Slips: Behavioral Evidence Aggregation for Network Security

2026-08-12

AI Summary

Traditional network intrusion detection systems struggle to integrate fragmented low-level alerts into coherent host-level behavioral assessments and often suffer from high false positive rates. This work proposes a host-centric behavioral profiling approach that organizes network activity within temporal windows, leverages a modular architecture to gather multi-source evidence, and performs context-aware aggregation at the host level for decision-making. The core innovation lies in a time-window-based mechanism for accumulating behavioral evidence, which aligns more closely with expert analytical reasoning. Evaluated on an expert-annotated dataset, the proposed method achieves an 83% higher recall and a 70% higher F1 score at the time-window level compared to Suricata, while producing zero false positives.

Abstract

Network intrusion detection systems often analyze individual packets or flows, although malicious behavior may develop across many connections and over time. This may limit their ability to combine isolated detections into a coherent assessment of host behavior. Packet-level features may also be too low-level for complex AI-based detection, requiring additional processing to improve accuracy while maintaining a low false-positive rate. We present Slips, a network intrusion detection system that builds host-centered behavioral profiles and organizes activity into time windows. It uses a modular architecture in which independent modules report evidence rather than generating final alerts directly. Slips then accumulates this evidence into host-level decisions. We evaluate Slips against Suricata on an expert-labeled PCAP dataset. At the profile-time-window level, Slips achieved 83% higher recall and a 70% higher F1 score than Suricata, while neither system produced false positives. These results indicate that time-window-based evidence accumulation can produce context-aware decisions that better align with expert judgment.

Problem

• network intrusion detection
• behavioral profiling
• evidence aggregation
• time-window analysis
• false-positive rate

Innovation

• behavioral profiling
• evidence aggregation
• time-window analysis
• host-centric detection
• modular intrusion detection