PaperlayerView exact revision on arXiv

Source-linked AI summary

Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams

Dalton Diez, Peyton Andras, Max Shroyer, James Ghawaly Jr

arXiv:2609.15772v1cs.NEcs.AIcs.CR

TL;DR

Cyber streams combine categorical identifiers, irregular timing, and local context, which conventional encodings and IDS pipelines do not directly preserve for event-native SNN processing. The paper introduces a sparse symbolic-temporal event encoding and evaluates compact recurrent SNNs on Network and CAN IDS. Under µCaspian-aligned constraints, the reported hybrid detection metric is at least 0.980 across both domains.

  • Problem

    Cyber streams carry symbolic attributes, irregular timing, and local context, while conventional IDS pipelines preprocess events and prior SNN IDS approaches generally start from engineered numeric features or converted networks.

    Source: §I · p. 1, E. Representation Gap · p. 2

  • Method

    The framework maps raw events at arrival to sparse spike-compatible inputs using semantic identity, local frequency context, and inter-event timing.

    Source: §I · p. 1, §IX · p. 9

  • Results

    Jhybrid ≥0.980 across packet-level Network IDS and message-level CAN IDS was achieved by compact recurrent SNNs under edge-aligned µCaspian constraints.

    Source: §IX · p. 9

  • Takeaways & Limitations

    The reported results show that edge-aligned SNNs can perform direct monitoring on native cyber event streams using the proposed representation.

    Source: §IX · p. 9

    The evaluations use public benchmark datasets and simulated hardware constraints, so they do not capture all deployment challenges.

    Source: §VIII · p. 9

Abstract

from arXiv · show

Spiking neural networks (SNNs) have shown promise for sparse, event-driven computation through stateful processing that is naturally compatible with low-power edge hardware. These properties align with cyber monitoring, where data arrives asynchronously, and malicious behavior often emerges through temporal patterns across event sequences. However, cyber streams are not composed solely of continuous numeric signals: their informative structure is also carried by categorical identifiers, irregular timing, and local behavioral context. Traditional rate- and population-based spike encodings are not naturally suited to these heterogeneous semantics, while conventional intrusion detection system (IDS) pipelines typically resolve the mismatch by converting raw events into flows, fixed aggregation windows, or dense tensors. Although useful for conventional classifiers, these transformations introduce buffering latency, obscure native temporal structure, and weaken the computational advantages of event-driven neuromorphic processing. We introduce an event-native symbolic-temporal spike encoding framework that maps heterogeneous cyber events directly into sparse, spike-compatible inputs. By assigning encoding roles to semantic identity, local frequency context, and inter-event timing, the framework preserves categorical semantics and temporal dynamics. We validate the approach on packet-level Network IDS and extend it to message-level CAN IDS, using both domains to evaluate whether the encoding exposes usable structure for recurrent SNNs operating directly on native event streams. Under edge-oriented, $\mu$Caspian-aligned hardware constraints, compact recurrent SNNs achieve strong anomaly detection performance, with an operational hybrid metric ($J_{hybrid}$) of 0.987 on Network IDS and 0.980 on CAN IDS.

I. Introduction

Cyber streams combine categorical fields, irregular timing, and sequential context, but conventional encodings and IDS pipelines do not directly preserve these semantics for SNNs. The paper proposes an event-native encoding and evaluates it across packet-level Network IDS and message-level CAN IDS.

