Paper deep dive
Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams
Dalton Diez, Peyton Andras, Max Shroyer, James Ghawaly
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Spiking neural networks (SNNs) have shown promise for sparse, event-driven computation through stateful processing that is naturally compatible with low-power edge hardware. These properties align with cyber monitoring, where data arrives asynchronously, and malicious behavior often emerges through temporal patterns across event sequences. However, cyber streams are not composed solely of continuous numeric signals: their informative structure is also carried by categorical identifiers, irregular timing, and local behavioral context. Traditional rate- and population-based spike encodings are not naturally suited to these heterogeneous semantics, while conventional intrusion detection system (IDS) pipelines typically resolve the mismatch by converting raw events into flows, fixed aggregation windows, or dense tensors. Although useful for conventional classifiers, these transformations introduce buffering latency, obscure native temporal structure, and weaken the computational advantages of event-driven neuromorphic processing. We introduce an event-native symbolic-temporal spike encoding framework that maps heterogeneous cyber events directly into sparse, spike-compatible inputs. By assigning encoding roles to semantic identity, local frequency context, and inter-event timing, the framework preserves categorical semantics and temporal dynamics. We validate the approach on packet-level Network IDS and extend it to message-level CAN IDS, using both domains to evaluate whether the encoding exposes usable structure for recurrent SNNs operating directly on native event streams. Under edge-oriented, $\mu$Caspian-aligned hardware constraints, compact recurrent SNNs achieve strong anomaly detection performance, with an operational hybrid metric ($J_{hybrid}$) of 0.987 on Network IDS and 0.980 on CAN IDS.
Tags
Links
- Source: https://arxiv.org/abs/2609.15772v1
- Canonical: https://arxiv.org/abs/2609.15772v1
Trouble viewing inline? Open PDF directly →
Full Text
49,871 characters extracted from source content.
Expand or collapse full text
Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams Dalton Diez, Peyton Andras, Max Shroyer, and James Ghawaly, Jr. Affiliation: Louisiana State University Baton Rouge, Louisiana, USA ddiez2, peyton.andras, mshroy1, jghawaly@lsu.edu Abstract Spiking neural networks (SNNs) have shown promise for sparse, event-driven computation through stateful processing that is naturally compatible with low-power edge hardware. These properties align with cyber monitoring, where data arrives asynchronously, and malicious behavior often emerges through temporal patterns across event sequences. However, cyber streams are not composed solely of continuous numeric signals: their informative structure is also carried by categorical identifiers, irregular timing, and local behavioral context. Traditional rate- and population-based spike encodings are not naturally suited to these heterogeneous semantics, while conventional intrusion detection system (IDS) pipelines typically resolve the mismatch by converting raw events into flows, fixed aggregation windows, or dense tensors. Although useful for conventional classifiers, these transformations introduce buffering latency, obscure native temporal structure, and weaken the computational advantages of event-driven neuromorphic processing. We introduce an event-native symbolic-temporal spike encoding framework that maps heterogeneous cyber events directly into sparse, spike-compatible inputs. By assigning explicit encoding roles to semantic identity, local frequency context, and inter-event timing, the framework preserves categorical semantics and temporal dynamics. We validate the approach on packet-level Network IDS and extend it to message-level CAN IDS, using both domains to evaluate whether the encoding exposes usable structure for recurrent SNNs operating directly on native event streams. Under edge-oriented, μ -aligned hardware constraints, compact recurrent SNNs achieve strong anomaly detection performance, with an operational hybrid metric (JhybridJ_hybrid) of 0.987 on Network IDS and 0.980 on CAN IDS. These results show that preserving native symbolic and temporal structure enables compact recurrent SNNs to perform effective attack detection using edge-compatible inference. Index Terms: Spiking neural networks, event-native encoding, cyber intrusion detection, Controller Area Network, neuromorphic computing, asynchronous streams. I Introduction Spiking neural networks (SNNs) are naturally aligned with the asynchronous, event-driven characteristics of cybersecurity streams [1]. In domains like network monitoring or in-vehicle communication, data arrives as discrete events (packets or messages), and malicious activity often manifests as temporal patterns across sequences. However, despite this conceptual alignment, applying SNNs to native cyber event streams presents a major representational challenge. The difficulty lies in the input interface. Unlike physical sensor signals, which are often regularly sampled and continuous-valued, cyber event fields are symbolic, heterogeneous, and irregularly timed. Attributes such as protocol type, destination port, service, and Controller Area Network (CAN) arbitration ID do not have natural numeric ordering or magnitude relationships. Treating a port number or protocol identifier as a continuous value therefore distorts its semantic meaning. Individual packets or messages are also weakly informative in isolation; their significance depends on local sequential context and relative timing across event arrivals. To overcome this representation gap, conventional intrusion detection systems (IDS) rely on extensive preprocessing, such as flow construction, fixed-duration aggregation, or input aggregation windows [2, 3, 4]. While these methods extract useful numeric features, they transform the data from its native form, introducing latency and increasing resource overhead. Prior SNN-based IDS research typically inherits these limitations by using pre-engineered, static numeric feature vectors as the starting point for spike encoding [5, 6, 7, 8], or by converting conventional