eBiTCN: Efficient bidirectional temporal convolution network for encrypted malicious network traffic detection

Abstract

The growing prevalence of encrypted malicious network traffic poses significant challenges for cybersecurity, as it conceals the content from traditional detection methods. Temporal convolutional networks (TCNs) present promising capabilities for extracting complex temporal features and patterns from the dynamic traffic flow data. However, the unidirectional nature of traditional TCNs limits their effectiveness in capturing the full context of network traffic, which often exhibits bidirectional temporal dependencies. Consequently, a few studies have proposed bidirectional TCN (BiTCN) architectures to address the limitations. However, these methods present complex architectures that require a significant amount of parameters to be learned, which imposes high memory requirements on the computational resources for training such models. In this study, we introduce the efficient bidirectional TCN (eBiTCN) model, an efficient BiTCN that requires fewer parameters yet not at the expense of computational cost and effective detection. The eBiTCN framework combines a bidirectional processor, a lightweight gating mechanism, temporal attention, dropout, a novel loss function, and dense layers. Extensive experiments show that eBiTCN outperforms eight state-of-the-art competing models in terms of detection efficacy, speed, and scalability. The eBiTCN model showcased robust performance in detecting evolving attacks and excelled across various real-world datasets. Its efficiency in training speed and reduced memory usage translates to lower infrastructure costs, making it an accessible and effective choice for deployment. These findings highlight eBiTCN’s practicality and dependability in addressing contemporary network security needs.

Keywords

Network security bidirectional temporal convolution network malicious traffic temporal attention computational cost

1. Introduction

With the rapid proliferation of encryption technologies, the detection of malicious network traffic has become a critical challenge in cybersecurity.¹ The increasing use of encryption protocols such as transport layer security (TLS) and secure sockets layer has led to a situation where a substantial portion of network traffic is opaque to traditional intrusion detection system (IDS) methods.^2,3 This has necessitated the development of new techniques that can detect anomalies and potential security threats without compromising the privacy of encrypted data.⁴ Deep learning, with its ability to automatically extract features and learn complex patterns from data, offers a promising solution to this challenge.^5,6 Among the deep learning architectures, temporal convolutional networks (TCNs) have shown particular promise in handling sequential data due to their capacity to capture temporal dependencies.⁷ However, the unidirectional nature of traditional TCNs limits their effectiveness in capturing the full context of network traffic, which often exhibits bidirectional temporal dependencies.⁸ Consequently, a section of studies^9,10 proposes bidirectional TCNs (BiTCNs). The transition from traditional TCNs to BiTCNs is motivated by the recognition that network traffic exhibits complex temporal dependencies that are not fully captured by unidirectional processing.¹¹ By incorporating bidirectional processing, BiTCNs can consider both the past and future contexts of a data point, providing a more comprehensive understanding of the temporal dynamics within network traffic. This enhanced representation is essential for accurately detecting malicious patterns that may span across extended periods and involve intricate cause-and-effect relationships, which are often overlooked by models that analyze data in a single direction.

However, while these proposed BiTCN architectures have proven effective to some extent, they are hindered by several drawbacks. First, these methods require a large number of parameters to be learned, which imposes high memory requirements on the computational resources for training such models. The computational complexity of BiTCN architectures can be challenging, particularly in real-time or resource-constrained environments.¹² The bidirectional processing, while beneficial for capturing temporal dependencies, doubles the computational load compared to unidirectional networks.¹³ This increased complexity can lead to longer training times and higher memory requirements, which are not always feasible in operational settings. As such, these architectures are unable to efficiently handle long sequences, as the computational complexity increases with the length of the input data. Secondly, the data requirements for training deep learning models, including BiTCNs, are often extensive. These models necessitate large volumes of labeled data to achieve high accuracy, which can be challenging to obtain, especially for encrypted traffic, due to privacy concerns and the rapidly evolving landscape of network protocols and threats.¹⁴ The lack of publicly available, representative datasets further exacerbates this issue, potentially limiting the generalizability of the models. Cai et al.⁹ and Chen et al.,¹⁰ for instance, crafted datasets for this task. Also, existing BiTCNs architectures in the literature are not optimized for dealing with the unique characteristics of encrypted network traffic, where the payload is obscured, and only metadata is available for analysis.¹⁵ In light of these limitations, an efficient model that can effectively detect malicious activities in encrypted network traffic without succumbing to the aforementioned challenges is preferred.

To address this problem, we introduce a novel efficient BiTCN that requires an order of magnitude fewer parameters than existing BiTCN approaches. The development of such a model requires innovative approaches that balance computational efficiency with the model’s ability to learn from complex and dynamic traffic patterns while minimizing the reliance on large labeled datasets. The bidirectional structure of our proposed network combines dilated convolutions, depthwise separated convolutions, Gaussian error linear unit (GELU) activation function, temporal consistency loss function, temporal attention, and a bidirectional processing module that allows it to process traffic data in both forward and reverse temporal orders. By stacking layers of dilated causal convolutional nets, receptive fields can be increased, and the long-term correlations can be captured without violating the temporal orders.¹⁶ In addition, in dilated causal convolutional architectures, the training process can be performed in parallel, which guarantees computation efficiency. This approach enables the model to learn from the past to predict the future and vice versa, enhancing its ability to identify patterns indicative of malicious activities. The core contributions of the eBiTCN model for encrypted network traffic detection are as follows:

(1)
Bidirectional temporal analysis: The model’s ability to process network traffic data in both forward and reverse directions, capturing a more comprehensive set of temporal features and dependencies. This dual-processing approach enhances the model’s understanding of the traffic patterns and improves the detection of encrypted traffic anomalies.
(2)
Computational efficiency: eBiTCN is designed to necessitate significantly fewer parameters compared to conventional BiTCNs. This mechanism allows the model to adapt to the complexity of the data and allocate computational resources efficiently, leading to better utilization of model capacity and potentially higher detection accuracy. Our approach enables the training of our model on more affordable hardware, as it demands significantly less graphics processing unit (GPU) memory—about 2 to 4 times less, varying with batch size. Furthermore, this method cuts down on the energy needed for training by at least 20%, thereby lowering the expenses associated with model training.
(3)
Introduction of a novel loss function: The model’s design includes strategies to handle class imbalance, such as weighted loss functions and data augmentation techniques, which are crucial for encrypted traffic datasets where anomalies are rare. These strategies help improve the model’s ability to detect rare but critical security threats. A novel loss function that adeptly addresses the dual challenges of class imbalance and the need for temporal sensitivity in sequence modeling. This function combines weighted cross-entropy with a temporal consistency term, enhancing the model’s ability to detect underrepresented malicious patterns while maintaining a strong focus on temporal dynamics.
(4)
Comprehensive and performance evaluation: A thorough evaluation of eBiTCN using the CICIDS-2018, and Stratosphere, MAWILab, ISCXVPN2016, USTC-TFC2016, and UJS-IDS2022 datasets and a variety of performance metrics are performed to provide evidence of the model’s effectiveness and efficiency in detecting encrypted traffic anomalies.
The uniqueness of our approach stems from its use of a simple convolutional architecture, leveraging bidirectional temporal processing and optimized dilated convolutions for improved pattern recognition. This design captures complex dependencies within encrypted traffic, enhancing detection capabilities in resource-constrained environments. The incorporation of a custom loss function addresses class imbalance and ensures sensitivity to crucial temporal patterns also offers unique contributions suitable for real-time detection and scalability. The remainder of this article is structured as follows: Sections 2 to 6 present related works, our proposed method, the experimental setup, results, and the conclusion concludes the article, respectively.
2. Related studies

The detection of malicious traffic has been approached with deep learning-based time-series techniques.¹⁷ Recurrent networks, specifically long short-term memory (LSTM) and gated recurrent unit (GRU) architectures, have been widely utilized due to their ability to capture temporal dependencies within data.¹⁸ However, these models face several challenges when applied to the problem of malicious network traffic detection. One of the primary challenges is the high dimensionality and volume of network traffic data. Recurrent networks process data sequentially, which can be computationally intensive and may not meet the real-time requirements necessary for efficient traffic detection.¹⁹ The attention mechanism has been introduced to help allocate computational resources effectively, focusing on the recognition of malicious traffic features within the data flow.²⁰ However, the integration of attention mechanisms adds complexity to the model, potentially impacting its efficiency.¹³ Overfitting is a common concern with complex models like recurrent networks.²¹ With a large number of parameters, these models may perform well on training data but fail to generalize to new, unseen traffic patterns.²² To mitigate this, techniques such as max-pooling and avg-pooling are employed to reduce model complexity and improve generalization. Parameter management is also crucial. The initialization and tuning of parameters in LSTM and GRU networks are essential for capturing the temporal dynamics of network traffic effectively. However, with high-dimensional feature spaces, this process can become quite intricate. To address these limitations, some studies adopted TCNs for the detection of malicious traffic.^23,24 TCNs are adept at handling time-series data, which is prevalent in network traffic analysis. They are designed to perform well on tasks that can be processed in parallel and are capable of adaptively learning complex structures, including those within time-series data. TCNs also exhibit stable gradients, making them relatively easier to train and allowing for quick convergence to an optimal solution.^19,25,26

However, TCNs have their limitations. One significant limitation is their inability to capture the bidirectional semantics of the data since they lack a bidirectional network structure. This can be a drawback when dealing with network traffic that may have patterns or anomalies that are better understood in the context of both past and future data points within a given timeframe.⁹ Additionally, TCNs have been reported to have weak noise resistance, which can lead to the learning of irrelevant features when processing complex data like source code, potentially impacting the accuracy of vulnerability detection.²⁷ To address these limitations, a few studies^9,27 introduced BiTCNs. These models leverage both forward and backward sequences to capture a more comprehensive representation of the data, which can be particularly beneficial for tasks like source-code vulnerability detection where the context around a piece of code can be crucial. BiTCNs aim to enhance the model’s attention to features associated with vulnerabilities by considering the data’s temporal dependencies in both directions.¹⁰ Despite the advantages, BiTCNs also have their weaknesses. One of the primary concerns is the increased complexity of the model, which can lead to higher computational costs and potentially slower training times. In certain situations, the use of multihead self-attention mechanisms can exacerbate the problem as observed in previous studies.⁹

Despite the improvements it offers, the model struggles with real-time analysis due to the computational demands of the bidirectional and attention mechanisms.¹³ Additionally, while BiTCNs improve context awareness, they may still struggle with very long-range dependencies, as the network’s ability to capture information over long distances can be limited by the architecture’s design. Furthermore, the integration of bidirectional processing can sometimes lead to overfitting, particularly when the volume of training data is insufficient to support the increased model complexity.¹⁹ In sum, many deep learning approaches such as GRUs, LSTMs, self-attention, transformers, TCNs, and BiTCNs have been used for the detection of malicious network traffic tasks. However, these methods present architectures that suffer from high memory usage, large amounts of operations, or poor gradients. Therefore, the architectural design of these models must carefully balance the benefits of bidirectional processing with the potential drawbacks of increased complexity and the risk of overfitting.