I. Introduction

  • Cyber events carry symbolic attributes and irregular timing, while individual packets or messages depend on sequence context and lack natural numeric magnitude.Converting identifiers such as ports or protocols into continuous values can distort their semantic meaning.Source: §I · p. 1
  • The proposed interface maps each event at arrival using semantic identity, local frequency context, and inter-event timing for recurrent SNN classification.The authors position the contribution as a representation rather than a new IDS model.Source: §I · p. 1

A. SNN Input Encoding

  • Rate and population coding were designed for regularly sampled continuous signals, so applying them directly to cyber identifiers would impose artificial numeric relationships.Ports, protocols, services, and arbitration IDs do not encode information through numeric magnitude.Source: A. SNN Input Encoding · p. 2

B. Event Streams and Irregular Temporal Models

  • Event-stream models can capture temporal relationships, but the cited alternatives rely on dense embeddings, self-attention, or large hidden states described as costly and incompatible with edge neuromorphic hardware.The passage names log-sequence models, temporal point processes, and event-based vision pipelines as examples.Source: B. Event Streams and Irregular… · p. 2

C. Machine Learning for Network IDS and CAN IDS

Conventional network and CAN IDS often use aggregated or fixed-dimensional inputs, while prior spiking IDS approaches generally inherit preprocessing assumptions. The paper frames an event-native symbolic-temporal representation as a way to map raw events into sparse inputs at arrival.

C. Machine Learning for Network IDS and CAN IDS

  • Network and CAN IDS commonly use static, aggregated, or fixed-dimensional features that require buffering and preprocessing overhead.The cited examples include traffic features summarizing multiple packets and fixed-dimensional CAN message-ID or payload representations.Source: C. Machine Learning for Network IDS… · p. 2

D. Spiking Neural Networks for Intrusion Detection

  • Prior spiking IDS approaches typically encode pre-extracted numeric features or convert pretrained networks, rather than processing asynchronous cyber events directly.The passage says these fixed-matrix approaches do not support event-native execution.Source: D. Spiking Neural Networks for… · p. 2

E. Representation Gap

  • The representation gap is that cyber streams mix categorical symbols, irregular timing, and sequential context, while existing IDS pipelines recover context through buffering or aggregation.The passage motivates preserving event semantics for sparse recurrent SNN execution.Source: E. Representation Gap · p. 2

III. Symbolic-Temporal Encoding Framework

  • The proposed framework maps raw asynchronous events to sparse inputs at arrival, using operational categorical semantics, online frequency counters, and explicit timing.It does not encode timing implicitly through fixed-rate intervals.Source: §III · p. 2

A. General Framework

  • Each event becomes a concatenated binary vector of attribute and timing groups, with exactly K+1 active elements and O(K) encoding time per event.The temporal group encodes the inter-event delay; the passage also points to Fig. 1 for the mapping.Source: A. General Framework · pp. 2–3, Figure 1 · p. 3

B. Three Encoding Roles

The framework assigns separate encoding roles to categorical meaning, local identifier frequency, and relative timing. Its stated design properties are event-native, sparse, domain-informed, and hardware-compatible.

B. Three Encoding Roles

  • Semantic identity maps categorical fields into domain-informed bins, while frequency context maps high-cardinality identifiers to local frequency bins using online counts over the most recent L events.The count is discretized to represent local burst or periodic behavior without overfitting to specific identifier values.Source: B. Three Encoding Roles · p. 3
  • Relative timing maps each inter-event delay to logarithmically spaced bins so recurrent SNNs can learn burst, periodic, and idle-time dynamics without fixed-duration windows.The timing is based on relative event spacing rather than clock-aligned feature bins.Source: B. Three Encoding Roles · p. 3

C. Key Design Properties

  • The framework processes events individually, activates only K+1 of D channels, derives bins from domain specifications, and aligns binary activations with neuromorphic hardware inputs.The stated properties are event-native, sparse, domain-informed, and hardware-compatible.Source: C. Key Design Properties · p. 3

IV. Experimental Setup

Experiments use run-level partitions and per-event binary classification, optimize recurrent SNNs with EONS under µCaspian-aligned constraints, and apply a rolling alarm rule to per-event predictions.