deep neural networks into spiking equivalents via artificial-to-SNN pipelines [9]. This prevents end-to-end event-native inference and shifts computation back toward preprocessing stages that reduce the latency and low-power advantages of sparse neuromorphic processing. In this work, we propose an event-to-spike representation designed specifically for heterogeneous, asynchronous cyber streams. Our central claim is representational: cyber event streams can be made suitable for edge-based neuromorphic inference when each event is encoded according to its symbolic identity, local behavioral context, and inter-event timing. Preserving this structure allows compact recurrent SNNs to accumulate evidence over time and classify attacks directly from native cyber streams. The contribution is not a new IDS model, but a symbolic-temporal representation interface for mapping raw cyber events into sparse, spike-compatible channels at their exact moment of arrival. The encoder uses semantically defined bins for categorical attributes, online frequency counters for local context, and discretized inter-event intervals (Δt t) for relative timing. This enables direct edge-compatible event-native classification without flow construction, fixed-duration aggregation, or dense traffic tensors. To demonstrate the generality of this representation, we instantiate it across two distinct domains: packet-level Network IDS and message-level CAN IDS. We optimize the recurrent SNN topologies and parameters under edge-oriented μ hardware constraints [10] using Evolutionary Optimization for Neuromorphic Systems (EONS) [11] as the optimization backend. We evaluate the representation with lightweight baselines on raw and encoded inputs, contextualizing the difficulty of event-native detection and the value of the domain-informed encoded representation. We then show that SNNs can use this representation to retain context across native event arrivals and perform effective edge-compatible detection. I Related Work I-A SNN Input Encoding Input encoding converts real-world data into spikes. Traditional encoding schemes (e.g., rate, temporal, and population coding) were designed for regularly sampled, continuous-valued signals where information is carried by physical magnitudes or precise timing [12, 13]. These approaches are poorly suited for cyber streams, where information is carried by symbolic attributes, irregular event spacing, and local temporal context rather than continuous magnitudes. For this reason, a direct rate-coded or population-coded baseline is not semantically well-defined for native packet or CAN fields. Ports, protocols, services, and arbitration IDs do not encode information through numeric magnitude, so mapping them directly to firing rates or population centers would impose artificial relationships that are not present in the underlying protocol semantics. I-B Event Streams and Irregular Temporal Models Outside neuromorphic computing, sequence models like DeepLog capture log sequences [14], while temporal point processes model irregular event arrivals [15]. Event-based vision pipelines also process asynchronous pixel streams using specialized spatial-temporal representations [16]. While these approaches capture temporal relationships, they rely on dense embeddings, self-attention, or large hidden states that are computationally expensive and incompatible with edge neuromorphic hardware. I-C Machine Learning for Network IDS and CAN IDS Conventional Network IDS and CAN IDS research heavily favors static, aggregated, or fixed-dimensional feature representations. Evaluations on network datasets typically use processed traffic features that summarize multiple packets over time [17, 18, 19]. Similarly, CAN IDS benchmarks frequently use fixed-dimensional representations of message-ID sequences or payload bit strings processed by dense neural networks [20, 21]. These approaches require buffering and aggregation, adding latency and preprocessing overhead that reduces their suitability for direct edge-based event processing. I-D Spiking Neural Networks for Intrusion Detection Prior spiking IDS implementations generally inherit these aggregation assumptions. Most spiking network intrusion detectors perform rate or temporal encoding on pre-extracted, high-level numeric features rather than raw packets [5, 6, 7]. For CAN security, researchers have proposed ANN-to-SNN conversion methods that map pre-trained networks into spiking networks [9]. Because these networks operate on fixed numeric matrices, they do not process asynchronous cyber events directly and therefore cannot support event-native execution. I-E Representation Gap Despite domain alignments, there is a representational gap between asynchronous cyber streams and neuromorphic computation. Current SNN encoders cannot naturally represent the mixture of categorical symbols, irregular timings, and sequential contexts of packet and CAN traffic. Conversely, existing IDS pipelines recover context only after buffering or aggregation, discarding the timing and event boundaries that recurrent SNNs are designed to process. This motivates a representation layer that preserves cyber event semantics while enabling sparse recurrent SNN execution for direct, low-overhead edge-based monitoring. I Symbolic-Temporal Encoding Framework The core contribution of this work is a representation framework for asynchronous cyber streams that maps raw events into sparse, spike-compatible inputs at their moment of arrival. The encoder represents categorical cyber fields using operational semantics, maintains local context with online frequency counters, and captures timing explicitly, rather than implicitly through fixed-rate intervals. I-A General Framework Given an asynchronous event stream =(x1,t1),(x2,t2),…,(xT,tT)X=\(x_1,t_1),(x_2,t_2),…,(x_T,t_T)\, each event xix_i arriving at timestamp tit_i is mapped to a sparse binary spike vector si∈0,1Ds_i∈\0,1\^D by concatenating K attribute groups with one temporal group: si=[g1(xi)‖g2(xi)‖⋯‖gK(xi)‖h(Δti)]∈0,1D,s_i= [\,g_1(x_i)\;\|\;g_2(x_i)\;\|\;·s\;\|\;g_K(x_i)\;\|\;h( t_i)\, ]∈\0,1\^D, (1) where Δti=ti−ti−1 t_i=t_i-t_i-1 is the inter-event arrival delay. Each attribute group gk(xi)g_k(x_i) maps a specific categorical or numeric field to a one-hot subvector of size BkB_k. The temporal group