3. Proposed method

3.1. Overview of the eBiTCN model

The proposed model, eBiTCN is designed to achieve the following objectives: capture long-range dependencies as the length of the input network traffic data increases; address the computational complexity associated with recurrent network structures; reduce the number of parameters used in BiTCNs architectures to create a more efficient network; Improve detection accuracy for encrypted malicious network traffic; and facilitate parallel computation for faster training and inference. The road map and the proposed architecture are shown in Figures 1 and 2. The eBiTCN architecture includes a combination of bidirectional processing, efficient convolutional strategies, and a temporal attention mechanism, to provide a state-of-the-art solution for the challenge of detecting malicious activities in encrypted network traffic. At its core, eBiTCN employs a bidirectional approach to capture temporal dependencies within network traffic flows. Unlike traditional TCNs, the bidirectional nature of eBiTCN allows for the consideration of both past and future context, which is paramount for understanding the sequential nature of network traffic and for identifying patterns indicative of malicious activity. The dilated convolutions within the TCN layers are specifically engineered to handle long-range temporal patterns, enabling the model to interpret sequences without the need for recurrent structures, which are typically associated with higher computational costs. This design choice facilitates parallel computation and reduces the model’s training and inference times significantly, a critical advantage for real-time network security applications.

To optimize parameter efficiency, eBiTCN integrates depthwise separable convolutions, which decompose the learning of spatial features and cross-channel correlations, thus requiring fewer parameters than conventional convolutional layers. This reduction in parameters does not come at the cost of performance; rather, it ensures that the model remains lightweight and scalable. A novel gating mechanism is introduced to synthesize the information processed by the bidirectional layers. This mechanism selectively combines the features from the forward and reverse TCNs, allowing eBiTCN to maintain a balance between data from different time perspectives. The gating mechanism is designed to be lightweight, sharing parameters between directions and avoiding excessive matrix multiplications that would otherwise increase the computational load. The temporal attention layer in eBiTCN aids in calculating attention weights for each time step. This allows the model to dynamically focus on the most informative parts of the traffic sequence. This focused processing aids in isolating subtle anomalous signals that could be indicative of encrypted threats. Post attention, the aggregation layer plays a critical role in distilling the context-rich sequence data into a singular, coherent form suitable for classification. The approach to aggregation is carefully chosen to maintain the integrity of temporal information while preparing the data for the final decision-making layers. To handle varying network traffic loads efficiently, we implement adaptive batch processing following Algorithm 1. The batch size is dynamically adjusted based on current traffic conditions, optimizing resource usage without compromising detection accuracy. Finally, eBiTCN utilizes rich attention-processed features to differentiate between benign and malicious traffic.

The components of the eBiTCN model interact in a cohesive manner to enhance its performance in detecting malicious network traffic. The bidirectional temporal convolutions extract features from both past and future contexts. The outputs from these convolutions are then synthesized by the gating mechanism, which combines the forward and reverse features, effectively balancing the information from different time perspectives. The dilated convolutions increase the receptive field, allowing the model to capture long-range dependencies without significantly increasing the number of parameters. The output from the dilated convolutions is combined with features from depthwise separable convolutions, which optimize the model by reducing the parameter count while maintaining the ability to learn complex patterns. The temporal attention layer interacts with the outputs from both the bidirectional and depthwise separable convolutions by calculating attention weights that highlight the most informative time steps. This dynamic focus guides the model to emphasize critical features, which are then passed to the aggregation layer. The aggregation layer consolidates the enriched outputs from the attention mechanism and the gating mechanism, preparing a coherent representation of the sequence data for classification. Lastly, adaptive batch processing adjusts the batch size based on current traffic conditions, ensuring that the entire model pipeline operates efficiently under varying loads.

Figure 1.

Efficient bidirectional temporal convolution network (eBiTCN) roadmap.

Figure 2.

Architecture of efficient bidirectional temporal convolution network (eBiTCN).

3.2. Data preprocessing

The preprocessing module as shown in Figure 1 handles the challenges of encrypted data by focusing on available metadata, adapting to protocol dynamics, and ensuring data integrity. It uses normalization, feature extraction, dimensionality reduction, and validation algorithms to refine the dataset for the detection of abnormal encrypted traffic. The Joy tool was leveraged to parse PCAP files used to store the network traffic. These files are converted into a JSON format that is more tractable for further processing. Following the initial conversion, the JSON-formatted data undergoes a cleansing and filtering process implemented within the preprocessing module. By addressing the challenge of accessing encrypted content, our approach focuses on analyzing packet headers. Although encrypted, these headers contain a wealth of metadata. While they don’t reveal the payload, they offer valuable insights into the structure and behavior of the traffic. Timestamps, sequence numbers, and port numbers are metadata elements used to construct an initial feature set. These features are then normalized to ensure that no single attribute unduly influences the model due to its magnitude, thus maintaining a balanced representation of the traffic data. To capture the dynamic nature of encrypted protocols such as TLS, the module employs a combination of clustering and principal component analysis (PCA) dimensionality reduction techniques. K-means clustering segments the traffic into groups based on behavioral patterns, while PCA simplifies the data by identifying and projecting it onto the principal components that capture the most significant variance.²⁸

3.3. Bidirectional processing module

The bidirectional processing layer of the eBiTCN framework is designed to enhance the model’s ability to capture both past and future contexts within encrypted network traffic while optimizing computational resources. The bidirectional convolutions at the heart of this layer are designed to process the input sequence in both forward and reverse temporal directions. Each temporal directional block consists of a set of bidirectional dilated convolutions,²⁹ parameter-shared layers, and depthwise separable convolutions, all activated by GELU. The bidirectional dilated convolution can be expressed as follows:

Output (t) = \sum_{k = - K}^{K} {Conv}_{d} (Input (t + k))

(1)

where

{Conv}_{d}

represents the dilated convolution operation with a dilation factor

d

, and

K

is the kernel size. The negative indices for

k

indicate that the convolution is applied in both forward and backward directions along the time axis, capturing the context from both the past and future of the current time step

t

. This dual processing provides the model with a comprehensive view of the temporal context, allowing it to discern patterns and anomalies that may be indicative of malicious activities. The bidirectional convolutions are articulated as follows:

\begin{aligned} Y^{(forward)} = X * W \end{aligned}

(2)

\begin{aligned} Y^{(backward)} = X \circ W \end{aligned}

(3)

where

X

is the input sequence,

W

is the weight matrix, and the operations

*

and

\circ

denote the standard and reverse convolutions, respectively. To reduce the model’s parameter count, the same weight matrix

W

is used for both forward and backward convolutions as follows:

Y = Y^{(forward)} + Y^{(backward)}

(4)

This unique strategy significantly reduces the model’s parameter count by utilizing a single set of weights for both directions and also encourage learning of shared representations from the data to enhance generalization capabilities. Depthwise separable convolutions are another technical refinement of the bidirectional processing layer. These convolutions decompose the computationally intensive standard convolution into a sequence of depthwise operations, which act on each channel independently, followed by a pointwise operation that merges the results. This decomposition reduces the computational cost and the number of parameters, aligning with our objective of creating an efficient network architecture. The gating mechanism within the bidirectional processing layer introduces an adaptive flow of information, modulating the influence of the input sequence on the output based on the learned weights. This mechanism is formulated as follows:

G = σ (W_{g} \cdot [Y^{(forward)}, Y^{(backward)}] + b_{g})

(5)

where

σ

is the sigmoid activation function, and

W_{g}

and

b_{g}

are the weight matrix and bias term for the gating mechanism, respectively. The outputs from the bidirectional convolutions and the gating mechanism are concatenated to form a unified representation that encapsulates the temporal dynamics of the input sequence and is activated with GELU.³⁰ Rectified linear unit (ReLU) is the original activation function of conventional TCN. Although known for its simplicity and effectiveness in solving the vanishing gradient problem, ReLU is not differentiable at zero, which can lead to issues during gradient updates where some neurons may become inactive or “die” if their weights are not updated.³¹ ReLU introduces a binary threshold behavior, which can lead to neurons having activations that are approximately uniformly distributed, potentially reducing the model’s ability to learn complex functions.³² To avoid the above challenges in eBiTCN, we replace the ReLU activation function in the original TCN with GELU, as it leads to a more robust and adaptive learning process. GELU is a smooth and differentiable function, which allows for more stable and continuous gradient updates. A visual representation of a single TCN layer is displayed in Figure 3. Within our network, every TCN layer is made up of a block that includes several components: a dilated convolution, depthwise separable convolution, GELU for activation, a dropout mechanism, and a fully connected layer. The GELU activation operates by taking an input value, denoted as

x

, and applying it to the Gaussian distribution’s cumulative distribution function

Φ (x)

. The mathematical expression for GELU is as follows:

GELU (x) = x P (X \leq x) = x Φ (x) \approx 0.5 x (1 + \tanh (\sqrt{2 / π} (x + 0.044715 x^{3})))

(6)

This GELU activation offers a gentler transition compared to the standard ReLU and tends to enhance the performance of the network. Each TCN layer generates a hidden state

h_{N}

and an output

o_{N}

. The outputs from all layers are then aggregated to form the final network output. To optimize the performance, we apply weight normalization, to both the dilated convolution and the fully connected layers within our network. Our approach to the temporal block deviates from that of WaveNet³³ by omitting the need for a gated activation mechanism. Instead, we rely on the GELU activation to introduce non-linearity into our model. As detailed in our results in Section 5 and its subsections, this streamlined design choice has been shown to enhance the network’s performance.

Figure 3.

Elements of forward and reverse temporal convolutional network (TCN) blocks.