IV. Experimental Setup

  • Packets or messages from a temporal run stay within one partition, and held-out test runs are reserved for final performance reporting.Combined datasets are stratified by attack category while preserving run boundaries.Source: §IV · p. 3

A. Binary Classification Task

  • The task is to predict benign or malicious activity for each arriving event using its encoded input and the recurrent state accumulated by the network.The event-level output is produced upon arrival.Source: A. Binary Classification Task · p. 3

B. SNN Optimization and Hardware-Constrained Simulation

  • EONS evolves recurrent SNN topology and parameters; each dataset uses 200 runs of 300 generations and population size 100, evaluated with µCaspian-emulating constraints.Networks are limited to 256 neurons and 4,096 synapses.Source: B. SNN Optimization and… · p. 3

C. Rolling Decision Rule

  • An alarm is raised when at least θ of the last w event predictions are malicious; experiments fix w at 50 and optimize θ on training data.The rolling rule operates on outputs and does not aggregate input features or construct flows.Source: C. Rolling Decision Rule · pp. 3–4

D. Baseline Models

The study compares classical classifiers and recurrent models on raw and encoded inputs under a shared evaluation procedure. It defines Jhybrid to combine attack detection with benign-event alarms as a single optimization objective.

D. Baseline Models

  • All baselines share the SNN’s train/validation/test partitions, threshold-selection procedure, and rolling decision rule, with raw continuous inputs compared against sparse binary encoded inputs.Models include Logistic Regression, Random Forest, Decision Tree, Gaussian Naive Bayes, and a recurrent neural network.Source: D. Baseline Models · p. 4

E. Evaluation Metrics

  • Jhybrid combines attack-interval detection rate with the fraction of benign event positions in alarm to provide EONS a single fitness objective.ADR counts attack intervals with at least one alarm; an event is a packet for Network IDS and a CAN message for CAN IDS.Source: E. Evaluation Metrics · p. 4
  • Jhybrid is not conventional Youden’s J because attack detection and benign false alarms are measured at different resolutions.Per-event accuracy is also reported by comparing detector alarm state with the ground-truth label at each event position.Source: E. Evaluation Metrics · p. 4

F. Confidence Intervals

The evaluation uses grouped bootstrap resampling for confidence intervals and tests the encoding on packet-level Network IDS data. The network representation preserves per-packet semantics and timing in a sparse input vector.

F. Confidence Intervals

  • 95% confidence intervals use 10,000 paired bootstrap samples, resampling within source-dataset and traffic-class groups and recalculating ADR, FPRevent, and Jhybrid.The same samples are used across models for paired comparisons.Source: F. Confidence Intervals · p. 4

A. Dataset and Preprocessing

  • Network IDS experiments use TON-IoT, Bot-IoT, TII-SSRC-23, and a Combined dataset, with runs split 60/10/30 into train, validation, and test partitions.Runs are balanced by benign versus attack-containing status, while individual event labels remain highly imbalanced.Source: A. Dataset and Preprocessing · p. 4, Table I · p. 4
  • Packets are weakly informative alone, so the evaluation targets temporal context while preserving per-packet semantics amid irregular timing and heterogeneous, imbalanced datasets.The recurrent SNN can accumulate evidence across arrivals.Source: A. Dataset and Preprocessing · p. 4

B. Encoding Scheme

  • Each packet maps to a 36-dimensional sparse spike vector with eight feature groups, including rolling-window address frequencies, standards-based port and size bins, and log-spaced inter-event-time bins.Address frequencies use a rolling 20,000-packet window; destination ports have finer granularity for common service endpoints.Source: B. Encoding Scheme · pp. 4–5

C. Results and Baseline Comparison

The encoded recurrent SNN achieves strong Network IDS results, while controlled baselines and feature ablations examine the roles of representation and symbolic inputs. Comparisons with published flow-based or heavily engineered systems are not intended as direct rankings.