h(Δti)h( t_i) maps the inter-event delay to a one-hot subvector of size BΔtB_ t. The total dimensionality of the input space is: D=∑k=1KBk+BΔt.D= _k=1^KB_k+B_ t. (2) Because each group activates exactly one bin per event, the resulting vector sis_i contains exactly K+1K+1 active elements, with the remaining D−(K+1)D-(K+1) elements set to zero. The encoding operation has a time complexity of O(K)O(K) per event, which is independent of the stream length. This mapping is illustrated in Fig. 1. This fully categorical formulation is used for Network IDS; Section VI extends it with rate-coded payload channels. Fig. 1: Overview of the symbolic-temporal encoding pipeline, mapping a raw cyber event into a sparse, spike-compatible binary vector. I-B Three Encoding Roles To capture the varied semantics of cyber protocols, the feature groups are designed to fulfill three distinct representational roles: 1. Semantic Identity: Non-numeric categorical fields (such as protocols, services, and ports) are mapped into semantically defined bins based on domain context. This avoids assigning arbitrary continuous magnitudes to categorical values, preserving their symbolic meaning. 2. Frequency-Based Context: High-cardinality identifiers, such as IP addresses or CAN arbitration IDs, are mapped to local frequency bins. The encoder maintains an online FIFO window of the most recent L events and updates identifier counts as events arrive. The resulting count for the current identifier is discretized into a frequency bin, capturing local burst or periodic behavior without overfitting to specific identifier values. 3. Relative Timing: The inter-event delay Δti t_i is mapped to logarithmically spaced bins, allowing the recurrent SNN to learn burst, periodic, and idle-time dynamics directly from relative event spacing without fixed-duration accumulation windows or clock-aligned feature bins. I-C Key Design Properties The encoding framework satisfies four properties: • Event-Native: Events are processed individually upon arrival, avoiding flow reconstruction or dense traffic-summary tensors. • Sparse: The resulting representation is highly sparse, activating only K+1K+1 channels out of D. • Domain-Informed: Bin boundaries are derived from standard network and communication specifications (e.g., IANA port allocations or Ethernet frame sizes). • Hardware-Compatible: The binary activations align directly with the input channels of neuromorphic hardware, minimizing encoding overhead. IV Experimental Setup All experiments use a common classification setting, training protocol, hardware-constrained simulator, and evaluation methodology. Data are partitioned at the run level: packets or messages from the same temporal run are never split across training, validation, and test sets. For the Combined datasets, stratification is performed by attack category while preserving run boundaries. This avoids event-level leakage across partitions and ensures that test performance is measured on held-out runs. Training runs are used for evolutionary fitness evaluation. Validation runs are monitored during evolution as a generalization check. Held-out test runs are used only for final performance reporting. IV-A Binary Classification Task We formulate cyber intrusion detection as a per-event binary classification task. Given an event stream X, the model must output a prediction y^i∈0,1 y_i∈\0,1\ upon the arrival of each event xix_i, where 11 indicates malicious and 00 indicates benign activity. The model must perform this classification using the current encoded event sis_i and the context accumulated within the network’s recurrent state. IV-B SNN Optimization and Hardware-Constrained Simulation We optimize recurrent SNN topology and parameters using Evolutionary Optimization for Neuromorphic Systems (EONS) [11]. EONS is a population-based, gradient-free optimizer that evolves both network structure and neuron/synapse parameters using tournament selection, crossover, and mutation. EONS serves as the optimization backend; the contribution of this work is the event-native representation supplied to the recurrent SNN. For each dataset, we perform 200 independent EONS runs, each using 300 generations and a population size of 100 candidate networks, for a total of 6.0 million candidate evaluations per dataset. All candidate networks are evaluated in the Caspian simulator configured to emulate the μ neuromorphic processor [10]. Networks use Integrate-and-Fire neurons with 8-bit thresholds, 16-bit membrane potentials, and 4-bit axonal delays. To maintain edge relevance, evolution is constrained to networks with at most 256 neurons and 4,096 synapses. IV-C Rolling Decision Rule To prevent transient spikes in output activity from causing excessive false alarms, we apply a rolling decision rule to the raw per-event predictions y^i y_i. An attack alarm is raised if the number of malicious predictions within a rolling output alarm window of the last w events meets or exceeds a threshold θ: y^talarm=1if ∑i=t−w+1ty^i≥θ,0otherwise. y^alarm_t= cases1&if _i=t-w+1^t y_i≥θ,\\[6.0pt] 0&otherwise. cases (3) We fix w=50w=50 events across all experiments to suppress isolated false positives while maintaining low detection latency. The threshold θ is optimized on the training split. This rolling rule does not aggregate input features, construct flows, or build dense traffic-summary tensors. IV-D Baseline Models For representation analysis, we train Logistic Regression (LR), Random Forest (RF), Decision Tree (DT), Gaussian Naive Bayes (GNB), and Recurrent Neural Network (RNN) classifiers. All baselines use the same train/validation/test partitions, threshold-selection procedure, and output rolling decision rule as the SNN. Raw features are represented using normalized continuous values, while encoded features use the sparse binary input vector. IV-E Evaluation Metrics Cybersecurity evaluation must account for both whether attacks are detected and how frequently benign traffic produces false alarms. Prior NIDS work provides precedent for evaluating successful detection at the attack-instance level while measuring false positives at the packet level [22]. We follow this general distinction for event-stream intrusion detection. We define the Attack Detection Rate (ADR) as the proportion of labeled attack intervals containing at