The increasing volume of network traffic and the growing sophistication of cyber-attacks pose challenges for the scalability and accuracy of Intrusion Detection Systems (IDS). A specific limitation is the difficulty of detecting intrusions and estimating the intensity of attacks in resource constrained environments, such as access networks with IoT devices. This article proposes a modular framework that encodes network flows into fixed size Bloom Filter matrices, enabling scalable and efficient learning through different modeling strategies. The methodology was validated using real traffic collected from a Brazilian broadband network. Four modeling approaches were evaluated under a unified training protocol: a baseline linear predictor, an XGBoost ensemble, a lightweight Simple CNN, and a Full CNN. The linear model exhibited limited performance, achieving an accuracy of <InlineEquation ID="IEq1"> <EquationSource Format="TEX">$0.9012$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.9012</mn> </mrow> </math></EquationSource> </InlineEquation> and an R<InlineEquation ID="IEq2"> <EquationSource Format="TEX">$^2$</EquationSource> <EquationSource Format="MATHML"><math> <mmultiscripts> <mrow /> <mrow /> <mn>2</mn> </mmultiscripts> </math></EquationSource> </InlineEquation> of <InlineEquation ID="IEq3"> <EquationSource Format="TEX">$0.0103$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.0103</mn> </mrow> </math></EquationSource> </InlineEquation>. The XGBoost ensemble improved results substantially, reaching an accuracy of <InlineEquation ID="IEq4"> <EquationSource Format="TEX">$0.9605$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.9605</mn> </mrow> </math></EquationSource> </InlineEquation> and an R<InlineEquation ID="IEq5"> <EquationSource Format="TEX">$^2$</EquationSource> <EquationSource Format="MATHML"><math> <mmultiscripts> <mrow /> <mrow /> <mn>2</mn> </mmultiscripts> </math></EquationSource> </InlineEquation> of <InlineEquation ID="IEq6"> <EquationSource Format="TEX">$0.5512$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.5512</mn> </mrow> </math></EquationSource> </InlineEquation>. The Simple CNN achieved near perfect classification with an accuracy of <InlineEquation ID="IEq7"> <EquationSource Format="TEX">$0.9929$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.9929</mn> </mrow> </math></EquationSource> </InlineEquation> and an R<InlineEquation ID="IEq8"> <EquationSource Format="TEX">$^2$</EquationSource> <EquationSource Format="MATHML"><math> <mmultiscripts> <mrow /> <mrow /> <mn>2</mn> </mmultiscripts> </math></EquationSource> </InlineEquation> of <InlineEquation ID="IEq9"> <EquationSource Format="TEX">$0.6258$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.6258</mn> </mrow> </math></EquationSource> </InlineEquation>. The Full CNN delivered the highest overall performance, attaining an accuracy of <InlineEquation ID="IEq10"> <EquationSource Format="TEX">$0.9929$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.9929</mn> </mrow> </math></EquationSource> </InlineEquation> and an R<InlineEquation ID="IEq11"> <EquationSource Format="TEX">$^2$</EquationSource> <EquationSource Format="MATHML"><math> <mmultiscripts> <mrow /> <mrow /> <mn>2</mn> </mmultiscripts> </math></EquationSource> </InlineEquation> of <InlineEquation ID="IEq12"> <EquationSource Format="TEX">$0.7824$</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mn>0.7824</mn> </mrow> </math></EquationSource> </InlineEquation>, with the narrowest confidence intervals across ten independent runs. These findings confirm the effectiveness of Bloom filter based summarization for intrusion detection and demonstrate that the convolutional architectures best exploit the spatial structure of the encoded representation, offering a favorable trade off between accuracy and computational cost for deployment in heterogeneous network environments.

Bloom filter matrix encoding of flows for multi-model intrusion detection and attack intensity prediction

期刊论文
发表日期：

2026年5月28日

查看全文

Ana Carolina Rocha Mendes,
Thi Mai Trang Nguyen,
Diogo M. F. Mattos

摘要

The increasing volume of network traffic and the growing sophistication of cyber-attacks pose challenges for the scalability and accuracy of Intrusion Detection Systems (IDS). A specific limitation is the difficulty of detecting intrusions and estimating the intensity of attacks in resource constrained environments, such as access networks with IoT devices. This article proposes a modular framework that encodes network flows into fixed size Bloom Filter matrices, enabling scalable and efficient learning through different modeling strategies. The methodology was validated using real traffic collected from a Brazilian broadband network. Four modeling approaches were evaluated under a unified training protocol: a baseline linear predictor, an XGBoost ensemble, a lightweight Simple CNN, and a Full CNN. The linear model exhibited limited performance, achieving an accuracy of $0.9012$ $0.9012$ and an R $^2$ $^{2}$ of $0.0103$ $0.0103$ . The XGBoost ensemble improved results substantially, reaching an accuracy of $0.9605$ $0.9605$ and an R $^2$ $^{2}$ of $0.5512$ $0.5512$ . The Simple CNN achieved near perfect classification with an accuracy of $0.9929$ $0.9929$ and an R $^2$ $^{2}$ of $0.6258$ $0.6258$ . The Full CNN delivered the highest overall performance, attaining an accuracy of $0.9929$ $0.9929$ and an R $^2$ $^{2}$ of $0.7824$ $0.7824$ , with the narrowest confidence intervals across ten independent runs. These findings confirm the effectiveness of Bloom filter based summarization for intrusion detection and demonstrate that the convolutional architectures best exploit the spatial structure of the encoded representation, offering a favorable trade off between accuracy and computational cost for deployment in heterogeneous network environments.