3.4. Temporal attention module

The temporal attention module serves as a mechanism to refine the model’s focus on the most relevant temporal aspects of the input sequence. This module is positioned after the bidirectional processing layer, where it recalibrates the model’s attention based on the significance of different time steps, thereby enhancing the overall performance of the network in capturing long-term dependencies and identifying patterns indicative of malicious activities. The temporal attention module operates on the principle that not all elements within a sequence contribute equally to a classification task. Consequently, by dynamically adjusting the focus to the most informative time steps, the module enables the model to allocate computational resources more effectively, leading to improved efficiency and accuracy. The temporal attention module is formulated using a weighted sum of the input sequence, where the weights are determined by the attention scores associated with each time step. The attention score for a given time step $t$ is computed using a softmax function over a scoring function $f$ that captures the relevance of each time step:

{Attention Score}_{t} = \frac{\exp (f (Input (t)))}{\sum_{τ} \exp (f (Input (τ)))}

(7)

Here,

f (Input (t))

is the scoring function that measures the relevance of the input at time step

t

, and the denominator normalizes the attention scores to sum up to one, ensuring that they represent a valid probability distribution.³⁴ The scoring function itself can be a simple function of the input, such as a linear transformation followed by a non-linear activation function:

f (Input (t)) = σ (W \cdot Input (t) + b)

(8)

where

W

is a weight matrix,

b

is a bias term, and

σ

is an activation function. Once the attention scores are computed, they are used to weight the input sequence, resulting in a contextually enhanced representation as follows:

Weighted Sum = \sum_{t} {Attention Score}_{t} \cdot Input (t)

(9)

This weighted sum forms the output of the temporal attention module, which is then passed on to the subsequent layers of the network for further processing. Within the eBiTCN framework, the temporal attention module is integrated such that it follows the efficient bidirectional layers. The outputs from these layers, which have already been processed in a bidirectional manner and had their parameters shared for efficiency, are fed into the temporal attention module. This module recalibrates the focus of the model, allowing it to emphasize or de-emphasize certain parts of the sequence based on their relevance to the task. The integration of the temporal attention module is crucial for the eBiTCN framework’s ability to handle encrypted network traffic data, where the nature and subtleties of the sequence can be critical for accurate detection of malicious activities. By enabling the model to adaptively focus on the most informative parts of the sequence, the temporal attention module significantly contributes to the framework’s overall performance and efficiency, making it a key component in the proposed method section of a research article.

3.5. Custom loss function

Moreover, unlike by Chen et al.^10,27 and Cai et al.,⁹ we implement a novel loss function that adeptly addresses two paramount challenges in the domain of encrypted traffic analysis: class imbalance and the need for acute temporal pattern recognition. The foundation of our loss function is a weighted cross-entropy term, formulated as follows:

L_{CE} = - \sum_{i} w_{i} \cdot (y_{i} \log ({\hat{y}}_{i}) + (1 - y_{i}) \log (1 - {\hat{y}}_{i}))

(10)

This component is engineered to tackle the pervasive issue of class imbalance within network traffic datasets. By introducing weights (

w_{i}

) that are inversely proportional to class frequencies, we elevate the significance of accurately classifying underrepresented classes, ensuring that our model remains sensitive to rare but critical malicious patterns. Complementing the weighted cross-entropy, we integrate a temporal consistency term as follows:

L_{TC} = \sum_{t = 1}^{T - 1} ‖ f (x_{t}, Θ) - f (x_{t + 1}, Θ) ‖_{2}

(11)

This addition incentivizes the model to generate consistent predictions across sequential time steps, a crucial feature for capturing the temporal dynamics characteristic of encrypted malicious activities. By minimizing the Euclidean distance between consecutive predictions, the EBiTCN is trained to recognize and preserve the temporal sequences indicative of anomalous behavior. The amalgamation of these two components yields our enhanced loss function as follows:

{Loss}_{e} = L_{CE} + λ L_{TC}

(12)

Here,

λ

serves as a tunable parameter, offering the flexibility to balance the influence of temporal consistency against the overarching goal of accurate classification.

4. Experimental setup and evaluation

4.1. Description of network traffic datasets

This study used six publicly available datasets, namely CICIDS-2018, Stratosphere, USTC-TFC-2016, MAWILAB, ISCXVPN2016, and UJS-IDS2022 datasets. To validate the proposed detection framework in a real-world environment and assess its effectiveness against evolving attack types, we utilized the USTC-TFC2016 dataset.

(1)
CICIDS-2018: The data is extracted from the CSE-CIC-IDS2018 dataset with attention to encrypted traffic instances.³⁵
(2)
Stratosphere: This dataset consists of malicious traffic compiled by Roques et al.³ and normally captured encrypted traffic from the Stratosphere IPS project.³⁶
(3)
USTC-TFC-2016:³⁷ Created by the University of Science and Technology of China (USTC), it includes a diverse set of real-world malicious and benign network traffic samples, capturing realistic and varied attack patterns in network environments. This dataset was selected for our task due to its extensive coverage of both traditional and advanced attack types, which are real-world network traffic threats.
(4)
MAWILab dataset:³⁸ This dataset is derived from the MAWI project, which collects real-world traffic data from a trans-Pacific backbone link. It is a labeled dataset for anomaly detection in network traffic. MAWILab focuses on identifying abnormal behaviors such as distributed denial-of-service (DDoS) attacks, port scans, and worm activities using semi-supervised learning techniques. The dataset provides detailed metadata and is widely used for evaluating anomaly detection models due to its realistic traffic patterns.
(5)
ISCXVPN2016:³⁹ This dataset is a labeled network traffic dataset designed for virtual private network (VPN) traffic analysis and intrusion detection. It was created by the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick (UNB). It includes both VPN and non-VPN traffic with a variety of application types such as email, web browsing, file transfer, and video streaming. The dataset is extensively used for evaluating traffic classification models and studying the impact of VPN encryption on network traffic analysis.
(6)
UJS-IDS2022:⁴⁰ This dataset is sourced from the Jiangsu University’s Key Laboratory of Security Technology for Industrial Cyberspace, comprises a wide range of real-life network traffic scenarios, both normal and malicious. This dataset is curated to reflect the latest trends and tactics in cybersecurity threats, providing a modern benchmark for intrusion detection systems. It includes advanced persistent threats, malware, and zero-day exploits, offering a diverse testing ground to evaluate the effectiveness of security models like the eBiTCN in recognizing and responding to evolving network threats.

4.2. Baseline models

We conducted a comparative analysis against eight (8) state-of-the-art baseline models from the existing literature. Descriptions of these baseline approaches are as follows:

(1)
BiTCN_MHSA:⁹ This model integrates a BiTCN with a multi-head self-attention (MHSA) mechanism. The MHSA mechanism assigns different weights to network traffic features, focusing the model on malicious traffic characteristics and improving global processing efficiency. The model also employs a cross-entropy loss function to address overfitting and data imbalance issues, showing superior precision, recall, F1-measure, and accuracy performance compared to state-of-the-art models.
(2)
BI-LSTM–CNN:⁴¹ It is a deep learning technique that is aimed at detecting malevolent traffic in smart devices. The model addresses time estimation challenges by leveraging the strengths of both LSTM and convolutions neural network (CNN) architectures to capture temporal dependencies and spatial features.
(3)
BiTCN:¹⁰ It is an improved version of TCN that considers the serialization of network traffic and its bidirectional semantics, which has higher efficiency compared to TCN.
(4)
CLAIRE:⁴² This model is based on a 2D-based CNN architecture with cluster-based nearest neighbor information. It has improved performance and robustness to imbalanced data distributions across multiple benchmark datasets.
(5)
S-TCN:¹¹ The model leverages a TCN architecture with a multi-class classification approach and a novel loss function to effectively detect diverse types of malicious traffic in IoT environments, addressing the challenges posed by class imbalance and complex traffic patterns.
(6)
TCN:²³ The model employs TCN, which is an extension of one-dimensional CNNs, to handle sequence data effectively. The proposed TCN was modified to replace the RELU activation function with the ELU. TCNs are noted for their effectiveness in modeling time-series problems and have demonstrated strong efficacy in network IDS.
(7)
TGMA:⁷ This model uses TCN and bidirectional gated recurrent units (BiGRUs) to extract both local and global temporal features from network traffic. The attention mechanism is applied to assign weights to different positions in the sequence, enhancing the model’s ability to focus on significant features.
(8)
TLS-MHSA:² This model is a detection model for encrypted malicious traffic that is based on the TLS protocol and a MHSA mechanism. It utilizes a MHSA mechanism, which is a deep learning technique that allows the model to capture long-range dependencies and complex patterns in the data.

4.3. Evaluation metrics

To assess the performance of eBiTCN for efficient detection of malicious encrypted network traffic, we utilized the metrics accuracy, precision, recall, and F1-score. These metrics, grounded in the elements of TP (true positive), TN (true negative), FP (false positive), and FN (false negative), are instrumental in gauging the model’s detection efficiency. Below, we detail each metric and its corresponding formula:

Precision = \frac{TP}{TP + FP}

(13)

Precision quantifies the accuracy of the eBiTCN in identifying malicious traffic, emphasizing the importance of minimizing false positives.

Recall = \frac{TP}{TP + FN}

(14)

Recall measures the model’s ability to detect all actual malicious traffic instances, underscoring the criticality of reducing false negatives.

F1-score = 2 \times \frac{Precision \times Recall}{Precision + Recall}

(15)

The F1-score provides a balanced view of the model’s overall detection performance by harmonizing precision and recall.

Accuracy = \frac{TP + TN}{TP + FP + FN + TN}

(16)

Accuracy offers a holistic measure of the model’s performance across all classifications, illustrating its effectiveness in distinguishing between malicious and benign traffic accurately. The misclassification rate is calculated as the complement of recall and is expressed as follows:

Misclassification Rate = 100 % - Recall

(17)

A lower misclassification rate indicates a more reliable model with fewer incorrect predictions. In the above metrics, TP represents instances where the eBiTCN correctly identifies malicious traffic, affirming both prediction and actual classification align as malicious. FP occurs when the eBiTCN incorrectly classifies benign traffic as malicious, demonstrating a misalignment between prediction and actual classification. On the other hand, TN denotes correctly identified benign traffic, where both the eBiTCN’s prediction and the actual classification concur on the non-malicious nature of the traffic. Whereas FN reflects the instances where malicious traffic is mistakenly classified as benign, pointing to missed detections.

5. Results

For the proposed eBiTCN model, many parameters can influence the computational and detection efficiency of the model. In order to obtain better detection accuracy, we conduct extensive experiments to test the efficiency of the eBiTCN model on two real-world datasets, CICIDS-2018³⁵ and Stratosphere.³⁶ First, we conducted experiments on each dataset to substantiate our claim that eBiTCN achieves state-of-the-art performance with fewer parameters. The approach informed our choice of the parameters used in eBiTCN. Second, we demonstrate that eBiTCN performs better than competing baseline methods over different batch sizes, layers, training epochs, and hidden units with fewer parameters. Third, we show the benefit of our architecture by studying the detection efficiency in terms of model complexity, training time, and energy cost. Finally, we conduct ablation experiments to assess the impact of eBiTCN under negative log-likelihood loss function, cross-entropy loss function, and our modified cross-entropy. The impact on the choice of GELU over ELU, and RELU activation functions used in traditional TCN architectures are also compared. The experimental results are discussed in the subsequent subsections.