least one alarm, and FPReventFPR_event as the fraction of benign event positions for which the detector is in an alarm state. For Network IDS, an event is a packet; for CAN IDS, it is a CAN message. Because EONS requires a single fitness objective, we combine them as JhybridJ_hybrid. ADR=NdetectedattacksNattacks.ADR= N_detected\ attacksN_attacks. (4) FPRevent=NbenigneventsinalarmNbenignevents.FPR_event= N_benign\ events\ in\ alarmN_benign\ events. (5) Jhybrid=ADR−FPRevent.J_hybrid=ADR-FPR_event. (6) This metric is not conventional Youden’s J, because ADR and FPReventFPR_event are measured at different resolutions. Instead, JhybridJ_hybrid is an operational IDS objective that rewards detection of attack instances while penalizing alarm activity on benign traffic. This provides a single fitness value for EONS that balances attack detection and false-positive behavior. We additionally report per-packet or per-message accuracy by comparing the detector alarm state with the ground-truth label at each event position. IV-F Confidence Intervals We estimate 95% confidence intervals using 10,000 bootstrap samples of the test set. Clusters are grouped by source dataset and traffic class, then sampled with replacement within each group. For each sample, ADR and FPReventFPR_event are recomputed from the resampled attack detections and benign event positions, and JhybridJ_hybrid is then recalculated. The confidence interval is given by the 2.5th and 97.5th percentiles of its bootstrap values. The same samples are used for all models to ensure paired comparisons. V Network IDS Evaluation We first evaluate the symbolic-temporal framework on packet-level network intrusion detection, where malicious behaviors must be identified from sequential packet arrivals. V-A Dataset and Preprocessing We utilize three public packet-level network datasets: TON-IoT [18], Bot-IoT [23], and TII-SSRC-23 [24], and construct a Combined dataset containing runs from all three sources (Table I). Raw packet captures are parsed using PyShark to extract packet-level attributes and ordered into temporal runs. The dataset is balanced at the run level (equal numbers of benign and attack-containing runs), though individual event labels remain highly imbalanced to reflect realistic deployment. The runs are split 60/10/30 into train, validation, and test partitions, stratified by attack category. Packet-level IDS is challenging because individual packets are often weakly informative in isolation, and malicious behavior is usually expressed through traffic patterns, feature distributions, and temporal context rather than a single separable packet attribute [2, 3]. This challenge is amplified by the irregular timing structure of network traffic [25] and the heterogeneity and imbalance of real IDS datasets [18, 23, 24]. These properties motivate an event-native representation that preserves per-packet semantics while allowing the recurrent SNN to accumulate evidence across arrivals. TABLE I: Network IDS Dataset Summary Dataset Runs Packets Attack % TON-IoT [18] 1,346 57.4 M 5.26 Bot-IoT [23] 31,096 459.4 M 12.60 TII-SSRC-23 [24] 521 2.84 M 32.48 Combined 32,963 519.6 M 11.90 V-B Encoding Scheme We map each packet to a 36-dimensional sparse spike vector composed of eight feature groups (Table I). IP frequency groups keep a local count of source and destination addresses over a rolling 20,000-packet window, capturing burst behavior without global address tracking. Port groups are binned according to IANA specifications [26], with destination ports having finer granularity to represent common service endpoints. Packet sizes are binned using Ethernet standard frames [27]. Inter-event times (Δt t) are discretized into log-spaced bins to capture the heavy-tailed timing distributions typical of network traffic [25]. TABLE I: Symbolic Input Bin Definitions. Each network packet activates exactly one bin per feature group. Bin Definition Bin Definition Bin Definition 0 Src IP freq: Low (0–5k) 12 Dst port: Web (80, 443, 8080) 24 Service: HTTP/HTTPS 1 Src IP freq: Med-low (5k–10k) 13 Dst port: DNS (53, 5353) 25 Service: DNS 2 Src IP freq: Med-high (10k–15k) 14 Dst port: SSH (22) 26 Service: TLS/SSL 3 Src IP freq: High (15k–20k) 15 Dst port: Mail (25, 465, 587) 27 Service: Other 4 Dst IP freq: Low (0–5k) 16 Dst port: NTP (123) 28 Pkt size: Tiny (0–64 B) 5 Dst IP freq: Med-low (5k–10k) 17 Dst port: Other well-known 29 Pkt size: Small (65–512 B) 6 Dst IP freq: Med-high (10k–15k) 18 Dst port: Registered 30 Pkt size: Standard (513–1514 B) 7 Dst IP freq: High (15k–20k) 19 Dst port: Dynamic/Other 31 Pkt size: Large (>>1514 B) 8 Src port: Well-known (0–1023) 20 Protocol: TCP 32 Δt t: Very fast (<<0.1 ms) 9 Src port: Registered 21 Protocol: UDP 33 Δt t: Fast (0.1–1 ms) 10 Src port: Dynamic 22 Protocol: ICMP 34 Δt t: Moderate (1–10 ms) 11 Src port: Other 23 Protocol: Other 35 Δt t: Slow (≥ 10 ms) V-C Results and Baseline Comparison The Network IDS evaluation assesses whether the symbolic-temporal encoding exposes useful structure from packet-level event streams and whether recurrent spiking state provides additional temporal decision capacity. We therefore report the best evolved SNN performance across datasets and compare raw and encoded inputs using controlled baselines on the Combined Network IDS dataset. Table I reports the best evolved SNN on each Network IDS dataset. For each dataset, the reported network was selected as the highest-performing candidate on the training data and then evaluated on held-out test runs. Performance remains strong across all individual datasets and the Combined setting. The Combined result is particularly important because it merges traffic from multiple sources and attack distributions, making it a stronger test of whether the representation can support detection across heterogeneous packet streams. TABLE I: Best SNN Performance per Network IDS Dataset Dataset JhybridJ_hybrid ADR FPReventFPR_event Packet Accuracy TON-IoT 0.9929 0.9952 0.0023 0.9826 Bot-IoT 0.9908 0.9998 0.0090 0.8665 TII-SSRC-23 0.9996 1.0000 0.0004 0.7952 Combined 0.9873 0.9986 0.0113 0.8750 These results are not intended as a direct state-of-the-art comparison against flow-based or heavily engineered IDS pipelines, since published systems often use different preprocessing, feature construction, task definitions, and