Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Temporal Analysis Framework for Intrusion Detection Systems: A Novel Taxonomy for Time-Aware Cybersecurity

Tatiana S. Parlanti, Carlos A. Catania

TL;DR

The paper addresses the deficit in early threat detection by introducing a temporal analysis framework and taxonomy for time-aware NIDS. Through a systematic review of publications from 2020–2025, it classifies approaches into five temporal categories (S.1–T.3) and maps them to MITRE ATT&CK tactics, revealing coverage gaps and dataset biases toward late-stage attacks. The work highlights the need for temporally rich datasets and richer evaluation metrics to assess early detection and generalization across networks. Overall, the framework aims to shift intrusion detection toward proactive defense by enabling detection of evolving adversarial patterns across the attack lifecycle.

Abstract

Most intrusion detection systems still identify attacks only after significant damage has occurred, detecting late-stage tactics rather than early indicators of compromise. This paper introduces a temporal analysis framework and taxonomy for time-aware network intrusion detection. Through a systematic review of over 40 studies published between 2020 and 2025, we classify NIDS methods according to their treatment of time, from static per-flow analysis to multi-window sequential modeling. The proposed taxonomy reveals that inter-flow sequential and temporal window-based methods provide the broadest temporal coverage across MITRE ATT&CK tactics, enabling detection from Reconnaissance through Impact stages. Our analysis further exposes systematic bias in widely used datasets, which emphasize late-stage attacks and thus limit progress toward early detection. This framework provides essential groundwork for developing IDS capable of anticipating rather than merely reacting to cyber threats, advancing the field toward truly proactive defense mechanisms.

Temporal Analysis Framework for Intrusion Detection Systems: A Novel Taxonomy for Time-Aware Cybersecurity

TL;DR

The paper addresses the deficit in early threat detection by introducing a temporal analysis framework and taxonomy for time-aware NIDS. Through a systematic review of publications from 2020–2025, it classifies approaches into five temporal categories (S.1–T.3) and maps them to MITRE ATT&CK tactics, revealing coverage gaps and dataset biases toward late-stage attacks. The work highlights the need for temporally rich datasets and richer evaluation metrics to assess early detection and generalization across networks. Overall, the framework aims to shift intrusion detection toward proactive defense by enabling detection of evolving adversarial patterns across the attack lifecycle.

Abstract

Most intrusion detection systems still identify attacks only after significant damage has occurred, detecting late-stage tactics rather than early indicators of compromise. This paper introduces a temporal analysis framework and taxonomy for time-aware network intrusion detection. Through a systematic review of over 40 studies published between 2020 and 2025, we classify NIDS methods according to their treatment of time, from static per-flow analysis to multi-window sequential modeling. The proposed taxonomy reveals that inter-flow sequential and temporal window-based methods provide the broadest temporal coverage across MITRE ATT&CK tactics, enabling detection from Reconnaissance through Impact stages. Our analysis further exposes systematic bias in widely used datasets, which emphasize late-stage attacks and thus limit progress toward early detection. This framework provides essential groundwork for developing IDS capable of anticipating rather than merely reacting to cyber threats, advancing the field toward truly proactive defense mechanisms.

Paper Structure

This paper contains 41 sections, 8 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Methodology
  3. Search Strategy and Information Resources
  4. Query Construction and Filtering Process
  5. Selection and Analysis Process
  6. Background
  7. Learning Approaches
  8. Machine Learning (ML)
  9. Deep Learning (DL)
  10. Graph-Based Deep Learning
  11. Common Metrics
  12. Adversarial Tactics
  13. Related Works
  14. Taxonomy
  15. Temporal Dimension
  16. ...and 26 more sections

Figures (8)

  • Figure 1: Taxonomy examples S.1 and S.2.
  • Figure 2: Case examples T.1, T.2, and T.3.
  • Figure 3: Number of articles that address temporality in different ways, broken down by year of publication.
  • Figure 4: Datasets used in the literature analyzed. On the left, the frequency of each dataset is shown, while on the right, this is seen when grouped by family.
  • Figure 5: Number of articles that use the different datasets, broken down by year of publication. The order on the abscissa is ascending, starting with KDD-Cup99 kddcup99, which is a 1999 dataset, and ending with CIC-IoT2023 Neto2023CICIoT2023 from 2023.
  • ...and 3 more figures