NeuroIDS: Neuromorphic Intrusion Detection System

Energy-efficient network intrusion detection using spiking neural networks for tactical and edge deployment.

NeuroIDS achieves 73.4% accuracy on the NSL-KDD benchmark while consuming only 1,620 pJ per inference—approximately 10,000x more energy-efficient than equivalent deep learning approaches. Unlike previous SNN-based IDS implementations that failed on minority attack classes, NeuroIDS successfully detects all five traffic categories including the challenging R2L and U2R attacks.

🎯 Key Results

Attack Category	Recall	Support	Notes
Normal	87.9%	9,711	Low false positive rate
DoS	67.4%	7,458	Denial of Service attacks
Probe	82.9%	2,421	Reconnaissance/scanning
R2L	33.7%	2,887	Remote to Local attacks
U2R	69.2%	67	User to Root privilege escalation

Overall Accuracy: 73.4% | Energy: 1,620 pJ/inference | All 5 classes detected

Comparison with Baseline SNN

Metric	Baseline SNN	NeuroIDS v4
Accuracy	63.0%	73.4%
Classes Detected	2/5	5/5
Probe Recall	0%	82.9%
R2L Recall	0%	33.7%
U2R Recall	0%	69.2%

Related Papers

This is the first paper in the NeuroIDS series:

Paper	Description	Link
NeuroIDS	Terrestrial SNN-based IDS (this repo)	DOI: 10.13140/RG.2.2.23827.13604
NeuroIDS-Sat	Space-adapted variant for CubeSat constellations with TMR radiation tolerance	DOI: 10.13140/RG.2.2.16893.42724
NeuroIDS-Adversarial	Adversarial robustness analysis and defensive hardening	GitHub

🚀 Quick Start

Installation

# Clone the repository
git clone https://github.com/SephDavis/NeuroIDS.git
cd NeuroIDS

# Install dependencies
pip install -r requirements.txt

Download NSL-KDD Dataset

1. Download from UNB NSL-KDD
2. Place KDDTrain+.txt and KDDTest+.txt in data/NSL-KDD/

Train the Model

python examples/train_nslkdd.py

Use Pre-trained Model

from src.neuroids_v4 import NeuroIDS

# Load pre-trained model
model = NeuroIDS.load('models/pretrained/nslkdd_model_v4.pkl')

# Predict on new data (normalized features, shape: [n_samples, 41])
predictions = model.predict(X_test)

# Get probabilities
probabilities = model.predict_proba(X_test)

# Evaluate
metrics = model.evaluate(X_test, y_test)
print(f"Accuracy: {metrics['accuracy']:.4f}")

📁 Project Structure

NeuroIDS/
├── src/
│   ├── neuroids_v4.py        # Main SNN implementation (USE THIS)
│   ├── data_augmentation.py  # SMOTE and class balancing
│   ├── data.py               # Data loading utilities
│   ├── neurons.py            # LIF neuron models
│   ├── encoders.py           # Spike encoding schemes
│   ├── layers.py             # SNN layer implementations
│   └── utils.py              # Helper functions
├── examples/
│   ├── train_nslkdd.py       # Full training script
│   ├── quick_start.py        # Basic usage example
│   └── energy_analysis.py    # Energy efficiency evaluation
├── models/
│   └── pretrained/
│       └── nslkdd_model_v4.pkl
├── data/
│   └── NSL-KDD/              # Place dataset here
├── docs/
│   └── NeuroIDS_Paper.pdf    # IEEE paper
├── tests/
│   └── test_network.py
├── requirements.txt
└── README.md

🧠 How It Works

Architecture

NeuroIDS uses a feedforward spiking neural network with Leaky Integrate-and-Fire (LIF) neurons:

Input (41 features) → Spike Encoding → Hidden Layer (128 LIF) → Hidden Layer (64 LIF) → Output (5 classes)

Key Innovations

1. Spike Count-Based Classification: Instead of backpropagating through non-differentiable spikes, we use accumulated spike counts as continuous features for the output layer. This enables stable gradient-based learning.

2. Adaptive Class Scaling: Dynamically adjusts class weights during training to prevent collapse to majority classes—critical for detecting rare attacks like U2R (only 52 training samples).

3. Balanced Sampling: Undersamples majority classes and oversamples minority classes to create balanced training batches without expensive synthetic data generation.

