FlagThis

Abstract

Streaming network intrusion detection systems must process flows continuously under bounded memory, yet most leave alerting-threshold selection as a post-hoc tuning problem that is incompatible with production deployment, where operators commit in advance to alert budgets, misclassification costs, and Service Level Objectives. We present CALIBURN, a streaming alerting pipeline that derives its decision threshold from these operational inputs rather than from a label-dependent validation search. CALIBURN composes, on a single streaming substrate, truncated Bayesian online change-point detection, isotonic calibration of the change-point posterior to an empirical conditional attack probability P(yt = 1 | st), cost-sensitive thresholding from operator-specified costs, a Conformal Risk Control (CRC) wrapper that converts an alert budget ε into a threshold with marginal false-positive validity under exchangeability, and multi-window burn-rate alerting adapted from Site Reliability Engineering practice. Each component is individually established; the contribution is their integration and a falsifiable empirical finding about that integration: the operational behaviour of calibration and conformal risk control is strongly regime-dependent across attack prevalence. Evaluating across three prevalence regimes LITNET-2020 (5.2 percent), CICIDS2017 (22.06 percent), and UNSW-NB15 (64 percent) we show that CALIBURN achieves AUC-PR 0.943 in the rare-attack regime it targets, outperforming the best streaming baseline by 2.21 and the best batch reference by 4.12, with isotonic calibration reducing Brier score by 30 percent; that it remains the strongest streaming method at moderate prevalence while a batch density method overtakes it; and that all streaming methods, including CALIBURN, converge toward the prevalence floor under base-rate inversion. A TTL-feature ablation on UNSW-NB15 confirms this high-prevalence collapse is intrinsic to the streaming setting rather than a removable dataset artifact. We additionally characterise two distinct mechanisms a theoretical CRC overshoot 2B / (n0 +1) and an empirical-density degeneracy by which conformal alerting collapses at very small ε , and propose both as explicit predeployment checks. All code, configurations, and experimental artifacts are released under Apache 2.0 (Zenodo DOI 10.5281/zenodo.20074590) for full reproducibility.