Machine learning-based intrusion detection systems (IDS) deployed in real-world environments frequently degrade due to concept drift, where evolving traffic patterns invalidate assumptions learned during training. This challenge is especially pronounced in Internet of Things (IoT) environments, where device behavior changes over time due to user interaction, firmware updates, and emerging attack strategies. Prior work introduced FIRCE, a framework that integrates conformal evaluation into streaming IDS pipelines to enable uncertainty-aware drift detection and adaptive retraining. In this journal extension, we present FADES, a framework for adaptive drift estimation that generalizes drift monitoring beyond prediction-space uncertainty by supporting both conformal evaluation and representation-space detectors within a unified streaming architecture. FADES incorporates multiple conformal evaluation variants, including Approximate Cross-Conformal Evaluation, which preserves the statistical structure of cross-conformal evaluation while eliminating repeated model training, as well as an Adaptive Chunking Controller that dynamically balances detection responsiveness and computational cost. We extend prior work through three major contributions: (i) a variance-aware evaluation protocol comprising 375 simulations across multiple seeds and runs, (ii) integration of a contrastive autoencoder-based detector to enable direct comparison between prediction-space and representation-space drift detection, and (iii) expanded evaluation across in-domain and cross-dataset transfer settings using UNSW-NB15, CICIDS2018, and a real-world IoT testbed. Approx-CCE achieves performance comparable to standard cross-conformal evaluation across hundreds of simulations, providing empirical evidence that the statistical benefits of CCE derive primarily from its disjoint calibration partition structure rather than fold-specific model diversity, a finding with implications for conformal evaluation in repeated recalibration settings more broadly. In contrast, representation-space drift detection via CADE incurs substantial computational cost under repeated retraining, limiting its practicality in streaming settings. These findings demonstrate that conformal evaluation provides a statistically grounded and computationally efficient foundation for real-time drift-aware intrusion detection, and that FADES enables flexible, unified evaluation of drift detection strategies under realistic deployment conditions.
Barrett et al. (Thu,) studied this question.