An Heuristic and Explainable Unsupervised Concept Drift Detector

In dynamic and interconnected environments, where smart systems continuously generate evolving network traffic, Intrusion Detection Systems (IDSs) based on Machine Learning (ML) are a core component of modern security infrastructures. However, these systems are particularly susceptible to concept drift, where changes in data distributions gradually degrade model performance. Understanding and detecting these shifts is critical, not only to maintain detection accuracy but also to identify which features drive performance degradation. This paper proposes an unsupervised and explainable concept drift detector for IDSs. Unlike supervised error-rate concept drift detectors, the proposed system does not rely on ground-truth labels, instead leveraging the outputs of the underlying ML model to detect drift and quantify feature-level contributions over time. Experimental results show that the proposed system reliably identifies concept drift, provides stable and prolonged detections, and maintains model-agnostic applicability in complex smart environments.