent drift in real time to enable proactive failure prevention. LEAD-Drift's core contribution is reformulating intent failure detection as a supervised learning problem by training a lightweight neural network on fixed-horizon labels to predict a future risk score. The model's raw output is then smoothed with an Exponential Moving Average (EMA) and passed through a statistically tuned threshold to generate robust, real-time alerts. Furthermore, we enhance the framework with two key features for operational intelligence: a multi-horizon modeling technique for dynamic time-to-failure estimation, and per-alert explainability using SHAP to identify root-cause KPIs. Our evaluation on a time-series dataset shows LEAD-Drift provides significantly earlier warnings, improving the average lead time by 7.3 minutes (+17.8\%) compared to a distance-based baseline. It also reduces alert noise by 80.2\% compared to a weighted-KPI heuristic, with only a minor trade-off in lead time. These results demonstrate that LEAD-Drift as a highly effective, interpretable, and operationally efficient solution for proactive network assurance in IBN.

Related papers

• YOLO-IOD: Towards Real Time Incremental Object Detection [57.862742461237055]
  We introduce YOLO-IOD, a real-time Incremental Object Detection (IOD) framework that is constructed upon the pretrained YOLO-World model.<n>YOLO-IOD encompasses three principal components: 1) Conflict-Aware Pseudo-Label Refinement (CPR), which mitigates the foreground-background confusion.<n>We also introduce Cross-Stage Asymmetric Knowledge Distillation (CAKD), which addresses the misaligned knowledge distillation conflict.
  arXiv  Detail & Related papers  (2025-12-28T15:35:26Z)
• A Secured Intent-Based Networking (sIBN) with Data-Driven Time-Aware Intrusion Detection [2.7273279761148967]
  This study proposes a secured IBN (sIBN) system with data driven intrusion detection method designed to secure user intent from adversarial tampering.<n>The proposed intent intrusion detection system uses a ML model applied for network behavioral anomaly detection to reveal temporal patterns of intent tampering.
  arXiv  Detail & Related papers  (2025-11-07T10:28:01Z)
• ResAD: Normalized Residual Trajectory Modeling for End-to-End Autonomous Driving [64.42138266293202]
  ResAD is a Normalized Residual Trajectory Modeling framework.<n>It reframes the learning task to predict the residual deviation from an inertial reference.<n>On the NAVSIM benchmark, ResAD achieves a state-of-the-art PDMS of 88.6 using a vanilla diffusion policy.
  arXiv  Detail & Related papers  (2025-10-09T17:59:36Z)
• Dynamic Temporal Positional Encodings for Early Intrusion Detection in IoT [3.6686692131754834]
  The rapid expansion of the Internet of Things (IoT) has introduced significant security challenges.<n>Traditional Intrusion Detection Systems (IDS) often overlook the temporal characteristics of network traffic.<n>We propose a Transformer-based Early Intrusion Detection System (EIDS) that incorporates dynamic temporal positional encodings.
  arXiv  Detail & Related papers  (2025-06-22T17:56:19Z)
• Probing Deep into Temporal Profile Makes the Infrared Small Target Detector Much Better [63.567886330598945]
  Infrared small target (IRST) detection is challenging in simultaneously achieving precise, universal, robust and efficient performance.<n>Current learning-based methods attempt to leverage more" information from both the spatial and the short-term temporal domains.<n>We propose an efficient deep temporal probe network (DeepPro) that only performs calculations in the time dimension for IRST detection.
  arXiv  Detail & Related papers  (2025-06-15T08:19:32Z)
• ORCHID: Streaming Threat Detection over Versioned Provenance Graphs [11.783370157959968]
  We present ORCHID, a novel Prov-IDS that performs fine-grained detection of process-level threats over a real time event stream. ORCHID takes advantage of the unique immutable properties of a versioned provenance graphs to iteratively embed the entire graph in a sequential RNN model. We evaluate ORCHID on four public datasets, including DARPA TC, to show that ORCHID can provide competitive classification performance.
  arXiv  Detail & Related papers  (2024-08-23T19:44:40Z)
• Uncertainty-Aware Deep Attention Recurrent Neural Network for Heterogeneous Time Series Imputation [0.25112747242081457]
  Missingness is ubiquitous in multivariate time series and poses an obstacle to reliable downstream analysis. We propose DEep Attention Recurrent Imputation (Imputation), which jointly estimates missing values and their associated uncertainty. Experiments show that I surpasses the SOTA in diverse imputation tasks using real-world datasets.
  arXiv  Detail & Related papers  (2024-01-04T13:21:11Z)
• PREM: A Simple Yet Effective Approach for Node-Level Graph Anomaly Detection [65.24854366973794]
  Node-level graph anomaly detection (GAD) plays a critical role in identifying anomalous nodes from graph-structured data in domains such as medicine, social networks, and e-commerce. We introduce a simple method termed PREprocessing and Matching (PREM for short) to improve the efficiency of GAD. Our approach streamlines GAD, reducing time and memory consumption while maintaining powerful anomaly detection capabilities.
  arXiv  Detail & Related papers  (2023-10-18T02:59:57Z)
• Free Lunch for Generating Effective Outlier Supervision [46.37464572099351]
  We propose an ultra-effective method to generate near-realistic outlier supervision. Our proposed textttBayesAug significantly reduces the false positive rate over 12.50% compared with the previous schemes.
  arXiv  Detail & Related papers  (2023-01-17T01:46:45Z)
• ARLIF-IDS -- Attention augmented Real-Time Isolation Forest Intrusion Detection System [0.0]
  Internet of Things and Software Defined Networking leverage lightweight strategies for the early detection of DDoS attacks. It is essential to have a fast and effective security identification model based on low number of features. In this work, a novel Attention-based Isolation Forest Intrusion Detection System is proposed.
  arXiv  Detail & Related papers  (2022-04-20T18:40:23Z)
• Uncertainty-Aware Deep Calibrated Salient Object Detection [74.58153220370527]
  Existing deep neural network based salient object detection (SOD) methods mainly focus on pursuing high network accuracy. These methods overlook the gap between network accuracy and prediction confidence, known as the confidence uncalibration problem. We introduce an uncertaintyaware deep SOD network, and propose two strategies to prevent deep SOD networks from being overconfident.
  arXiv  Detail & Related papers  (2020-12-10T23:28:36Z)
• Bayesian Optimization with Machine Learning Algorithms Towards Anomaly Detection [66.05992706105224]
  In this paper, an effective anomaly detection framework is proposed utilizing Bayesian Optimization technique. The performance of the considered algorithms is evaluated using the ISCX 2012 dataset. Experimental results show the effectiveness of the proposed framework in term of accuracy rate, precision, low-false alarm rate, and recall.
  arXiv  Detail & Related papers  (2020-08-05T19:29:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.