5.1. Parameter effects and choices

For the proposed eBiTCN model, we conducted extensive experiments to assess the impact of various parameters on the detection efficiency. The experiments spanned from assessing the sensitivity of varying key hyperparameters and their impacts on the performance of eBiTCN. The experiments also spanned different batch sizes, neural network depths, hidden units, and the number of training epochs. As shown in Figure 4(a), the performance of eBiTCN on the CICIDS-2018 dataset exhibited an increasing trend in accuracy as the number of layers went from two to eight. However, beyond eight layers, the increase in accuracy was less, with fluctuations that suggest a possible overfitting as the network depth continued to rise. Notably, networks with 12 and 16 layers demonstrated higher variability in accuracy across epochs, indicating potential instability in deeper networks. We, therefore, implemented adaptive batch processing (Algorithm 1) to address this. The peak accuracy was observed in the network with eight layers, reaching just below the 99% mark at epoch 10. In contrast, Figure 4(b) shows the model’s accuracy initially fluctuated for shallower networks but began to stabilize and increase with depths beyond six layers. Using 10, 12, and 16 layers, the model showed promising growth in accuracy over the epochs, with the 16-layer network achieving the highest accuracy, surpassing the 99% threshold by epoch 10. This suggests that the stratosphere dataset benefits from more complex model architectures, which could capture more sophisticated patterns absent in the CICIDS-2018 dataset. Figure 5(a) shows that 10 hidden units suffered underperformance. This implies the inability of smaller hidden units to encapsulate the latent structures within the data required to learn complex patterns. Conversely, as the hidden unit size was increased beyond the optimal 20, the models exhibited increasing volatility in accuracy across epochs, indicative of overfitting. Particularly for hidden unit sizes of 25 and 30, the model showed significant performance oscillations. Given the stability observed with 20 hidden units, a batch size between 32 and 64 strikes a balance. It is ample enough to ensure computational efficiency while allowing for a sufficient number of updates to learn generalizable patterns. This chosen batch size can prevent the overfitting trend observed with larger hidden unit sizes. For batch size, Figure 5(a) and (b) shows that eBiTCN suffers from performance instability, with notable fluctuations across epochs on both datasets with smaller batch sizes. This outcome reinforces the notion that while small batches offer the model a granular perspective of the data, they may also lead to an erratic learning path if the batch size is too small to encapsulate representative data variability. The smaller batch sizes for Stratosphere, similar to CICIDS-2018, suffer from performance instability, with notable fluctuations across epochs. This outcome reinforces the notion that while small batches offer the model a granular perspective of the data, they may also lead to an erratic learning path if the batch size is too small to encapsulate representative data variability (Figure 6).

Figure 4.

The detection accuracy of efficient bidirectional temporal convolution network (eBiTCN) under different neural network levels: (a) CICIDS-2018 and (b) Stratosphere.

Figure 5.

The detection accuracy of efficient bidirectional temporal convolution network (eBiTCN) under different batch sizes: (a) CICIDS-2018 and (b) Stratosphere.

Figure 6.

The detection accuracy of efficient bidirectional temporal convolution network (eBiTCN) under different hidden units: (a) CICIDS-2018 and (b) Stratosphere.

To understand the sensitivity of eBiTCN to key hyperparameters, we conducted a series of experiments on the CICIDS-2018 and Stratosphere datasets. The hyperparameters under consideration included the batch size ( $b_{s}$ ), hidden size ( $d_{h}$ ), kernel size (k), number of layers (N), and dropout rate ( $P_{d}$ ). The results of these experiments are summarized in Table 1. Each row in the table represents a single hyperparameter variation from the base case, allowing us to isolate the impact of each hyperparameter on the model’s performance metrics, which include precision, accuracy, recall, F1-score, training time, and energy cost. Key observations from our hyperparameter study are as follows: (1)

Batch size ( $b_{s}$ ): Varying the batch size revealed its direct impact on training time and energy efficiency. Smaller batch sizes generally led to increased training times due to the higher number of iterations required for convergence but were more energy-efficient. To ensure efficiency and scalability, we applied adaptive batch processing to rectify the phenomenon.

(2)

Hidden size ( $d_{h}$ ): The hidden size significantly influenced the model’s ability to capture complex patterns within the data. Larger hidden layers improved the precision and recall but also increased the model’s computational requirements, as evidenced by longer training times and higher energy costs.

(3)

Kernel size (k): The choice of kernel size affected the field of view of the convolutional filters. A larger kernel size allowed the model to capture more global features, which improved recall, but at the expense of precision for certain datasets.

(4)

Number of layers (N): Increasing the number of layers in the eBiTCN model deepened the network, potentially enhancing its learning capacity. However, this also led to increased complexity, resulting in longer training times and higher energy consumption.

(5)

Dropout rate ( $P_{d}$ ): The dropout rate is a critical regularizer to prevent overfitting. We found that (appropriate) dropout rates improved generalization, as indicated by the F1-score, without substantially increasing the training time or energy cost.

The base case served as a reference point for these experiments, with each hyperparameter being adjusted in turn while all others were held constant. This methodical approach allowed us to identify the optimal balance between model performance and computational efficiency for eBiTCN. Therefore, we identified that a configuration comprising 10 hidden units, a kernel size of 10, and a dropout rate of 0.01, yields the most favorable outcomes. This specific combination of hyperparameters facilitates the effective detection of malicious traffic while keeping the model’s complexity in check. With 10 hidden units, the model’s architecture remains lightweight, significantly reducing the number of parameters without impairing its performance. The kernel size of 10 allows the model to extract meaningful temporal features from network traffic data, enhancing its predictive capabilities. Additionally, a dropout rate of 0.01 introduces a level of regularization that is effective in preventing overfitting, particularly useful given the dynamic nature of network traffic data. This optimal hyperparameter setup equips the eBiTCN model with heightened accuracy in malicious traffic detection. It does so without incurring excessive computational costs, as evidenced by the controlled energy consumption, manageable training times, and modest memory footprint. These attributes are not just theoretically significant; they also have practical implications, particularly for organizations with constrained resources or those operating in real-time network security environments.

Table 1.

Performance metrics and computational efficiency of eBiTCN.

		No. of						Prec	Acc	Rec		Training	Energy
Datasets	Models	Parameters	$b_{s}$	$d_{h}$	k	N	$P_{d}$	(%)	(%)	(%)	F1	time (s)	cost (J)
CICIDS-2018	eBiTCN	49k	512	12	9	5	0.01	96.18	96.19	98.57	97.61	121.26	230
Base case		50k	256	20	10	4		97.35	98.57	97.96	97.96	115.13	171.31
		40k	128	16	8	6		94.18	95.28	93.71	94.83	94	111.31
	TCN	166k		24				96.20	97.16	95.63	95.45	130.16	237.00
	TGMA	19k		6				93.12	94.31	92.17	92.17	230	268.60
	CLAIRE	39k			3	7		89.56	92.87	91.48	89.37	86.11	126.40
	BiTCN	42k			5	6		94.18	87.09	89.38	90.5	131.55	142.20
	BiTCN-MHSA	50k			7	6		91.84	96.78	88	92.71	146.18	173.80
	BiLSTM-CNN	55k			11	5		93.89	85.7	94.11	87.56	361.44	205.40
	S-TCN	72k						85.98	99.23	99.48	97.13	301.16	316.00
	TLS-MHSA	77k						89.57	86.47	95.26	91.6	198.14	284.40
Stratosphere	eBiTCN	51k	512	12	9	5	0.01	98.98	99.58	99.59	99.58	95.18	227.52
Base case		53k	256					94.5	95.5	93.57	94.60	82.73
		44k	128					94.81	95.86	93.28	94.33	94.24
	TCN	178k		24				96.40	97.27	95.27	95.56	130.31	322.32
	TGMA	61k		6				93.43	94.36	92.46	92.57	243.01	151.68
	CLAIRE	68k			3	7		96.71	98.61	97.34	98.71	156.4	170.64
	BiTCN	74k			5	6		98.40	98.27	96.27	98.56	131.26	208.56
	BiTCN-MHSA	82k			7	6		98.92	99.2	99.38	99.31	149.1	246.48
	BiLSTM-CNN	167k			11	5		97.63	98.41	98.64	96.77	362.27	379.20
	S-TCN	88k						98.78	96.15	97.35	97.33	301.16	341.28
	TLS-MHSA	100k						99.06	99.13	99.14	99.35	192.31	303.36

Precision, accuracy, recall, F1-score, training time, and energy cost of eBiTCN when varying key hyperparameters: the batch size $b_{s}$ , the hidden size $d_{h}$ , the kernel size k, the number of layers N, and the dropout rate $p_{d}$ . For each row, only the value listed is changed with respect to the base case.

eBiTCN: efficient bidirectional temporal convolution network; TGMA: temporal convolutional network (TCN), the gated recurrent unit (GRU), and multi-head self-attention; TCN: temporal convolutional network; BiTCN: bidirectional temporal convolution network; BiTCN-MHSA: bidirectional temporal convolution network with a multi-head self-attention; BiLSTM-CNN: bidirectional long short-term memory-convolutional neural network; TLS-MHSA: transport layer security with a multi-head self-attention.

5.2. Detection efficiency of eBiTCN

We studied the detection efficiency of the proposed eBiTCN model on two datasets with a comparison of eight state-of-the-art models.

5.2.1. Detection efficiency of eBiTCN on CICIDS-2018 dataset

Table 2 presents the detection efficiency of various models on the CICIDS-2018 dataset across different malware families. The eBiTCN model demonstrates outstanding performance, achieving near-perfect metrics with precision, recall, F1-score, and accuracy consistently exceeding 99.9% across all attack types. This highlights its exceptional ability to distinguish between benign and malicious traffic, making it highly reliable for detection tasks.

Table 2.
Detection efficiency of different models on dataset CICIDS-2018.