C. Results and Baseline Comparison

  • The results are not intended as direct state-of-the-art comparisons with flow-based or heavily engineered IDS pipelines because preprocessing, task definitions, and evaluation settings differ.Prior systems cited in the passage use different approaches and report dataset-specific accuracy values.Source: C. Results and Baseline Comparison · p. 5
  • On the same encoded event sequences, the recurrent SNN achieves Jhybrid = 0.987 and FPRevent = 0.011, versus Jhybrid = 0.739 and FPRevent = 0.140 for the RNN.Source: C. Results and Baseline Comparison · p. 5
  • Jhybrid = 0.739 for the RNN versus 0.709 for the static Random Forest and Decision Tree models on the encoded Combined dataset.The encoded representation improves performance for most classical classifiers, but alone is not sufficient for strong detection with static classifiers.Source: C. Results and Baseline Comparison · p. 5

D. Symbolic Feature-Group Ablation

  • Across all datasets, ablating packet size yields the largest degradation in Jhybrid (mean ΔJhybrid = −0.085), followed closely by protocol (ΔJhybrid = −0.047); IP frequency and port groups have negligible impact.Source: D. Symbolic Feature-Group Ablation · pp. 5–6

C. Results and Baseline Comparison

  • Median detection latency is 55 packets on the Combined dataset, with 25% of attacks detected within 22 packets.Latency counts packets between attack onset and the first alarm within the labeled attack interval.Source: C. Results and Baseline Comparison · p. 5

VI. CAN IDS Evaluation

The framework is extended to CAN message streams using encoding roles matched to field semantics. The evaluation covers two public benchmarks and a combined dataset, with categorical treatment for identifiers and numeric encoding for payload bytes.

VI. CAN IDS Evaluation

  • The target stream is structurally distinct, with 11-bit arbitration IDs, short 8-byte payloads, and sub-millisecond inter-message spacing.CAN attacks commonly inject spoofed frames to manipulate in-vehicle systems, making timing and message-payload sequences relevant to detection.Source: §VI · p. 6

A. Dataset and Preprocessing

  • CAN evaluation uses ROAD, Car-Hacking, and a Combined dataset, with runs split 60/10/30 into train, validation, and test partitions.ROAD contains long contiguous attack segments, while Car-Hacking represents short, burst-like injection campaigns; nearby attack messages are merged when separated by fewer than 50 benign frames.Source: A. Dataset and Preprocessing · p. 6

B. Encoding Scheme

  • The CAN adaptation uses a 26-dimensional hybrid input and assigns representation by field semantics: categorical identifiers, discretized timing, and magnitude-preserving payload bytes.Numeric spike encoding is used only where numeric magnitude is semantically meaningful.Source: B. Encoding Scheme · p. 6
  • CAN ID frequency uses a sliding 1,000-message window and six bins, inter-message timing uses four sub-millisecond classes, and payload bytes use positive and negative deviation-rate channels.The payload encoding assigns two input channels per byte.Source: B. Encoding Scheme · p. 6

C. Results and Baseline Comparison

The CAN evaluation reports strong detection across individual datasets and the Combined setting; on Combined CAN, the SNN slightly exceeds a non-spiking RNN on Jhybrid.

C. Results and Baseline Comparison

  • The best evolved SNN maintains high performance on Combined CAN, which merges short injection bursts with longer ROAD captures.The reported network is selected on training data and evaluated on held-out test runs.Source: C. Results and Baseline Comparison · pp. 6–7, Table VII · p. 7
  • The CAN results are not a direct state-of-the-art comparison because prior systems use different preprocessing, feature construction, and evaluation procedures.Message-level accuracy is complementary to Jhybrid, the primary operational metric for comparing attack detection and benign alarm activity.Source: C. Results and Baseline Comparison · p. 7
  • Jhybrid = 0.9803 (95% CI: [0.9672, 0.9878]) for the SNN, versus Jhybrid = 0.9719 (95% CI: [0.9579, 0.9830]) for the non-spiking RNN on Combined CAN.The passage attributes much of the improvement to temporal recurrence and notes the SNN’s slightly improved performance in an event-driven, hardware-compatible form.Source: C. Results and Baseline Comparison · p. 7
  • On Combined CAN, median detection latency is 48 messages, with 25% of attacks detected within 35 messages.Latency is measured from attack onset to the first alarm within the labeled attack interval.Source: C. Results and Baseline Comparison · p. 7
  • On Combined CAN, the proposed 26-dimensional hybrid encoding improves performance for most classical baselines compared with raw normalized features.The comparison isolates the representation’s contribution; the passage links useful structure to CAN ID frequency, payload behavior, and inter-message timing.Source: C. Results and Baseline Comparison · p. 7, Table VIII · p. 8

VII. Discussion

Temporal-shift controls test whether Jhybrid reflects alignment with attack behavior rather than chance overlap in long attack intervals. Observed alarms align earlier and more strongly with attack onset than shifted outputs.

