Temporal Analysis Framework for Intrusion Detection Systems: A Novel Taxonomy for Time-Aware Cybersecurity

2025-11-05

AI Summary

Existing network intrusion detection systems (IDS) predominantly focus on late-stage attack behaviors, hindering early threat identification and proactive defense. Method: This paper introduces the first time-aware NIDS analysis framework, establishing a novel taxonomy grounded in temporal dimensions—from static flow analysis to multi-window sequential modeling—and systematically reviewing 40+ recent studies via MITRE ATT&CK tactic mapping. Contribution/Results: We uncover a systematic bias in mainstream datasets toward post-compromise attack stages, limiting early detection. Empirical evaluation demonstrates that time-aware methods comprehensively cover all ATT&CK phases—from reconnaissance and resource development to impact—significantly enhancing detection capability at earlier stages. Our work establishes a theoretical foundation and an extensible temporal analysis paradigm for cross-phase, forward-looking defense.

Technology Category

• Data Mining & Knowledge Management: Mining of Spatial, Temporal or Spatio-Temporal Data
• Machine Learning: Time-Series/Data Streams
• Knowledge Representation and Reasoning: Geometric, Spatial, and Temporal Reasoning

Application Category

• Web Mining and Content Analysis: Models for Web evolution
• Social Networks and Social Media: Fairness and bias in social network and social media analysis
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphs

Abstract

Most intrusion detection systems still identify attacks only after significant damage has occurred, detecting late-stage tactics rather than early indicators of compromise. This paper introduces a temporal analysis framework and taxonomy for time-aware network intrusion detection. Through a systematic review of over 40 studies published between 2020 and 2025, we classify NIDS methods according to their treatment of time, from static per-flow analysis to multi-window sequential modeling. The proposed taxonomy reveals that inter-flow sequential and temporal window-based methods provide the broadest temporal coverage across MITRE ATT&CK tactics, enabling detection from Reconnaissance through Impact stages. Our analysis further exposes systematic bias in widely used datasets, which emphasize late-stage attacks and thus limit progress toward early detection. This framework provides essential groundwork for developing IDS capable of anticipating rather than merely reacting to cyber threats, advancing the field toward truly proactive defense mechanisms.

Problem

• Developing time-aware intrusion detection to identify early attack indicators
• Classifying NIDS methods by temporal analysis from static to sequential modeling
• Addressing dataset bias limiting progress toward proactive cyber threat detection

Innovation

• Introduces temporal analysis framework for time-aware intrusion detection
• Classifies NIDS methods by time treatment from static to sequential
• Uses multi-window modeling for broad MITRE ATT&CK tactic coverage