evaluation settings. For context, prior work reports 99.99% accuracy on TON-IoT using CNNs [17], 99.87% on Bot-IoT using hybrid LSTM-CNNs [19], and 100% on TII-SSRC-23 using XGBoost [24]. The relevance of Table I is instead that edge-aligned SNNs can achieve high detection directly from packet arrivals while avoiding flow construction and dense feature engineering. Table IV isolates the role of the representation. Classical models trained on raw packet features perform poorly to moderately, indicating that the packet-level task is difficult when events are treated as static numeric records. When the same models are trained on the proposed encoded representation, performance improves for most classifiers. This shows that the encoder exposes class-relevant structure that is not as accessible in the raw numeric feature space. However, the encoded representation alone is not sufficient for strong detection with static classifiers. To provide a non-spiking recurrent-state comparison, we additionally evaluate an RNN using the same encoded event sequences. The RNN achieves Jhybrid=0.739J_hybrid=0.739, improving over the static Random Forest and Decision Tree models (Jhybrid=0.709J_hybrid=0.709), while the recurrent SNN reaches Jhybrid=0.987J_hybrid=0.987 with a substantially lower FPReventFPR_event of 0.0110.011, compared with 0.1400.140 for the RNN. Detection latency is measured as the number of packets between attack onset and the first alarm within the labeled attack interval. On the Combined dataset, the best individual network achieves a median detection latency of 55 packets, with 25% of attacks detected within 22 packets. During high-rate packet bursts, this corresponds to short response delays, further supporting the real-time motivation for event-driven neuromorphic intrusion detection. Together, these results indicate that a major obstacle to applying compact SNNs to cyber monitoring is representational: once native event semantics are preserved, sparse recurrent inference becomes a viable fit for asynchronous, edge-oriented cyber streams. TABLE IV: Baseline Comparison on the Combined Network IDS Dataset Model Representation JhybridJ_hybrid JhybridJ_hybrid 95% CI ADR FPReventFPR_event Packet Accuracy LR Raw 0.4367 [0.4150, 0.4584] 0.8729 0.4362 0.4698 LR Encoded 0.6811 [0.6673, 0.6948] 0.9364 0.2554 0.6444 RF Raw 0.7004 [0.6870, 0.7135] 0.9078 0.2074 0.5574 RF Encoded 0.7089 [0.6960, 0.7218] 0.9607 0.2517 0.6709 DT Raw 0.7068 [0.6934, 0.7200] 0.8937 0.1869 0.5428 DT Encoded 0.7088 [0.6958, 0.7216] 0.9607 0.2519 0.6708 GNB Raw 0.1098 [0.0982, 0.1213] 0.9972 0.8874 0.1520 GNB Encoded 0.5163 [0.5034, 0.5293] 0.9457 0.4294 0.4348 RNN Raw 0.4667 [0.4505, 0.4825] 0.9038 0.4371 0.4117 RNN Encoded 0.7389 [0.7248, 0.7527] 0.8789 0.1401 0.8764 SNN Encoded 0.9873 [0.9856, 0.9888] 0.9986 0.0113 0.8750 V-D Symbolic Feature-Group Ablation To assess the relative importance of each symbolic attribute, we performed a structured ablation study during network training. For each dataset, we evolved 200 SNNs: 25 networks for each of the 7 conditions where a single symbolic feature group was removed, and 25 control networks trained with all features. All ablations preserve native inter-event timing during SNN propagation because elapsed time governs recurrent spiking dynamics and is part of the asynchronous computation model. The ablation, therefore, evaluates the contribution of each symbolic input group while keeping the event-time substrate fixed. Fig. 2: Loss in JhybridJ_hybrid when individual symbolic feature groups are ablated, shown per dataset. As shown in Fig. 2, packet size and protocol are the most critical symbolic features across all datasets. Ablating packet size leads to the largest degradation (mean ΔJhybrid=−0.085 J_hybrid=-0.085), followed closely by protocol (ΔJhybrid=−0.047 J_hybrid=-0.047). This matches the high volume of small, identical-protocol packet bursts characteristic of DoS and DDoS attacks. Conversely, IP frequency and port groups show negligible impact, suggesting that the networks learn general traffic behaviors rather than overfitting to specific addresses or ports. VI CAN IDS Evaluation To test the transferability of our framework, we apply it to Controller Area Network (CAN) bus traffic, a structurally different asynchronous stream characterized by 11-bit arbitration IDs, short 8-byte payloads, and sub-millisecond inter-message spacing. CAN attacks typically inject spoofed frames to manipulate in-vehicle systems, demanding that a detector analyze both transmission timing and message payload sequences. VI-A Dataset and Preprocessing We evaluate using two public CAN benchmarks: ROAD [21] and Car-Hacking [20], alongside a Combined CAN dataset containing runs from both (Table V). ROAD provides dynamometer captures with long contiguous attack segments, while Car-Hacking represents short, burst-like injection campaigns. For evaluation, adjacent attack messages separated by fewer than 50 benign frames are merged into single attack intervals, and runs are padded with benign context. Splits are 60/10/30 for train/validation/test. TABLE V: CAN IDS Dataset Summary Dataset Runs Messages Attack % ROAD 28 25.8 M 3.06 Car-Hacking 2,404 24.9 M 9.35 Combined CAN 2,432 50.8 M 6.15 VI-B Encoding Scheme We adapt the three representational roles to CAN semantics, resulting in a 26-dimensional hybrid input vector (Table VI). TABLE VI: CAN Input Encoding and Input Dimensions Feature Group Features SNN In Description CAN ID freq 6 6 Sliding 1k window; one-hot: 0, 1–5, 6–10, 11–20, 21–40, 41+ Payload bytes 8 16 8 bytes × 2 (flip-flop rate coding) Δt t 4 4 <0.5<0.5 ms, 0.50.5–11 ms, 11–55 ms, ≥5≥5 ms Total 18 26 The framework does not require every field to be symbolic. It assigns encoding roles according to field semantics: symbolic identifiers are represented categorically, timing is discretized as Δt t, and payload bytes retain magnitude because their values carry meaningful signal content. This preserves native per-event structure while applying numeric spike encoding only where numeric magnitude is semantically meaningful. For CAN ID frequency, we count occurrences of each arbitration ID within a sliding 1,000-message window, binning the result into six categorical bins. Relative timing (Δt t) is binned into four classes representing sub-millisecond