Model Metrics Benign Bot HOIC UDP GoldenEye Hulk SlowHTTP Slowloris BruteForce Infiltn SSH

TCN Precision 99.95 99.87 99.85 99.9 99.88 99.8 99.7 99.6 99.55 92.5 98.8

Recall 99.91 99.88 99.82 99.85 99.83 99.9 99.65 99.5 99.6 92.7 98.75

F1-Score 99.93 99.88 99.84 99.88 99.86 99.85 99.68 99.55 99.58 92.6 98.78

Accuracy 99.96 99.88 99.85 99.88 99.87 99.88 99.72 99.6 99.55 92.6 98.8

TGMA Precision 99.96 99.85 99.83 99.92 99.84 99.95 99.75 97.9 99.65 94.9 98.95

Recall 99.98 99.8 99.86 99.93 99.77 99.96 99.8 97.7 99.4 94.8 98.85

F1-Score 99.97 99.83 99.85 99.93 99.81 99.96 99.78 97.8 99.52 94.85 98.9

Accuracy 99.98 99.97 99.9 99.9 99.87 99.88 99.75 97.8 99.9 94.8 98.85

CLAIRE Precision 99.94 99.8 99.82 99.93 99.75 99.94 99.78 97.8 99.63 95.75 98.7

Recall 99.97 99.85 99.79 99.95 99.7 99.91 99.82 97.65 99.5 95.8 98.65

F1-Score 99.96 99.83 99.81 99.94 99.73 99.93 99.8 97.72 99.57 95.78 98.68

Accuracy 99.97 99.83 99.8 99.89 99.85 99.85 99.78 97.8 99.65 94.85 98.8

BiTCN Precision 99.82 99.9 99.86 99.28 99.55 99.4 99.39 99.45 99.41 99.92 99.7

Recall 99.9 99.88 99.74 99.92 99.53 99.75 99.93 99.52 99.74 99.9 99.6

F1-Score 99.86 99.89 99.8 99.93 99.54 99.58 99.85 99.48 99.67 99.91 99.65

Accuracy 99.92 99.88 99.82 99.83 99.75 99.83 99.72 99.6 99.57 95.78 98.68

BiTCN_MHSA Precision 99.97 99.91 99.93 99.57 99.88 99.72 99.76 99.69 99.72 99.94 99.8

Recall 99.92 99.87 99.96 99.95 99.86 99.95 99.97 99.87 99.96 99.97 99.85

F1-Score 99.94 99.89 99.94 99.96 99.87 99.84 99.86 99.88 99.84 99.95 99.83

Accuracy 99.9 99.87 99.88 99.9 99.82 99.88 99.76 98.8 99.67 99.9 98.85

BiLSTM-CNN Precision 99.97 99.78 99.85 99.97 99.75 99.96 99.87 98.5 99.93 95.35 99.6

Recall 99.94 99.92 99.75 99.94 99.9 99.99 99.98 97.35 99.92 92.7 99.5

F1-Score 99.95 99.85 99.8 99.95 99.83 99.98 99.92 97.9 99.92 93.8 99.55

Accuracy 99.97 99.78 99.76 99.8 99.76 99.77 99.87 98.5 99.77 99.91 98.95

S-TCN Precision 99.76 99.88 99.83 99.31 99.6 99.45 99.42 99.55 99.48 99.85 99.68

Recall 99.87 99.85 99.77 99.89 99.59 99.78 99.9 99.6 99.8 99.87 99.58

F1-Score 99.81 99.86 99.8 99.9 99.59 99.61 99.86 99.57 99.64 99.86 99.63

Accuracy 99.8 99.6 99.55 99.6 99.55 99.48 99.42 97.9 99.48 99.85 99.68

TLS-MHSA Precision 99.96 99.89 99.91 99.59 99.85 99.7 99.74 99.71 99.7 99.92 99.78

Recall 99.97 99.84 99.95 99.93 99.82 99.93 99.95 99.85 99.94 99.96 99.83

F1-score 99.93 99.86 99.93 99.94 99.83 99.82 99.84 99.78 99.82 99.94 99.8

Accuracy 99.95 99.88 99.82 99.87 99.86 99.77 99.74 97.7 99.71 99.84 98.9

eBiTCN Precision 99.98 99.95 99.94 99.98 99.93 99.97 99.95 99.9 99.96 99.99 99.95

Recall 99.91 99.96 99.93 99.97 99.94 99.98 99.97 99.91 99.95 99.98 99.96

F1-Score 99.98 99.96 99.94 99.97 99.94 99.98 99.96 99.91 99.96 99.99 99.96

Accuracy 99.98 99.96 99.96 99.96 99.96 99.96 99.96 99.91 99.98 99.99 99.96

Model	Metrics	Benign	Bot	HOIC	UDP	GoldenEye	Hulk	SlowHTTP	Slowloris	BruteForce	Infiltn	SSH
TCN	Precision	99.95	99.87	99.85	99.9	99.88	99.8	99.7	99.6	99.55	92.5	98.8
	Recall	99.91	99.88	99.82	99.85	99.83	99.9	99.65	99.5	99.6	92.7	98.75
	F1-Score	99.93	99.88	99.84	99.88	99.86	99.85	99.68	99.55	99.58	92.6	98.78
	Accuracy	99.96	99.88	99.85	99.88	99.87	99.88	99.72	99.6	99.55	92.6	98.8
TGMA	Precision	99.96	99.85	99.83	99.92	99.84	99.95	99.75	97.9	99.65	94.9	98.95
	Recall	99.98	99.8	99.86	99.93	99.77	99.96	99.8	97.7	99.4	94.8	98.85
	F1-Score	99.97	99.83	99.85	99.93	99.81	99.96	99.78	97.8	99.52	94.85	98.9
	Accuracy	99.98	99.97	99.9	99.9	99.87	99.88	99.75	97.8	99.9	94.8	98.85
CLAIRE	Precision	99.94	99.8	99.82	99.93	99.75	99.94	99.78	97.8	99.63	95.75	98.7
	Recall	99.97	99.85	99.79	99.95	99.7	99.91	99.82	97.65	99.5	95.8	98.65
	F1-Score	99.96	99.83	99.81	99.94	99.73	99.93	99.8	97.72	99.57	95.78	98.68
	Accuracy	99.97	99.83	99.8	99.89	99.85	99.85	99.78	97.8	99.65	94.85	98.8
BiTCN	Precision	99.82	99.9	99.86	99.28	99.55	99.4	99.39	99.45	99.41	99.92	99.7
	Recall	99.9	99.88	99.74	99.92	99.53	99.75	99.93	99.52	99.74	99.9	99.6
	F1-Score	99.86	99.89	99.8	99.93	99.54	99.58	99.85	99.48	99.67	99.91	99.65
	Accuracy	99.92	99.88	99.82	99.83	99.75	99.83	99.72	99.6	99.57	95.78	98.68
BiTCN_MHSA	Precision	99.97	99.91	99.93	99.57	99.88	99.72	99.76	99.69	99.72	99.94	99.8
	Recall	99.92	99.87	99.96	99.95	99.86	99.95	99.97	99.87	99.96	99.97	99.85
	F1-Score	99.94	99.89	99.94	99.96	99.87	99.84	99.86	99.88	99.84	99.95	99.83
	Accuracy	99.9	99.87	99.88	99.9	99.82	99.88	99.76	98.8	99.67	99.9	98.85
BiLSTM-CNN	Precision	99.97	99.78	99.85	99.97	99.75	99.96	99.87	98.5	99.93	95.35	99.6
	Recall	99.94	99.92	99.75	99.94	99.9	99.99	99.98	97.35	99.92	92.7	99.5
	F1-Score	99.95	99.85	99.8	99.95	99.83	99.98	99.92	97.9	99.92	93.8	99.55
	Accuracy	99.97	99.78	99.76	99.8	99.76	99.77	99.87	98.5	99.77	99.91	98.95
S-TCN	Precision	99.76	99.88	99.83	99.31	99.6	99.45	99.42	99.55	99.48	99.85	99.68
	Recall	99.87	99.85	99.77	99.89	99.59	99.78	99.9	99.6	99.8	99.87	99.58
	F1-Score	99.81	99.86	99.8	99.9	99.59	99.61	99.86	99.57	99.64	99.86	99.63
	Accuracy	99.8	99.6	99.55	99.6	99.55	99.48	99.42	97.9	99.48	99.85	99.68
TLS-MHSA	Precision	99.96	99.89	99.91	99.59	99.85	99.7	99.74	99.71	99.7	99.92	99.78
	Recall	99.97	99.84	99.95	99.93	99.82	99.93	99.95	99.85	99.94	99.96	99.83
	F1-score	99.93	99.86	99.93	99.94	99.83	99.82	99.84	99.78	99.82	99.94	99.8
	Accuracy	99.95	99.88	99.82	99.87	99.86	99.77	99.74	97.7	99.71	99.84	98.9
eBiTCN	Precision	99.98	99.95	99.94	99.98	99.93	99.97	99.95	99.9	99.96	99.99	99.95
	Recall	99.91	99.96	99.93	99.97	99.94	99.98	99.97	99.91	99.95	99.98	99.96
	F1-Score	99.98	99.96	99.94	99.97	99.94	99.98	99.96	99.91	99.96	99.99	99.96
	Accuracy	99.98	99.96	99.96	99.96	99.96	99.96	99.96	99.91	99.98	99.99	99.96

HOIC: high orbit ion Cannon; UDP: user datagram protocol; SSH: secure shell protocol; TGMA: temporal convolutional network (TCN), the gated recurrent unit (GRU), and multi-head self-attention; eBiTCN: efficient bidirectional temporal convolution network; TCN: temporal convolutional network; BiTCN: bidirectional temporal convolution network; BiTCN-MHSA: bidirectional temporal convolution network with a multi-head self-attention; BiLSTM-CNN: bidirectional long short-term memory-convolutional neural network; TLS-MHSA: transport layer security with a multi-head self-attention.

The TCN model follows closely, achieving precision, recall, and F1-scores above 99.5% in most cases, with accuracy reaching up to 99.96%. However, it exhibits a slight dip to 92.5% accuracy when handling SSH-based attacks. TGMA and CLAIRE models also perform well, with metrics generally ranging from 97.8% to 99.9%, though both experience minor declines for bot-related and SlowHTTP traffic. BiTCN and its variant BiTCN_MHSA demonstrate solid performance, with BiTCN achieving an accuracy range of 95.8%–99.9%. The BiTCN_MHSA variant shows a slight precision drop for SlowHTTP traffic but maintains high overall scores, with accuracy between 98.8% and 99.9%. The BiLSTM-CNN model achieves competitive results, particularly excelling in most attack types, but its accuracy dips to 93.8% for BruteForce attacks. The S-TCN and TLS-MHSA models provide robust detection capabilities, with S-TCN achieving accuracy up to 99.8% and TLS-MHSA performing particularly well on SlowHTTP attacks, achieving an F1-score of 99.94%. eBiTCN consistently outperforms other models across all metrics, reinforcing its suitability for malicious traffic detection, especially in challenging scenarios such as encrypted network traffic.

The weighted average detection efficiency of the compared models, as shown in Table 3, highlights the superior performance of the eBiTCN model. Achieving an average precision of 99.95%, recall of 99.95%, F1-score of 99.96%, and accuracy of 99.96%, eBiTCN demonstrates exceptional capability in accurately detecting and classifying diverse types of network traffic. This underscores its robustness and reliability in handling complex attack scenarios with minimal false positives. The BiTCN_MHSA model also performs strongly, achieving an average F1-score of 99.89% and accuracy of 99.66%, reflecting its efficiency in detecting threats with minimal false negatives. The BiTCN model maintains balanced performance, with an average precision of 99.61% and accuracy of 99.31%, showcasing its capability in handling a range of attack types effectively. CLAIRE and TGMA exhibit solid detection efficiency, with F1-scores of 99.16% and 99.11%, respectively, indicating consistent detection across various attack types, though with slight drops compared to the top models. Similarly, S-TCN achieves an average accuracy of 99.45%, while TLS-MHSA demonstrates strong precision at 99.80%, effectively handling a broad spectrum of attack types.

