CALIBURN: Operationally Calibrated Streaming Intrusion Detection with Regime-Dependent Conformal Risk Control

A new streaming intrusion-detection pipeline called CALIBURN sets alerting thresholds directly from operator budgets and cost constraints, bypassing the label-dependent tuning that hampers production deployments, according to a preprint posted to arXiv on 23 May 2026 [1]. The system, detailed in a paper by Michel Youssef, integrates five layers on a single streaming substrate: truncated Bayesian online change-point detection, isotonic calibration of the posterior to a conditional attack probability, cost-sensitive thresholding, a Conformal Risk Control (CRC) wrapper, and multi-window burn-rate alerting drawn from Site Reliability Engineering practice [1][2]. Each component is established; the contribution is their integration and a finding that calibration and conformal risk control behave differently depending on attack prevalence [2]. CALIBURN was evaluated across three regimes with sharply different attack densities: LITNET-2020 at 5.2 percent, CICIDS2017 at 22 percent, and UNSW-NB15 at 64 percent [2]. In the rare-attack regime it targets, the pipeline reached an area under the precision-recall curve of 0.943, outperforming the best streaming baseline by a factor of 2.21 and the best batch reference by a factor of 4.12 [2]. Isotonic calibration alone reduced the Brier score by 30 percent [2]. The paper also identifies two failure modes that collapse conformal alerting at very small alpha: a theoretical CRC overshoot of 2B/(n0+1) and an empirical-density degeneracy, both proposed as pre-deployment checks [2]. A TTL-feature ablation confirmed that the performance collapse at high prevalence is intrinsic to streaming rather than an artifact of the datasets [2]. arXiv, where the preprint appeared, is an open-access repository that hosts e-prints across physics, computer science, and other fields after moderation but without peer review [6]. The platform passed two million articles by the end of 2021 and currently receives roughly 24,000 submissions per month [6]. The CALIBURN paper’s code and artifacts are released under the Apache 2.0 license and deposited with Zenodo [2].