ranges. For numeric payload content, we employ flip-flop rate coding, assigning two input channels per payload byte to represent its continuous value as positive and negative deviation rates. VI-C Results and Baseline Comparison The CAN IDS evaluation serves the same purpose as the Network IDS evaluation: to test whether the proposed representation exposes useful structure from native event streams and whether recurrent spiking state adds temporal decision capacity beyond the encoded inputs alone. Unlike packet-level network traffic, CAN messages are shorter, more periodic, and dominated by arbitration ID, payload content, and sub-millisecond inter-message timing. This makes CAN a useful transfer test for the symbolic-temporal framework. Table VII reports the best evolved SNN for each CAN dataset. For each dataset, the reported network was selected as the highest-performing candidate on the training data and then evaluated on held-out test runs. The SNN achieves strong detection on both individual datasets and maintains high performance on the Combined CAN dataset, which merges short injection bursts with longer ROAD captures. TABLE VII: Best SNN Performance on CAN IDS Datasets Dataset JhybridJ_hybrid ADR FPReventFPR_event Message Accuracy Car-Hacking 0.9971 1.0000 0.0029 0.8418 ROAD 0.9850 1.0000 0.0150 0.9850 Combined 0.9803 1.0000 0.0197 0.9063 These results are not presented as a direct state-of-the-art comparison against all CAN IDS methods, since prior systems often use different preprocessing, feature construction, and evaluation procedures. Existing CAN detectors commonly report accuracies above 99% [9, 4]; the distinction here is that the proposed approach performs detection directly from message arrivals using an edge-aligned SNN and the event-native encoded representation. The lower message-level accuracy on Car-Hacking should be interpreted in light of our operational objective. ADR counts an attack as detected when at least one alarm occurs within its labeled interval, so high ADR can coexist with lower message-level accuracy. We use JhybridJ_hybrid as our primary operational metric for comparing attack detection and benign alarm activity across ROAD, Car-Hacking, and the Combined CAN setting, while reporting message-level accuracy as a complementary measure. Table VIII isolates the contribution of the representation on the Combined CAN dataset. Classical models trained on raw normalized features achieve limited performance. When trained on the proposed 26-dimensional hybrid encoding, performance improves for most baselines. This suggests that the encoding exposes useful structure from CAN ID frequency, payload behavior, and inter-message timing. TABLE VIII: Baseline Comparison on the Combined CAN Dataset Model Representation JhybridJ_hybrid JhybridJ_hybrid 95% CI ADR FPReventFPR_event Message Accuracy LR Raw 0.3741 [0.3042, 0.4555] 0.6263 0.2522 0.7412 LR Encoded 0.5140 [0.4196, 0.6235] 0.6824 0.1683 0.8236 RF Raw 0.8107 [0.7221, 0.9183] 0.8772 0.0665 0.9304 RF Encoded 0.8410 [0.7655, 0.9262] 0.8965 0.0555 0.9419 DT Raw 0.8174 [0.7467, 0.9004] 0.9115 0.0940 0.9063 DT Encoded 0.8485 [0.7910, 0.9167] 0.9185 0.0700 0.9294 GNB Raw 0.3049 [0.2374, 0.3822] 0.3424 0.0375 0.9288 GNB Encoded 0.2279 [0.1811, 0.2878] 0.2516 0.0237 0.9370 RNN Raw 0.9712 [0.9601, 0.9829] 0.9918 0.0206 0.6341 RNN Encoded 0.9719 [0.9579, 0.9830] 0.9726 0.0007 0.9660 SNN Encoded 0.9803 [0.9672, 0.9878] 1.0000 0.0197 0.9063 As in the Network IDS evaluation, the encoded representation improves the performance of static classifiers. A non-spiking RNN evaluated on the same encoded message sequences achieves a Jhybrid=0.9719J_hybrid=0.9719 (95% CI: [0.9579, 0.9830][0.9579,\,0.9830]), compared with Jhybrid=0.9803J_hybrid=0.9803 (95% CI: [0.9672, 0.9878][0.9672,\,0.9878]) for the SNN. These results indicate that temporal recurrence accounts for much of the improvement, while the SNN provides slightly improved performance in an event-driven, hardware-compatible form. Detection latency is measured as the number of CAN messages between attack onset and the first alarm within the labeled attack interval. On the Combined CAN dataset, the best individual network achieves a median detection latency of 48 messages, with 25% of attacks detected within 35 messages. At typical CAN bus message rates, this corresponds to short detection delays suitable for real-time edge monitoring. These results reproduce the central trend observed in the Network IDS study: when native event semantics are preserved in a meaningful representation, SNNs can use temporal state effectively while retaining the low-latency, event-driven computation needed for edge-oriented cyber monitoring. VII Discussion VII-A Temporal Validation of the Hybrid Objective A limitation of JhybridJ_hybrid is that ADR is interval-based. Long attack intervals provide more opportunities for an alarm to overlap an attack by chance, allowing a temporally uninformative detector to achieve an inflated ADR. We therefore evaluate whether the observed performance reflects meaningful temporal alignment between SNN activity and attack behavior. We apply a circular-shift control within each held-out run, randomly shifting the SNN output sequence to break its alignment with the attack labels while preserving its activity pattern. The rolling decision rule is then reapplied, and JhybridJ_hybrid, ADR, and FPReventFPR_event are recomputed over 10,000 shifts. TABLE IX: Observed and Temporally Shifted SNN Performance Application Evaluation JhybridJ_hybrid ADR FPReventFPR_event Network IDS Observed 0.9873 0.9986 0.0113 Shifted Mean 0.7540 0.8609 0.1069 CAN IDS Observed 0.9803 1.0000 0.0197 Shifted Mean 0.6490 0.7714 0.1224 Temporal shifting reduces mean JhybridJ_hybrid by 0.2333 for Network IDS and 0.3313 for CAN IDS (Table IX), with the observed score exceeding all 10,000 shifted replicates in both domains (p<0.0001p<0.0001). However, shifted ADR remains relatively high, confirming that long attack intervals can still produce chance overlap. We therefore evaluate whether alarms occur promptly and remain aligned with attack activity after onset. First, fixed-horizon analysis measures the cumulative fraction of attacks for which a new alarm episode begins within the first K events. For Network IDS, this reaches 40.5%, 75.6%, and 83.1% within 50, 100, and 