A. Temporal Validation of the Hybrid Objective

  • Because ADR is interval-based, long attack intervals can produce chance alarm overlap and inflate ADR for a temporally uninformative detector.This motivates testing temporal alignment beyond the hybrid score alone.Source: A. Temporal Validation of the Hybrid… · p. 8
  • Temporal shifting lowers mean Jhybrid by 0.2333 for Network IDS and 0.3313 for CAN IDS; observed scores exceed all 10,000 shifted replicates in both domains (p < 0.0001).The control shifts each held-out run’s output sequence while preserving its activity pattern, then reapplies the rolling decision rule.Source: Table IX · p. 8, A. Temporal Validation of the Hybrid… · p. 8
  • Within 50, 100, and 250 events, Network IDS detects 40.5%, 75.6%, and 83.1% of attacks, versus 25.7%, 31.7%, and 48.7% under shifting; CAN IDS rates are 52.1%, 74.8%, and 90.1%, versus 3.9%, 7.0%, and 13.7%.Median latency is 55 versus 263 events for Network IDS and 48 versus > 500 messages for CAN IDS, observed versus shifted.Source: A. Temporal Validation of the Hybrid… · p. 8
  • Alarm-state activity rises from 11.0% at Network IDS attack onset to 31.5% at event +49, and from 0.0% to 52.1% for CAN IDS; shifted controls remain near 16% and 37%.The analysis checks whether alarm activity becomes concentrated after an attack begins.Source: A. Temporal Validation of the Hybrid… · p. 8

B. Topology

The evolved networks are compact and fit µCaspian-oriented constraints, while the conclusion reports strong detection across both event domains. The authors also identify limits in the encoding design and evaluation scope.

B. Topology

  • The Network IDS SNN uses 46 neurons with dense recurrence, and its input connections concentrate around packet-size and protocol bins.The authors report high detection on the Combined dataset and describe these input hubs as aligned with discriminative encoding channels.Source: B. Topology · pp. 8–9
  • The CAN IDS network retains inputs from ID-frequency, payload-byte, and inter-arrival-timing channels while pruning several others.Its compact event-driven structure processes temporal evidence as messages arrive, without waiting for large windows or dense feature construction.Source: B. Topology · p. 9
  • Both evolved topologies fit µCaspian neuron, synapse, precision, and axonal-delay limits, but the cyber models lack physical hardware measurements.The authors present the constraints as a hardware-aligned basis for future direct deployment.Source: B. Topology · p. 9

VIII. Limitations

  • The encoding is domain-informed and uses manually defined bin boundaries; the authors identify learning those boundaries from data as future work.They also state that RNN and conventional-classifier comparisons used limited hyperparameter sweeps rather than exhaustive optimization.Source: §VIII · p. 9
  • The evaluations use public benchmark datasets and simulated hardware constraints, so they do not capture all deployment challenges.Source: §VIII · p. 9

IX. Conclusion

  • The framework maps heterogeneous asynchronous events to sparse spike-compatible vectors at arrival, encoding semantic identity, local frequency context, and inter-event timing.It preserves categorical semantics and temporal spacing without converting events to artificial numeric averages.Source: §IX · p. 9
  • Jhybrid ≥0.980 across packet-level Network IDS and message-level CAN IDS under edge-aligned µCaspian constraints.The conclusion reports this as strong detection by compact recurrent SNNs.Source: §IX · p. 9
Loading 2609.15772v1…