Table 3.

Average detection efficiency on CICIDS-2018.

	TCN	TGMA	CLAIRE	BiTCN	BiTCN_MHSA	BiLSTM-CNN	S-TCN	TLS-MSHA	eBiTCN
Precision	99.04	99.14	99.17	99.61	99.81	99.32	99.62	99.80	99.95
Recall	99.04	99.08	99.14	99.76	99.92	98.99	99.77	99.91	99.95
F1	99.04	99.11	99.16	99.74	99.89	99.13	99.74	99.86	99.96
Accuracy	99.05	99.15	99.10	99.31	99.66	99.62	99.45	99.55	99.96

TCN: temporal convolutional network; TGMA: temporal convolutional network (TCN), the gated recurrent unit (GRU), and multi-head self-attention; eBiTCN: efficient bidirectional temporal convolution network; BiTCN: bidirectional temporal convolution network; BiTCN-MHSA: bidirectional temporal convolution network with a multi-head self-attention; BiLSTM-CNN: bidirectional long short-term memory-convolutional neural network; TLS-MHSA: transport layer security with a multi-head self-attention.

Baseline models such as TCN and BiLSTM-CNN deliver competitive performance but fall slightly behind in consistency. For instance, BiLSTM-CNN achieves a precision of 99.32% but shows some variation in recall, affecting its overall F1-score and accuracy. The eBiTCN model’s architecture, integrating bidirectional temporal convolutional networks, temporal attention mechanisms, and lightweight gating, plays a critical role in its superior performance. This design allows for refined feature extraction, effectively capturing multi-scale dependencies crucial for identifying sophisticated cyber threats. By focusing computational resources on critical data, the model minimizes false positives, making it the most reliable choice for malicious traffic detection.

5.2.2. Detection efficiency of eBiTCN on Stratosphere dataset

The results presented in Table 4 demonstrate the superior performance of our proposed model, eBiTCN, across various metrics when compared to existing state-of-the-art models on the Stratosphere dataset for different malware families. eBiTCN achieves exceptional performance, with precision ranging from 85% to 100%, recall between 90% and 100%, F1-score from 87.5% to 100%, and accuracy spanning 87.48% to 100%. This consistently high performance across metrics underscores eBiTCN’s strong ability to detect diverse types of malware accurately. When examining individual malware families, eBiTCN achieves perfect scores (100%) in precision, recall, F1-score, and accuracy for Dridex, Dyreza, Emotet, Zbot, Auditcred, and Kins, highlighting its robustness and adaptability across a broad range of threats. For Teslacrypt, while precision is slightly lower at 85%, recall remains high at 90% and F1-score at 87.5%, still outperforming all other models for this specific malware family.

Table 4.
Detection efficiency of different models on Stratosphere dataset.

Model Metrics Normal Dridex Dyreza Emotet Gh0stRAT Zbot Auditcred Kins Dyre Tescrypt Teslacrypt

TCN Precision 97.9 99.95 99.97 99.8 99.88 99.85 99.95 99.7 68.3 99.9 66.25

Recall 98.7 99.92 99.89 99.77 99.82 99.1 99.97 99.8 77.8 99.85 60.35

F1-Score 97.85 99.93 99.92 99.79 99.85 99.47 99.96 99.85 73.5 99.88 63.8

Accuracy 98.63 99.88 99.59 99.72 99.54 99.42 99.68 99.58 70.13 99.62 65.47

TGMA Precision 98.65 100 99.8 99.99 99.83 99.92 100 99.97 74.25 99.83 62.3

Recall 99.05 99.98 99.9 99.78 99.77 99.96 100 99.9 71.95 99.97 75.2

F1-Score 98.55 99.99 99.85 99.89 99.8 99.94 100 99.93 72.85 99.9 68.15

Accuracy 98.79 99.96 99.91 99.82 99.31 99.49 99.98 99.24 72.58 99.83 63.97

CLAIRE Precision 97.1 100 99.93 100 99.97 99.98 100 99.6 73.35 99.3 64.2

Recall 97.3 98.99 99.82 99.74 99.75 99.2 99.98 99.81 67.7 99.88 61.3

F1-Score 98.2 99.97 99.87 99.86 99.81 99.6 99.99 99.87 70.5 99.59 62.75

Accuracy 98.31 99.85 99.68 99.89 99.52 99.69 99.86 99.27 68.09 99.78 61.42

BiTCN Precision 98.4 99.96 99.94 99.97 99.91 99.99 99.98 99.93 78.6 99.99 67.4

Recall 98.55 99.77 99.9 99.69 99.83 99.29 99.99 99.84 74.95 99.98 74.25

F1-Score 99.5 99.98 99.91 99.82 99.87 99.65 99.97 99.88 76.3 99.97 71.8

Accuracy 98.05 99.93 99.88 99.83 99.46 99.64 99.92 99.72 67.53 99.75 64.98

BiTCN_MHSA Precision 98.1 99.99 99.84 99.95 99.87 99.9 99.99 99.92 76.05 99.88 65.4

Recall 98.95 99.97 99.91 99.72 99.85 99.09 99.96 99.85 70 99.79 68.1

F1-score 98.5 99.98 99.87 99.83 99.86 99.49 99.97 99.88 73 99.83 66.25

Accuracy 98.87 99.82 99.72 99.88 99.53 99.77 100.00 99.48 76.08 99.92 65.32

BiLSTM-CNN Precision 99.25 100 99.93 99.92 99.85 99.79 99.99 100 72 98.89 61.4

Recall 98.1 100 99.82 99.73 99.85 99.49 100 99.8 69.5 99.87 73.75

F1-Score 98.7 100 99.87 99.82 99.85 99.38 100 99.9 70.75 99.88 67.6

Accuracy 99.19 99.98 99.92 99.89 99.82 99.88 99.96 99.83 73.02 99.91 66.48

S-TCN Precision 97.6 100 99.98 100 99.92 99.91 99.99 99.95 69.6 99.87 65.7

Recall 98.9 99.97 99.84 99.72 99.81 99.39 100 99.88 77.75 99.99 69.6

F1-Score 98.75 99.98 99.91 99.86 99.86 99.74 100 99.91 73.65 99.87 67.7

Accuracy 98.74 99.99 99.98 99.81 99.91 99.93 99.83 99.96 69.56 99.87 67.62

TLS-MHSA Precision 99.63 100 99.99 100 99.95 100 100 100 79.1 99.99 80.55

Recall 98.58 98.97 99.88 99.8 99.85 99.97 99.99 99.87 86 99.99 88

F1-score 99.6 99.97 99.93 99.89 99.9 99.74 99.99 99.92 78.2 99.99 80

Accuracy 98.35 99.78 99.68 99.82 99.51 99.88 99.92 99.69 76.98 99.73 67.68

eBiTCN Precision 99.98 100 99.98 100 99.97 100 100 100 98.76 100 85

Recall 99.19 100 99.97 100 99.98 100 100 100 90 100 90

F1-Score 99.97 100 99.98 100 99.98 100 100 100 87.5 100 87.5

Accuracy 99.83 100 99.97 100 100 100 100 100 98.52 100 87.48

Model	Metrics	Normal	Dridex	Dyreza	Emotet	Gh0stRAT	Zbot	Auditcred	Kins	Dyre	Tescrypt	Teslacrypt
TCN	Precision	97.9	99.95	99.97	99.8	99.88	99.85	99.95	99.7	68.3	99.9	66.25
	Recall	98.7	99.92	99.89	99.77	99.82	99.1	99.97	99.8	77.8	99.85	60.35
	F1-Score	97.85	99.93	99.92	99.79	99.85	99.47	99.96	99.85	73.5	99.88	63.8
	Accuracy	98.63	99.88	99.59	99.72	99.54	99.42	99.68	99.58	70.13	99.62	65.47
TGMA	Precision	98.65	100	99.8	99.99	99.83	99.92	100	99.97	74.25	99.83	62.3
	Recall	99.05	99.98	99.9	99.78	99.77	99.96	100	99.9	71.95	99.97	75.2
	F1-Score	98.55	99.99	99.85	99.89	99.8	99.94	100	99.93	72.85	99.9	68.15
	Accuracy	98.79	99.96	99.91	99.82	99.31	99.49	99.98	99.24	72.58	99.83	63.97
CLAIRE	Precision	97.1	100	99.93	100	99.97	99.98	100	99.6	73.35	99.3	64.2
	Recall	97.3	98.99	99.82	99.74	99.75	99.2	99.98	99.81	67.7	99.88	61.3
	F1-Score	98.2	99.97	99.87	99.86	99.81	99.6	99.99	99.87	70.5	99.59	62.75
	Accuracy	98.31	99.85	99.68	99.89	99.52	99.69	99.86	99.27	68.09	99.78	61.42
BiTCN	Precision	98.4	99.96	99.94	99.97	99.91	99.99	99.98	99.93	78.6	99.99	67.4
	Recall	98.55	99.77	99.9	99.69	99.83	99.29	99.99	99.84	74.95	99.98	74.25
	F1-Score	99.5	99.98	99.91	99.82	99.87	99.65	99.97	99.88	76.3	99.97	71.8
	Accuracy	98.05	99.93	99.88	99.83	99.46	99.64	99.92	99.72	67.53	99.75	64.98
BiTCN_MHSA	Precision	98.1	99.99	99.84	99.95	99.87	99.9	99.99	99.92	76.05	99.88	65.4
	Recall	98.95	99.97	99.91	99.72	99.85	99.09	99.96	99.85	70	99.79	68.1
	F1-score	98.5	99.98	99.87	99.83	99.86	99.49	99.97	99.88	73	99.83	66.25
	Accuracy	98.87	99.82	99.72	99.88	99.53	99.77	100.00	99.48	76.08	99.92	65.32
BiLSTM-CNN	Precision	99.25	100	99.93	99.92	99.85	99.79	99.99	100	72	98.89	61.4
	Recall	98.1	100	99.82	99.73	99.85	99.49	100	99.8	69.5	99.87	73.75
	F1-Score	98.7	100	99.87	99.82	99.85	99.38	100	99.9	70.75	99.88	67.6
	Accuracy	99.19	99.98	99.92	99.89	99.82	99.88	99.96	99.83	73.02	99.91	66.48
S-TCN	Precision	97.6	100	99.98	100	99.92	99.91	99.99	99.95	69.6	99.87	65.7
	Recall	98.9	99.97	99.84	99.72	99.81	99.39	100	99.88	77.75	99.99	69.6
	F1-Score	98.75	99.98	99.91	99.86	99.86	99.74	100	99.91	73.65	99.87	67.7
	Accuracy	98.74	99.99	99.98	99.81	99.91	99.93	99.83	99.96	69.56	99.87	67.62
TLS-MHSA	Precision	99.63	100	99.99	100	99.95	100	100	100	79.1	99.99	80.55
	Recall	98.58	98.97	99.88	99.8	99.85	99.97	99.99	99.87	86	99.99	88
	F1-score	99.6	99.97	99.93	99.89	99.9	99.74	99.99	99.92	78.2	99.99	80
	Accuracy	98.35	99.78	99.68	99.82	99.51	99.88	99.92	99.69	76.98	99.73	67.68
eBiTCN	Precision	99.98	100	99.98	100	99.97	100	100	100	98.76	100	85
	Recall	99.19	100	99.97	100	99.98	100	100	100	90	100	90
	F1-Score	99.97	100	99.98	100	99.98	100	100	100	87.5	100	87.5
	Accuracy	99.83	100	99.97	100	100	100	100	100	98.52	100	87.48

