On the Evaluation of Spiking Neural Network Configurations for Network Intrusion Detection
For cybersecurity practitioners seeking lightweight intrusion detection models, this work provides a systematic comparison of SNN design choices, though the gains are incremental over existing methods.
The paper evaluates 27 SNN configurations (9 neuron models × 3 spike encodings) for network intrusion detection on four benchmark datasets, finding that latency encoding outperforms rate and delta encoding, and the LeakyParallel neuron with latency encoding achieves 92.11% accuracy and 0.80 macro-F1 with 2.01% false positives averaged across datasets.
Network intrusion detection is a core component of modern cybersecurity infrastructure, yet the deep learning models that dominate the field are computationally demanding, motivating interest in lightweight alternatives suited to edge and neuromorphic deployment. Spiking Neural Networks (SNNs) are therefore a natural candidate, but their design space, spanning the choice of neuron model and spike encoding scheme, remains poorly characterized for intrusion detection. We bridge this gap by using a controlled ablation study using 9 neurons coupled with 3 spike encoding schemes, making 27 variants, all implemented on snntorch evaluated over raw inputs with limited preprocessing on four benchmark datasets (NSL KDD, KDDCup99, CIC-IDS2017, and CTU-13) with 5 seeds. We find that spike encoding scheme is a better determinant for detection quality than the neuron model, where rate and delta spike encodings perform worse than latency encoding over the sweep. The LeakyParallel neuron with latency encoding performed the best overall, averaging at 92.11% accuracy and 0.80 macro- F1 at a rate of 2.01% false positives averaged over all 4 datasets, with accuracy close to perfect for CIC-IDS2017 and CTU-13, and also performed the fastest on inference. These results highlight the potential of SNNs as a viable alternative to traditional methods of intrusion detection when considering low-latency or resource-constrained deployments.