Title: Assessing Spiking Neural Network Architectures for Network Intrusion Detection Systems

Network intrusion detection serves as a foundational pillar of contemporary cybersecurity frameworks. However, the deep learning models currently prevalent in this domain are often hindered by high computational costs, driving a search for more efficient solutions capable of operating on edge devices and neuromorphic hardware. Spiking Neural Networks (SNNs) emerge as a promising lightweight alternative; yet, their architectural design space—particularly regarding the selection of neuron models and spike encoding methodologies—lacks comprehensive characterization in the context of intrusion detection.

To address this deficiency, this study employs a rigorous controlled ablation study. We evaluated 27 distinct SNN variants, constructed by combining nine different neuron models with three spike encoding schemes. All models were implemented using the snntorch framework and tested on raw input data requiring minimal preprocessing. The evaluation spanned four established benchmark datasets—NSL KDD, KDDCup99, CIC-IDS2017, and CTU-13—utilizing five random seeds for each configuration.

Our analysis reveals that the choice of spike encoding scheme exerts a more significant influence on detection performance than the specific neuron model employed. Specifically, rate-based and delta-based encodings underperformed compared to latency encoding across all tested configurations. The top-performing architecture combined the LeakyParallel neuron with latency encoding. This configuration achieved an average accuracy of 92.11% and a macro-F1 score of 0.80, with an average false positive rate of just 2.01% across the four datasets. Notably, it delivered near-perfect accuracy on the CIC-IDS2017 and CTU-13 datasets while also demonstrating the fastest inference speeds among the tested variants. These findings underscore the viability of SNNs as a robust alternative to traditional intrusion detection methods, particularly for applications prioritizing low latency and constrained computational resources.

Source: arXiv Generated at: 2026-06-02 00:00:00 UTC