In comparison, other models exhibit some inconsistencies across different malware types. The TCN model performs well in certain cases, achieving high precision and recall for specific malware families, but struggles with others like Teslacrypt and Dyre, where its recall values drop significantly. Similarly, the TGMA model demonstrates strong overall performance but shows substantial declines in recall for Teslacrypt (around 64%) and Dyre ( $\sim$ 73%). CLAIRE achieves competitive results, maintaining high precision and recall across most malware families but exhibits similar weaknesses as TGMA in detecting Teslacrypt and Dyre. The BiTCN model provides balanced detection efficiency, with slightly better performance in precision and recall compared to CLAIRE. However, its BiTCN_MHSA variant experiences a decline in recall for Teslacrypt. The BiLSTM-CNN model excels in detecting families like Dridex and Emotet with perfect precision but shows reduced recall for Normal traffic and Teslacrypt, affecting its overall recall values. S-TCN and TLS-MHSA models perform competitively, maintaining high precision, recall, and F1-scores across various malware types, though with minor variations in performance across different classes. eBiTCN’s architecture, with its forward and reverse TCN layers, depthwise convolutions, lightweight gating mechanism, temporal attention, aggregation layer, and dense layers, enables it to capture intricate temporal dependencies within network traffic data. This advanced design provides eBiTCN with the capability to discern between normal and malicious traffic with high accuracy, even in the presence of encryption, maintaining low false positives and consistently high recall values across diverse malware families.

The weighted average detection efficiency of the models under comparison is presented in Table 5. The proposed eBiTCN model surpasses all other models across all metrics, achieving impressive scores of 98.52% in precision, 98.10% in recall, 97.72% in F1-score, and 98.71% in accuracy. The precision of eBiTCN, measuring the accuracy of positive predictions, is exceptionally high at 98.52%, indicating that the model is highly reliable in identifying true positive instances with minimal false positives. Similarly, the recall of eBiTCN, quantifying the model’s ability to detect all positive instances, is also high at 98.10%, suggesting that eBiTCN is nearly exhaustive in its detection capabilities, with few missed instances of malicious traffic. The F1-score, which balances precision and recall, provides an aggregate view of the model’s performance. eBiTCN achieves an F1-score of 97.72%, the highest among all compared models, reflecting an optimal balance between precision and recall. The accuracy, which is the ratio of correctly predicted instances to the total instances, further highlights eBiTCN’s performance, with a score of 98.71%. This high accuracy underscores eBiTCN’s effectiveness in accurately classifying both benign and malicious traffic. When compared to other models such as TCN, TGMA, CLAIRE, BiTCN, BiTCN_MHSA, BiLSTM-CNN, S-TCN, and TLS-MSHA, eBiTCN consistently leads across all metrics. For example, while TGMA and TLS-MSHA show strong performance, they fall slightly short in recall and F1-score when compared to eBiTCN. The superior performance of eBiTCN can be attributed to its innovative architecture that integrates bidirectional temporal convolutions with depthwise convolutions and a lightweight gating mechanism. This design allows the model to capture complex temporal patterns in network traffic data, leading to more accurate and efficient detection of malicious activities.

Table 5.

Average detection efficiency of different models on Stratosphere.

	TCN	TGMA	CLAIRE	BiTCN	BiTCN_MHSA	BiLSTM-CNN	S-TCN	TLS-MSHA	eBiTCN
Precision	93.77	94.05	93.95	94.92	94.44	93.73	93.87	96.29	98.52
Recall	94.09	95.04	93.04	95.09	94.11	94.54	94.99	97.35	98.10
F1-score	93.98	94.44	93.64	95.15	94.22	94.16	94.48	96.10	97.72
Accuracy	93.75	93.90	93.21	93.52	94.40	94.35	94.11	94.64	98.71

5.3. Model complexity evaluation

As stated earlier, the proposed approach is aimed at achieving high efficiency not only in terms of detection accuracy, but also computational complexity, energy cost, and less training time with fewer parameters. In this section, we show the benefit of the proposed architecture by studying the detection efficiency in terms of model complexity, training time, and energy cost. The results are discussed in subsequent subsections as follows.

5.3.1. Model complexity

We experimented how the selected parameters influence the model’s computational complexity, energy consumption or cost. Table 1 shows how the selected parameters influenced the model as follows. eBiTCN showcases a substantial reduction in parameter count compared to traditional models, indicating an architecture that leverages efficiency without sacrificing performance. This is particularly evident when compared to more parameter-dense models such as BiTCN_MHSA. The primary parameters of interest for our computational complexity analysis are:

$N$ , the number of layers in the eBiTCN;

$k$ , the kernel size of the convolutions;

$T$ , the sequence length processed by the network;

$d_{h}$ , the hidden dimension size within the network layers;

$d_{out}$ , the dimensionality of the network’s output channels.

For the eBiTCN, the computational complexity of a single layer, which encapsulates the bidirectional processing, is computed as follows:

O (2 \cdot k \cdot T \cdot d_{h} \cdot d_{out} + T \cdot d_{out} + d_{h} \cdot T^{2})

(18)

where

d_{out}

equals

4 \cdot d_{h}

due to the bidirectional processing. The factor of 2 accounts for the bidirectional nature of the architecture, doubling the complexity of the standard TCN layer. Thus, the total complexity for an

N

-layer eBiTCN is

O (N \cdot (2 \cdot k \cdot T \cdot d_{h} \cdot d_{out} + T \cdot d_{out} + d_{h} \cdot T^{2}))

(19)

Despite the additional factor from bidirectional processing, eBiTCN maintains a lower hidden dimension

d_{h}

, allowing for a reduction in overall complexity while still ensuring sufficient capacity for feature extraction. This is made possible by efficient parameter sharing and the use of depthwise separable convolutions, which lower the parameter count and the computational burden. In practice, the eBiTCN model achieves a balance between the receptive field and model capacity, which, when combined with lower

d_{h}

values, results in a highly efficient network capable of performing complex temporal analyses. This efficiency affords the model a significant advantage, particularly in applications where computational resources are a limiting factor. For model complexity compared to models, we find that eBiTCN requires significantly fewer parameters than the compared.

5.3.2. Computational time

One of the benefits of a model with fewer parameters is that ceteris paribus it can be trained faster. In evaluating the time efficiency of eBiTCN against various neural network architectures, we compared our model against a suite of contemporary models, including TCN, BiTCN, BiTCN-MHSA, BiLSTM-CNN, S-TCN, TGMA, CLAIRE, and TLS-MHSA, across two distinct datasets: CICIDS-2018 and Stratosphere as shown in Figure 7. The training time, measured in seconds, served as the benchmark for efficiency. For the CICIDS-2018 dataset, the eBiTCN model demonstrated a notable efficiency, registering a training time of 115.13 seconds, substantially outpacing the majority of its peers. The BiTCN-MHSA model incurred the most considerable training time of 361.44 seconds, which suggests a significantly higher computational overhead, likely due to the incorporation of the multi-head self-attention mechanism. Notably, the standard TCN model also showed promising efficiency, concluding its training in just 130.16 seconds, a testament to its streamlined architecture sans the bidirectional and attention-based augmentations. On the Stratosphere dataset, the eBiTCN model further performed efficiently, charting a training duration of only 95.18 seconds, the shortest among all models considered. This result corroborates the eBiTCN’s architectural optimizations. Contrastingly, the BiTCN-MHSA model again lagged at 362.27 seconds, mirroring its performance on the CICIDS-2018 dataset. Across both datasets, models like TGMA, CLAIRE, and TLS-MHSA exhibited a middle-ground performance, with training times that indicate a balanced trade-off between computational demand and the ability to capture complex patterns in the data. It’s particularly interesting to observe that TGMA and CLAIRE, despite their advanced mechanisms, maintained training times (230 seconds for TGMA and 198.14 seconds for CLAIRE on CICIDS-2018; 243.01 seconds for TGMA and 192.31 seconds for CLAIRE on Stratosphere) that didn’t deviate drastically from the simpler TCN architecture. The findings suggest that eBiTCN’s architectural efficiencies are well-suited for rapid model training without compromising on the depth and complexity necessary for high-performance detection tasks. These results indicate the efficacy of eBiTCN in scenarios where both time efficiency and detection performance are paramount.

Figure 7.

Computational time of efficient bidirectional temporal convolution network (eBiTCN) compared with different models: (a) CICIDS-2018 and (b) Stratosphere.

5.3.3. Energy cost

We estimated the energy usage of eBiTCN and baseline models based on their Floating Point Operations (FLOPs) required for training. This method allowed us to derive energy consumption estimates without direct power measurement, by leveraging a theoretical approach grounded in computational cost.⁴³ We first calculated the total FLOPs necessary for one training epoch for each model, factoring in their architectural details such as the number and type of operations involved. For the energy consumption estimation, we applied an average energy cost per FLOP, based on the specifications of our primary computational resource, the NVIDIA GTX 1080Ti GPU.⁴⁴ The energy cost per FLOP was estimated to be $\sim$ $1.58 \times 10^{- 10}$ J, drawing from published benchmarks and manufacturer data. We observed that eBiTCN requires fewer parameters despite the loads of operations it performs per epoch compared to competing counterparts. This translated into lower energy consumption, even when accounting for the total training process. In contrast, models with lower computational demands per epoch, such as TGMA and CLAIRE, ended up consuming more energy. This was primarily due to their need for a greater number of epochs to reach the desired model accuracy, which significantly increased their total energy expenditure. eBiTCN, with its fewer parameters, showcased how architectural efficiency can lead to significant reductions in energy consumption without compromising on performance. This finding is particularly relevant for practitioners aiming to optimize both the computational cost and energy footprint of machine learning systems.

