2026 International Conference on Networks Computers and Communications (ICNCCom 2026)

Traditional performance metrics such as the F1-score evaluate whether a cyberattack classifier is making correct decisions, but they provide limited insight into how confidently those decisions are being made as threat environments evolve. Consequently, deployed classifiers may experience increasing uncertainty and health deterioration long before substantial performance degradation becomes apparent. To address this challenge, this paper proposes a Prognostics and Health Management (PHM)-oriented framework for online monitoring of cyberattack classifier degradation under zero-day attack conditions. A binary Support Vector Machine (SVM) classifier is trained to distinguish benign from malicious traffic using the CIC-IDS2017 dataset, while previously unseen attack classes are progressively introduced during testing. The proposed approach converts the SVM decision margin of each incoming sample into a risk measure that is recursively accumulated through a SVM Health Index (SHI). Experimental results show that SHI provides a stable and interpretable representation of classifier health, outperforming Cluster Mean Distance, Kolmogorov-Smirnov, and Page-Hinkley monitoring approaches. Moreover, SHI identifies emerging degradation trends despite the classifier maintaining a Macro F1-score above 97%, demonstrating its potential as a leading indicator of degradation for proactive maintenance.

Prognostics and Health Management,Online Health Monitoring,Cyberattack classification,Zero-Day Attacks