LIF Neuron Dynamics

V(t+1) = V_rest + (V(t) - V_rest) × exp(-Δt/τ_m) + R_m × I(t)

If V(t) ≥ V_thresh: spike and reset to V_reset

Parameter	Value
Membrane time constant (τ_m)	15.0 ms
Threshold (V_thresh)	0.5
Reset potential (V_reset)	0.0
Refractory period	2.0 ms

⚡ Energy Efficiency

NeuroIDS is designed for deployment on neuromorphic hardware where energy efficiency is critical:

Metric	Value
Average spikes per inference	810
Energy per spike (neuromorphic HW)	~2 pJ
Total SNN energy	1,620 pJ
Equivalent ANN energy	~68.8 mJ
Efficiency gain	~10,000-42,000×

At 1,620 pJ per inference, NeuroIDS can process ~600,000 samples/second/milliwatt, enabling:

• Battery-powered edge deployment
• Always-on monitoring in power-constrained environments
• Deployment on neuromorphic chips (BrainChip Akida, Intel Loihi)

📊 Training Your Own Model

Basic Training

from src.neuroids_v4 import NeuroIDS, NetworkConfig, create_ids_network
from src.data import DataLoader, normalize_features

# Load data
loader = DataLoader('data/NSL-KDD')
X_train, y_train = loader.load_train()
X_test, y_test = loader.load_test()

# Normalize
X_train, stats = normalize_features(X_train)
X_test, _ = normalize_features(X_test, stats=stats)

# Create model
model = create_ids_network('standard')  # or 'lightweight', 'deep', 'accurate'

# Train
history = model.fit(
    X_train, y_train,
    epochs=20,
    validation_data=(X_test, y_test),
    patience=5,
    verbose=True
)

# Save
model.save('my_model.pkl')

Custom Configuration

from src.neuroids_v4 import NeuroIDS, NetworkConfig

config = NetworkConfig(
    input_size=41,
    hidden_sizes=[256, 128, 64],  # Deeper network
    output_size=5,
    time_steps=150,               # Longer simulation
    v_thresh=0.5,
    tau_m=15.0,
    spike_rate=0.3,
    learning_rate=0.01,
    weight_decay=0.0001
)

model = NeuroIDS(config)

With Data Augmentation

from src.data_augmentation import balance_dataset, AugmentationConfig

# Balance training data
aug_config = AugmentationConfig(
    min_samples_per_class=2000,
    target_ratio=0.6,
    smote_k_neighbors=5
)
X_balanced, y_balanced = balance_dataset(X_train, y_train, aug_config)

# Train on balanced data
model.fit(X_balanced, y_balanced, ...)

🔬 Reproducing Paper Results

To reproduce the results from the paper:

# Full training with synthetic validation + NSL-KDD
python examples/train_nslkdd.py

Expected output:

Overall Accuracy: 0.7342
  normal: P=0.711 R=0.879 F1=0.786
  dos:    P=0.900 R=0.674 F1=0.771
  probe:  P=0.644 R=0.829 F1=0.725
  r2l:    P=0.645 R=0.337 F1=0.443
  u2r:    P=0.106 R=0.692 F1=0.184

🎯 Use Cases

Tactical/Military Networks

• Forward operating bases with limited power
• Unmanned systems (drones, UGVs)
• Satellite communication endpoints

IoT/Edge Security

• Smart grid monitoring
• Industrial control systems
• Connected vehicle networks

Resource-Constrained Environments

• Remote sensors
• Battery-powered devices
• Embedded security appliances

📈 Future Work

• Hardware validation on BrainChip Akida
• Intel Loihi deployment
• STDP-based unsupervised pre-training
• Temporal/latency encoding schemes
• Evaluation on CICIDS2017/2018 datasets
• Adversarial robustness analysis → NeuroIDS-Adversarial

📄 Citation

If you use NeuroIDS in your research, please cite:

@article{davis2026neuroids,
  title={NeuroIDS: Energy-Efficient Intrusion Detection Using Spiking Neural
         Networks for Tactical Network Defense},
  author={Davis, Toby R.},
  doi={10.13140/RG.2.2.23827.13604},
  year={2026}
}

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Department of Defense Cyber Service Academy Scholarship Program
• Mississippi State University Department of Computer Science and Engineering
• NSL-KDD dataset creators at the University of New Brunswick

📧 Contact

Toby R. Davis M.S. Candidate, Cybersecurity & Operations Mississippi State University Email: trd183@msstate.edu GitHub: @SephDavis

---

NeuroIDS — Bringing neuromorphic computing to cybersecurity 🧠🔒