Evolutionary adaptation of DLP policies under concept drift in streaming data

Abstract

In modern streaming DLP systems deployed across cloud and hybrid environments, fixed policies degrade rapidly due to concept drift. Operators must simultaneously control the risk-weighted miss cost, limit the false-alarm burden, meet latency SLOs, and keep alert streams stable under tight memory and compute budgets. These competing objectives are not adequately balanced by traditional detectors or manual policy tuning.
We present an online evolutionary controller that casts policy adaptation as constrained multi-objective optimization. The method uses a chromosome encoding with drift-aware exploration–exploitation switching, an archive of vetted policies for warm starts, a compact active mixture, and guarded rollbacks for operational safety. On six streams (synthetic and real), the controller keeps the integrated cost within 0–3.5% of the best baseline (mean absolute gap ≈1.6%), sustains p95 latency below 100 ms, and reduces alert-rate volatility by 50–63% while maintaining comparable or lower false-alarm rates. Two practical sensitivities emerge: the drift-gate threshold governing the exploration/exploitation balance, and short-lived compute bursts immediately after detected changes. Warm starts, a compact mixture, and mutation-budget guards mitigate these effects without sacrificing responsiveness.