Spiking neural networks detect cyber attacks using native event encodings
Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams
Neural and Evolutionary ComputingArtificial IntelligenceCryptography and Security
Summary
Cybersecurity data often arrives as irregular, mixed-type events that are hard to analyze efficiently. The authors present a new way to transform these mixed events into spikes, the kind of signals spiking neural networks (SNNs) use, preserving important details like timing and event type. This approach avoids losing information through traditional aggregation methods and works well on low-power devices. They tested it on two kinds of network data and showed it can detect anomalies accurately using small, specialized neural networks.
What this means in practice
- •For network security teams: Detect network intrusions using real-time spike-encoded event data rather than aggregated flow records to improve response times on edge hardware.
- •For automotive cybersecurity engineers: Monitor vehicle CAN bus messages with spike-encoded event inputs for timely detection of anomalies in vehicle networks.
Authors
Dalton Diez, Peyton Andras, Max Shroyer, James Ghawaly
Abstract
Spiking neural networks (SNNs) have shown promise for sparse, event-driven computation through stateful processing that is naturally compatible with low-power edge hardware. These properties align with cyber monitoring, where data arrives asynchronously, and malicious behavior often emerges through temporal patterns across event sequences. However, cyber streams are not composed solely of continuous numeric signals: their informative structure is also carried by categorical identifiers, irregular timing, and local behavioral context. Traditional rate- and population-based spike encodings are not naturally suited to these heterogeneous semantics, while conventional intrusion detection system (IDS) pipelines typically resolve the mismatch by converting raw events into flows, fixed aggregation windows, or dense tensors. Although useful for conventional classifiers, these transformations introduce buffering latency, obscure native temporal structure, and weaken the computational advantages of event-driven neuromorphic processing. We introduce an event-native symbolic-temporal spike encoding framework that maps heterogeneous cyber events directly into sparse, spike-compatible inputs. By assigning encoding roles to semantic identity, local frequency context, and inter-event timing, the framework preserves categorical semantics and temporal dynamics. We validate the approach on packet-level Network IDS and extend it to message-level CAN IDS, using both domains to evaluate whether the encoding exposes usable structure for recurrent SNNs operating directly on native event streams. Under edge-oriented, $μ$Caspian-aligned hardware constraints, compact recurrent SNNs achieve strong anomaly detection performance, with an operational hybrid metric ($J_{hybrid}$) of 0.987 on Network IDS and 0.980 on CAN IDS.