250 events, compared with 25.7%, 31.7%, and 48.7% under temporal shifting. For CAN IDS, the corresponding observed rates are 52.1%, 74.8%, and 90.1%, compared with 3.9%, 7.0%, and 13.7%. Median detection latency is also substantially lower for the observed outputs: 55 versus 263 events for Network IDS and 48 versus >500>500 messages for CAN IDS. We additionally examine the instantaneous alarm state at specific positions relative to attack onset. This analysis shows whether alarm activity becomes concentrated after an attack begins. Network IDS increases from 11.0% of attacks in the alarm state at onset to 31.5% at event +49+49, while the shifted control remains near 16%. CAN IDS increases from 0.0% at onset to 52.1% at +49+49, while the shifted control remains near 37%. These results show that the high JhybridJ_hybrid scores are not explained by long attack intervals alone. Observed outputs produce alarms substantially earlier than shifted controls, while new alarm episodes and alarm-state activity are strongly aligned with attack onset. VII-B Topology Fig. 3: Evolved SNN topologies for Network IDS (top) and CAN IDS (bottom). Input neurons are blue, hidden are grey, and output are red. The evolved SNN topologies also highlight the deployment motivation for the proposed representation. The evolved Network IDS SNN (Fig. 3, top) uses only 46 neurons with dense recurrence, while still achieving high detection on the Combined dataset. This compact scale contrasts with typical deep IDS architectures, which rely on dense tensor operations and larger parameterized models. The input connections are concentrated around packet size (bins 28/30) and protocol (bins 20/21), which form recurrent hubs. This structural alignment with our ablation study suggests that the network routes information through the most discriminative encoding channels while suppressing brittle categorical indicators. Similarly, for the CAN IDS network (Fig. 3, bottom), EONS produced a compact recurrent core using active inputs from ID-frequency bins, payload byte channels, and inter-arrival timing bins. Several inputs are pruned, leaving a small set of connections associated with high-frequency ID transmission and payload deviations. This compact recurrent structure is particularly relevant for CAN monitoring, where short inter-message intervals make detection latency critical: the small topology and event-driven dynamics allow temporal evidence to be processed as messages arrive, without waiting for large windows or dense feature construction. The compact evolved topologies align with the μ -oriented deployment constraints [10]. μ is a small event-driven FPGA platform for neuromorphic edge applications. Hardware power and latency have also been evaluated on this platform in prior work: Ghawaly et al. [28] deployed compact EONS-evolved Integrate-and-Fire SNNs on μ and reported 2 mW power consumption with 20.2 ms inference latency. The resulting Network IDS and CAN IDS topologies fall within the same neuron, synapse, precision, and axonal-delay limits, indicating that the proposed event-native representation supports compact recurrent SNNs compatible with an established edge-oriented neuromorphic deployment path. Although the present work does not report physical hardware measurements for the cyber models, these constraints provide a hardware-aligned basis for future direct deployment from native packet and CAN event streams. VIII Limitations We acknowledge several limitations of this study. First, we do not claim that event-native spiking classifiers universally outperform conventional intrusion detection systems. Rather, our contribution is representational: we demonstrate that neuromorphic systems can perform event-native monitoring when cyber semantics are preserved at the input interface. Second, the encoding framework is domain-informed and relies on manually defined bin boundaries. Future work should investigate methods for learning these boundaries directly from data. Third, the RNN and conventional classifiers were tuned through limited sweeps over key hyperparameters rather than exhaustive optimization. Future evaluations could expand this comparison through more extensive tuning and the inclusion of GRUs, LSTMs, and temporal transformers. Additionally, JhybridJ_hybrid is an operational optimization objective rather than a conventional sample-level classification metric; because ADR is interval-based, we supplement it with additional temporal analyses to test whether detections are genuinely aligned with attack activity. Finally, our evaluations use public benchmark datasets and simulated hardware constraints; therefore, they do not capture all deployment challenges. IX Conclusion This paper addresses the representational gap at the intersection of spiking neural networks and cybersecurity. We introduced a symbolic-temporal spike encoding framework that maps heterogeneous, asynchronous cyber events directly to sparse, spike-compatible vectors at arrival. By assigning distinct encoding roles to semantic identity, local frequency context, and inter-event timing, the framework preserves categorical semantics and temporal spacing without converting events to artificial numeric averages. Across packet-level Network IDS and message-level CAN IDS, compact recurrent SNNs operating under edge-aligned μ constraints achieved strong detection (Jhybrid≥0.980J_hybrid≥ 0.980). The proposed event-to-spike representation interface preserves the symbolic and temporal structure of cyber streams, enabling edge-aligned SNNs to perform direct, low-latency neuromorphic monitoring on native event streams. References [1] W. Maass (1997) Networks of spiking neurons: the third generation of neural network models. Neural networks 10 (9), p. 1659–1671. Cited by: §I. [2] A. Lakhina, M. Crovella, and C. Diot (2005) Mining anomalies using traffic feature distributions. In Proceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, SIGCOMM ’05, New York, NY, USA, p. 217–228. External Links: ISBN 1595930094, Link, Document Cited by: §I, §V-A. [3] R. Sommer and V. Paxson (2010) Outside the closed world: on using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA, p. 305–316. External Links: Document Cited by: §I, §V-A. [4] S. Rajapaksha, H. Kalutarage, M. O. Al-Kadri, A. Petrovski, G. Madzudzo, and M. Cheah (2023) AI-based intrusion detection systems for in-vehicle networks: a survey. ACM Computing Surveys 55 (11), p. 1–40. External Links: Document Cited by: §I, §VI-C. [5] S. Zhou and X. Li (2021) Spiking neural networks with single-spike temporal-coded neurons for network intrusion detection. In 2020 25th International Conference on Pattern Recognition (ICPR), Milan, Italy, p. 8148–8155. Cited by: §I, §I-D. [6] M. Živadinović and D. Simić (2024) Resource efficient internet-of-things intrusion detection with spiking neural networks. In Position Papers of the 19th Conference on Computer Science and Intelligence Systems (FedCSIS 2024), Belgrade, Serbia, p. 73–78. External Links: Document Cited by: §I, §I-D. [7] P. S N, S. D, N. Shelke, A. Pimpalkar, D. K. Jang Bahadur Saini, and G. H. Kumar (2025) Event-driven intrusion detection systems using spiking neural networks for edge and iot security. In 2025 5th International Conference on Soft Computing for Security Applications (ICSCSA), Vol. , p. 41–47. External Links: Document Cited by: §I, §I-D. [8] D. R. Follett, D. Townsend, P. L. Follett, G. D. Karpman, J. H. Naegle, R. A. Suppona, J. B. Aimone, and C. D. James (2017) Neuromorphic data microscope. In Proceedings of the Neuromorphic Computing Symposium, NCS ’17, New York, NY, USA. External Links: ISBN 9781450364423, Link, Document Cited by: §I. [9] R. Islam, S. Alam, C. Yakopcic, N. Rahman, S. Khan, and T. Taha (2024) Unsupervised anomaly detection for automotive can bus on the intel loihi. In 2024 International Joint Conference on Neural Networks (IJCNN), Yokohama, Japan, p. 1–8. Cited by: §I, §I-D, §VI-C. [10] J. P. Mitchell, C. D. Schuman, and T. E. Potok (2020) A small, low cost event-driven architecture for spiking neural networks on fpgas. In International Conference on Neuromorphic Systems 2020, ICONS 2020, New York, NY, USA. External Links: Document, ISBN 9781450388511, Link Cited by: §I, §IV-B, §VII-B. [11] C. D. Schuman, J. P. Mitchell, R. M. Patton, T. E. Potok, and J. S. Plank (2020) Evolutionary optimization for neuromorphic systems. In Proceedings of the 2020 Annual Neuro-Inspired Computational Elements Workshop, New York, NY, USA, p. 1–9. Cited by: §I, §IV-B. [12] W. Gerstner and W. M. Kistler (2002) Spiking neuron models: single neurons, populations, plasticity. Cambridge University Press. Cited by: §I-A. [13] M. Bouvier, A. Valentian, T. Mesquida, F. Rummens, M. Reyboz, E. Vianello, and E. Beigne (2019) Spiking neural networks hardware implementations and challenges: a survey. ACM Journal on Emerging Technologies in Computing Systems (JETC) 15, p. 1–35. Cited by: §I-A. [14] M. Du, F. Li, G. Zheng, and V. Srikumar (2017) DeepLog: anomaly detection and diagnosis from system logs through deep learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS), p. 1285–1298. External Links: Document Cited by: §I-B. [15] H. Mei and J. Eisner (2017) The neural hawkes process: a neurally self-modulating multivariate point process. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 30, Red Hook, NY, p. 6754–6764. Cited by: §I-B. [16] G. Gallego, T. Delbrück, G. Orchard, C. Bartolozzi, B. Taba, A. Censi, S. Leutenegger, A. J. Davison, J. Conradt, K. Daniilidis, and D. Scaramuzza (2022) Event-based vision: a survey. IEEE Transactions on Pattern Analysis and Machine Intelligence 44 (1), p. 154–180. External Links: Document Cited by: §I-B. [17] H. Asgharzadeh, A. Ghaffari, M. Masdari, and F. S. Gharehchopogh (2024) An intrusion detection system on the internet of things using deep learning and multi-objective enhanced gorilla troops optimizer. Journal of Bionic Engineering 21 (5), p. 2658–2684. Cited by: §I-C, §V-C. [18] N. Moustafa (2021) A new distributed architecture for evaluating ai-based security systems at the edge: network ton_iot datasets. Sustainable Cities and Society 72, p. 102994. Cited by: §I-C, §V-A, §V-A, TABLE I. [19] P. Sinha, D. Sahu, S. Prakash, T. Yang, R. S. Rathore, and V. Pandey (2025) A high performance hybrid lstm cnn secure architecture for iot environments using deep learning. Scientific Reports 15. External Links: Document Cited by: §I-C, §V-C. [20] H. M. Song, J. Woo, and H. K. Kim (2020) In-vehicle network intrusion detection using deep convolutional neural network. Vehicular Communications 21, p. 100198. External Links: Document Cited by: §I-C, §VI-A. [21] M. E. Verma, R. A. Bridges, M. D. Iannacone, S. C. Hollifield, P. Moriano, S. C. Hespeler, B. Kay, and F. L. Combs (2024) A comprehensive guide to CAN IDS data and introduction of the ROAD dataset. PLoS ONE 19 (1), p. e0296879. External Links: Document Cited by: §I-C, §VI-A. [22] D. Bolzoni, B. Crispo, and S. Etalle (2007) ATLANTIDES: an architecture for alert verification in network intrusion detection systems. In 21st Large Installation System Administration Conference (LISA 07), Dallas, TX. External Links: Link Cited by: §IV-E. [23] N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull (2019) Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: bot-iot dataset. Future Generation Computer Systems 100, p. 779–796. External Links: ISSN 0167-739X, Document, Link Cited by: §V-A, §V-A, TABLE I. [24] D. Herzalla, W. T. Lunardi, and M. Andreoni (2023) TII-ssrc-23 dataset: typological exploration of diverse traffic patterns for intrusion detection. IEEE Access 11 (), p. 118577–118594. External Links: Document Cited by: §V-A, §V-A, §V-C, TABLE I. [25] V. Paxson and S. Floyd (1995) Wide area traffic: the failure of poisson modeling. IEEE/ACM Transactions on Networking 3 (3), p. 226–244. External Links: Document Cited by: §V-A, §V-B. [26] M. Cotton, L. Eggert, Dr. J. D. Touch, M. Westerlund, and S. Cheshire (2011) Internet Assigned Numbers Authority (IANA) Procedures for the Management of the Service Name and Transport Protocol Port Number Registry. Request for Comments, RFC Editor. Note: RFC 6335 External Links: Document, Link Cited by: §V-B. [27] IEEE (2022) IEEE standard for ethernet. Note: IEEE Std 802.3-2022 External Links: Document Cited by: §V-B. [28] J. Ghawaly, A. Nicholson, C. Schuman, D. Diez, A. Young, and B. Witherspoon (2025) Exploring spiking neural networks for binary classification in multivariate time series at the edge. In 2025 International Joint Conference on Neural Networks (IJCNN), Rome, Italy, p. 1–10. External Links: Link, Document Cited by: §VII-B.