On the Evaluation of Spiking Neural Network Configurations for Network Intrusion Detection

2026-05-31

AI Summary

This study addresses the challenge of deploying conventional deep learning models on edge or neuromorphic hardware by systematically evaluating the combined performance of nine spiking neuron models and three spike encoding schemes across four standard intrusion detection datasets: NSL-KDD, KDDCup99, CIC-IDS2017, and CTU-13. Using the snntorch framework with minimal preprocessing and raw inputs, the work presents the first quantitative analysis demonstrating that spike encoding exerts a significantly greater influence on model performance than neuron type. The optimal configuration—LeakyParallel neurons paired with latency encoding—achieves an average accuracy of 92.11%, a macro F1-score of 0.80, and a remarkably low false positive rate of 2.01%, while also delivering the fastest inference speed and near-perfect detection on certain datasets.

Abstract

Network intrusion detection is a core component of modern cybersecurity infrastructure, yet the deep learning models that dominate the field are computationally demanding, motivating interest in lightweight alternatives suited to edge and neuromorphic deployment. Spiking Neural Networks (SNNs) are therefore a natural candidate, but their design space, spanning the choice of neuron model and spike encoding scheme, remains poorly characterized for intrusion detection. We bridge this gap by using a controlled ablation study using 9 neurons coupled with 3 spike encoding schemes, making 27 variants, all implemented on snntorch evaluated over raw inputs with limited preprocessing on four benchmark datasets (NSL KDD, KDDCup99, CIC-IDS2017, and CTU-13) with 5 seeds. We find that spike encoding scheme is a better determinant for detection quality than the neuron model, where rate and delta spike encodings perform worse than latency encoding over the sweep. The LeakyParallel neuron with latency encoding performed the best overall, averaging at 92.11% accuracy and 0.80 macro- F1 at a rate of 2.01% false positives averaged over all 4 datasets, with accuracy close to perfect for CIC-IDS2017 and CTU-13, and also performed the fastest on inference. These results highlight the potential of SNNs as a viable alternative to traditional methods of intrusion detection when considering low-latency or resource-constrained deployments.

Problem

• Spiking Neural Networks
• Network Intrusion Detection
• Neuron Model
• Spike Encoding
• Cybersecurity

Innovation

• Spiking Neural Networks
• Network Intrusion Detection
• Spike Encoding
• Neuromorphic Computing
• Ablation Study