Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{206696,
        author = {Samuel Bright and Prof. Bala Modi},
        title = {Gated Trend Residual Matrix (GTRM): A Confidence-Gated Hybrid Framework for Zero-Day Attack Detection in Network Intrusion Detection Systems},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {2},
        pages = {4075-4081},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=206696},
        abstract = {BACKGROUND Network Intrusion Detection Systems rely heavily on tree-based machine learning models such as: Decision Trees, Random Forests, and Gradient Boosting variants due to their interpretability and strong performance on known attack traffic. However, these models are structurally incapable of extrapolating beyond the boundaries of their training data, making them unreliable against zero-day attacks. Such attacks produce network traffic patterns never previously observed. A deeper and less studied problem termed: cross-modal extrapolation failure, occurs when multiple network traffic feature modalities simultaneously present out-of-distribution values, causing tree-based models to fail at detecting compound novel attack signatures. As such, novel model namely: Gated Trend Residual Matrix was developed to solve the problem with cross-modal extrapolation failures. The training results show superior performance metrics when compared against some other tree-based linear models.
OBJECTIVES: To design a confidence-gated hybrid framework capable of detecting zero-day network attacks]by identifying cross-modal behavioural anomalies rather than relying on known attack signatures [1]. To implement a composite confidence gate combining Mahalanobis distance and ensemble disagreement for real-time out-of-distribution detection. To develop a residual safety valve model trained specifically on distributional boundary samples. To evaluate the proposed framework against five baseline tree-based models using a Leave-One-Attack-Category-Out (LOCO) zero-day simulation protocol on the CIC-IDS2017 benchmark dataset.
METHODOLOGY: A quantitative experimental research design was adopted. The Gated Trend Residual Matrix (GTRM) integrates a 10-tree LightGBM linear model tree ensemble approach as its primary classifier, a composite confidence gate that combines Mahalanobis distance and ensemble disagreement, a multi-level confidence tier system, and a soft gating blending mechanism. It also combines an XGBoost residual safety valve trained on the top 20% most distributionally extreme boundary samples. The framework was evaluated on 2,520,798 cleaned network flow instances from CIC-IDS2017 dataset, across 14 attack categories. It also usied an 80/20 stratified train-test split and a LOCO protocol that withheld each attack category from training in turn to simulate zero-day attack conditions.
RESULT: The GTRM achieved the highest average zero-day detection rate (93.09%) and the lowest average false negative rate (6.91%) among all six evaluated models, outperforming Decision Tree (92.91% DR), Random Forest (91.58% DR), XGBoost (90.82% DR), Linear Model Tree (89.80% DR), and an Autoencoder + XGBoost hybrid (91.23% DR). The GTRM achieved a false positive rate of 0.52% which was 3.1 times lower than the Decision Tree and 8.9 times lower than the standalone Linear Model Tree, and a perfect AUC-ROC of 1.00. The confidence gate raised 36 zero-day uncertainty flags across the most volumetrically complex attack categories, a capability entirely absents from all baseline models. The residual safety valve recovered up to 14.29 percentage points of detection rate lost by the standalone Linear Model Tree on categories exhibiting severe cross-modal extrapolation failure, including DDoS (87.54% to 99.93%) and Infiltration (85.71% to 100.0%).
CONCLUSION
The study concluded that the confidence-gated residual architecture of the GTRM is an effective and deployable approach for improving zero-day attack detection in tree-based Network Intrusion Detection Systems [2]. By detecting cross-modal distributional shift rather than relying on known attack signatures, the GTRM significantly improves detection rate and reduces false negatives on novel attack traffic while providing calibrated uncertainty communication that supports human-in-the-loop security operations.},
        keywords = {Zero-Day Attack Detection, Network Intrusion Detection System, Cross-Modal Extrapolation, Confidence Gating, Mahalanobis Distance, Residual Learning, Tree-Based Machine Learning, CIC-IDS2017},
        month = {July},
        }