The Value of Spike Timing: A Leakage-Resistant Benchmark of SNN Design Choices for Network Intrusion Detection

Abstract

Spiking neural networks (SNNs) are increasingly studied for network intrusion detection, but comparative evidence on how neuron models and spike encodings affect performance remains limited. Evaluation choices can influence results when preprocessing, capture structure, or scenario information crosses the train--test boundary. We evaluate nine snnTorch neuron families with three spike encodings, yielding 27 SNN configurations across four intrusion-detection benchmarks. We screen the design space and then repeat the evaluation using train-only transforms, seed-independent partitions, and capture- or scenario-aware separation. In our study, LeakyParallel/latency ranked first in both 27-configuration evaluations. The leading configurations identified during screening also remained largely consistent under confirmation, indicating that screening preserved the ordering useful for design selection even when the measured performance changed under the stricter protocol. We then examine what latency coding contributes by holding the active spike set fixed and changing only its temporal organization. At the main T=25 operating point, mapping feature magnitude to spike time improved macro-F1 on all five confirmation protocols, while spreading the same spikes through time without that mapping could either improve or reduce performance. This shows that the effect of latency coding comes from both the information carried by spike time and how those spikes interact with the temporal dynamics of the network. Finally, sparse input encoding does not directly translate into sparse internal activity, although latency coding requires fewer fanout-weighted operations than rate coding in the evaluated models. Overall, the results show that SNN design choice, evaluation protocol, spike-timing representation, and computational activity should be examined separately when applying SNNs to static network-flow data.