Counterfactual Causal Graph Memory with Dual-Drift Attribution and Trust-Gated Continual Learning for Zero-Day Intrusion Detection

Abstract

Network intrusion detection systems are increasingly asked to operate in an open, non-stationary world in which genuinely novel zero-day attacks appear and the benign traffic environment continually drifts. Signature and closed-set classifiers fail on unseen attacks because they confidently map every flow to a known class, and naive online learners that adapt to streaming traffic risk silently absorbing the very novel attacks they should flag. This paper presents a framework that unifies robust zero-day detection with safe continual adaptation for the Internet of Things(CausalTwin-IDS). Each network flow is encoded through two behavioral streams, a flow-statistics stream and an Internet-Protocol interaction-graph stream, into a class-relevant causal representation, while contextual attributes are routed to a separate nuisance representation. A counterfactual intervention that permutes nuisance factors across device-group environments and enforces invariance of the causal code and its prediction makes the attack representation robust to benign environment change rather than merely correlated with it. Known attack families are summarized by a multi-prototype memory, and zero-day flows are detected by a source-only split-conformal score that fuses prototype distance, free energy, tri-view graph disagreement, and predictive entropy, with a finite-sample false-alarm guarantee obtained without ever observing a zero-day sample. A dual-drift attribution module separates benign environment drift from genuine attack-causal drift using two kernel maximum-mean-discrepancy signals, and a trust gate admits an online prototype update only when a flow is confidently known, tri-view consistent, and accompanied by attack-rather-than-environment drift, structurally preventing zero-day contamination of the memory. On the real ToN-IoT network benchmark with four attack families held out as zero-day, CausalTwin-IDS attains an H-score of 87.9%, a zero-day detection area under the receiver operating characteristic curve of 0.923, and an open-set classification-rate area of 0.798, exceeding softmax, OpenMax, energy, and autoencoder baselines, while its trust gate retains 90.8% known-attack accuracy under 50% zero-day contamination where a naive updater collapses to 64.1%. Every reported number is produced by an executed run in which zero-day labels are used only for final evaluation, never for training, calibration, or adaptation.