SAGE (Sample-Aware Guarding Engine) builds on our earlier DYNAMITE work to dynamically pick the best defense against adversarial attacks on ML-based intrusion detection. It couples active learning (EOAL) with targeted data reduction to label only the most informative samples, then trains a second-level selector to route each adversarial input to the strongest defense. In experiments across multiple IDS datasets, SAGE improves average F1 by about 201% over prior defenses, stays within 3.8% of an Oracle selector, and cuts computation by up to 29×, while remaining robust to unseen attacks.
- Please follow the instruction: README