5.3.4. Memory consumption

The memory usage of BiTCN-MHSA and TLS-MHSA models increases at a rate proportional to the square of the input sequence length.⁴⁵ This is because the model must retain all the activation outputs from the multi-head attention mechanism during the forward propagation phase, which are then utilized during the backward propagation phase. On the other hand, the memory consumption for TCN architectures is primarily determined by two factors: (1) the number of layers needed to achieve an adequate receptive field for the task at hand, and (2) the total count of parameters within these layers. This characteristic allows for the training of these models with a lesser amount of memory, which subsequently makes it possible to train them using more cost-effective computational resources. In Tables 6 to 8, we show the GPU memory consumption during training compared between eBiTCN and transformer-based models across datasets. The memory consumption varied from two to almost four times less in eBiTCN models across similar batch sizes, highlighting a substantial economic advantage for training such models. Practically, this efficiency translates to a reduced requirement for high-end GPU hardware. For instance, a bigger model necessitates a premium GPU, such as the nVidia RTX 2080Ti, which boasts 4–7 GB of memory to handle a batch size of 512 on complex datasets. In contrast, an eBiTCN model, with its lower memory footprint, could be adequately trained on a more cost-effective GPU like the RTX 2060. The economic disparity between these two GPU options is noteworthy. While the RTX 2080Ti is typically priced at over USD $1000, the RTX 2060 can be purchased for a fraction of the cost, with listings starting around USD $300 on Amazon.⁴⁶ This price difference is not merely academic; it represents a tangible reduction in the barriers to entry for researchers and practitioners looking to train sophisticated neural network models. Our findings suggest that by opting for eBiTCN architectures, not only can one achieve competitive performance but also do so in a manner that is considerably more budget-friendly. This has profound implications for the accessibility of advanced machine learning models, particularly in research environments with constrained financial resources.

Table 6.
GPU memory consumption in gigabytes during training of eBiTCN compared to other BiTCNs and transformer-based models.

Batch size Dataset eBiTCN BiTCN-MHSA TLS-MHSA BiTCN

512 CICIDS-2023 1.77 6.55 2.64 3.56

Stratosphere 1.78 5.57 2.20 3.66

256 CICIDS-2023 1.51 4.61 2.36 3.40

Stratosphere 1.49 4.91 1.86 2.13

128 CICIDS-2023 1.34 4.43 1.91 1.74

Stratosphere 1.20 4.37 1.36 1.67

Batch size	Dataset	eBiTCN	BiTCN-MHSA	TLS-MHSA	BiTCN
512	CICIDS-2023	1.77	6.55	2.64	3.56
	Stratosphere	1.78	5.57	2.20	3.66
256	CICIDS-2023	1.51	4.61	2.36	3.40
	Stratosphere	1.49	4.91	1.86	2.13
128	CICIDS-2023	1.34	4.43	1.91	1.74
	Stratosphere	1.20	4.37	1.36	1.67

GPU: graphics processing unit; eBiTCN: efficient bidirectional temporal convolution network; BiTCN: bidirectional temporal convolution network; BiTCN-MHSA: bidirectional temporal convolution network with a multi-head self-attention; TLS-MHSA: transport layer security with a multi-head self-attention.

Table 7.

Real-world detection efficiency of different models using the USTC-TFC2016 dataset.

Model	Metrics (%)	Cridex	Geodo	Htbot	Miuref	Neris	Nsis-ay	Shifu	Tinba	Virut	Zeus	Average
TCN	Recall	96.58	96.23	95.74	94.92	93.16	93.89	92.11	93.68	94.75	95.32	94.64
	Misclassification rate	3.42	3.77	4.26	5.08	6.84	6.11	7.89	6.32	5.25	4.68	5.36
	Accuracy	96.72	96.36	95.82	95.24	93.42	94.12	92.25	93.79	94.81	95.33	94.79
TGMA	Recall	97.36	96.85	96.42	96.08	94.72	95.41	93.25	94.83	95.61	96.17	95.67
	Misclassification rate	2.64	3.15	3.58	3.92	5.28	4.59	6.75	5.17	4.39	3.83	4.33
	Accuracy	97.43	97.06	96.52	96.14	94.88	95.47	93.31	94.96	95.72	96.21	95.77
CLAIRE	Recall	95.92	95.61	94.88	94.57	93.04	93.72	91.33	92.94	93.87	94.42	94.03
	Misclassification rate	4.08	4.39	5.12	5.43	6.96	6.28	8.67	7.06	6.13	5.58	5.97
	Accuracy	96.06	95.68	94.96	94.62	93.27	93.89	91.54	92.97	93.92	94.43	94.13
BiTCN	Recall	98.15	97.89	97.42	97.13	96.04	96.72	94.85	95.68	96.52	97.07	96.75
	Misclassification rate	1.85	2.11	2.58	2.87	3.96	3.28	5.15	4.32	3.48	2.93	3.25
	Accuracy	98.21	97.94	97.48	97.17	96.08	96.73	94.98	95.73	96.57	97.12	96.80
BiTCN_MHSA	Recall	98.45	98.19	97.87	97.63	96.87	97.36	95.52	96.43	97.22	97.76	97.33
	Misclassification rate	1.55	1.81	2.13	2.37	3.13	2.64	4.48	3.57	2.78	2.24	2.67
	Accuracy	98.56	98.29	97.92	97.68	96.89	97.38	95.62	96.48	97.27	97.81	97.39
BiLSTM-CNN	Recall	97.43	97.16	96.01	95.77	94.38	95.16	92.81	94.28	95.12	95.76	95.39
	Misclassification rate	2.57	2.84	3.99	4.23	5.62	4.84	7.19	5.72	4.88	4.24	4.61
	Accuracy	97.52	97.23	96.07	95.83	94.49	95.24	92.93	94.32	95.19	95.79	95.46
eBiTCN	Recall	99.28	99.04	98.71	98.43	97.81	98.32	96.67	97.56	98.31	98.79	98.29
	Misclassification rate	0.72	0.96	1.29	1.57	2.19	1.68	3.33	2.44	1.69	1.21	1.71
	Accuracy	99.34	99.09	98.76	98.48	97.88	98.39	96.72	97.63	98.37	98.84	98.35

TCN: temporal convolutional network; TGMA: temporal convolutional network (TCN), the gated recurrent unit (GRU), and multi-head self-attention; eBiTCN: efficient bidirectional temporal convolution network; BiTCN: bidirectional temporal convolution network; BiTCN-MHSA: bidirectional temporal convolution network with a multi-head self-attention; BiLSTM-CNN: bidirectional long short-term memory-convolutional neural network; USTC: University of Science and Technology of China.

Table 8.

Unknown malicious attacks detection efficiency of different models on USTC-TFC2016 dataset.

Model	Metrics (%)	w/o Cridex	w/o Geodo	w/o Virut	w/o Htbot	w/o Tinba	Average
TCN	Recall	86.47	87.65	85.94	86.13	86.78	86.59
	Misclassification rate	13.53	12.35	14.06	13.87	13.22	13.41
	Accuracy	87.05	87.83	86.23	86.34	86.92	86.87
TGMA	Recall	88.92	89.74	88.45	88.63	89.01	88.95
	Misclassification rate	11.08	10.26	11.55	11.37	10.99	11.05
	Accuracy	89.2	89.93	89.32	89.49	89.14	89.42
CLAIRE	Recall	85.32	86.47	84.92	85.16	85.75	85.52
	Misclassification rate	14.68	13.53	15.08	14.84	14.25	14.48
	Accuracy	85.68	86.74	85.02	85.24	85.82	85.7
BiTCN	Recall	91.54	92.37	90.98	91.21	91.74	91.57
	Misclassification rate	8.46	7.63	9.02	8.79	8.26	8.43
	Accuracy	91.76	92.52	91.14	91.36	91.89	91.73
BiTCN_MHSA	Recall	92.74	93.61	92.12	92.48	93.03	92.8
	Misclassification rate	7.26	6.39	7.88	7.52	6.97	7.2
	Accuracy	92.92	93.69	92.24	92.56	93.13	92.91
BiLSTM-CNN	Recall	89.04	89.82	88.54	88.75	89.31	89.09
	Misclassification rate	10.96	10.18	11.46	11.25	10.69	10.91
	Accuracy	89.32	90.04	89.15	89.36	89.78	89.53
eBiTCN	Recall	95.54	96.27	95.12	95.38	95.82	95.63
	Misclassification rate	4.46	3.73	4.88	4.62	4.18	4.37
	Accuracy	95.71	96.41	95.26	95.49	95.94	95.76

TCN: temporal convolutional network; TGMA: temporal convolutional network (TCN), the gated recurrent unit (GRU), and multi-head self-attention; eBiTCN: efficient bidirectional temporal convolution network; BiTCN: bidirectional temporal convolution network; BiTCN-MHSA: bidirectional temporal convolution network with a multi-head self-attention; BiLSTM-CNN: bidirectional long short-term memory-convolutional neural network; USTC: University of Science and Technology of China.

5.4. Stability of eBiTCN model

The stability and generalizability of network traffic detection models are paramount for practical deployment. To assess the proposed eBiTCN model’s performance, we ran an iterative comparative analysis against eight other deep learning-based models using two datasets: CICIDS-2018 and Stratosphere. The results are shown in Figure 8(a) using precision, recall, F1-score, and accuracy as evaluation metrics. As shown in Figure 8(b), eBiTCN stands out with the highest precision score of 100% on the CICIDS-2018 dataset, showcasing its exceptional capability to accurately detect all instances of malicious traffic without false positives. This level of precision is superior among the compared models and also indicates a high degree of model stability and generalization to different traffic patterns. On the Stratosphere dataset, eBiTCN slightly reduces its precision score to 99.5%, yet it continues to lead the comparison by a significant margin. This consistency across different datasets further emphasizes the robustness of eBiTCN and its potential effectiveness in diverse real-world scenarios. The models TCN, CLAIRE, and TLS-MHSA also exhibit consistent performance, although their precision scores are lower compared to eBiTCN and BiTCN-MHSA. The TCN model, with the lowest precision scores among the evaluated models, indicates a need for further optimization to improve its detection capabilities.

Figure 8.

Stability of efficient bidirectional temporal convolution network (eBiTCN) against different models: (a) precision, (b) recall, (c) F1-score, and (d) accuracy.

The recall scores as compared in Figure 8(b) demonstrate the performance of each model on both datasets. Among them, eBiTCN model demonstrates a strong performance with a recall score of 97.0% on the CICIDS-2018 dataset, which is among the highest in the comparison. This score indicates that eBiTCN is highly effective in identifying a broad range of malicious traffic instances. On the Stratosphere dataset, eBiTCN maintains a competitive edge with a recall score of 96.8%, suggesting that the model is stable across different data distributions. Figure 8(c) presents the F1-scores of each model across both datasets. The eBiTCN model achieves the highest F1-score of 100.0% on the CICIDS-2018 dataset, indicating a perfect balance between precision and recall. When evaluated on the Stratosphere dataset, eBiTCN continues to lead with an F1-score of 99.5%, which, while slightly lower than its performance on CICIDS-2018, still significantly surpasses the other models. This consistency across different datasets highlights the model’s robustness, stability, and generalizability. The proposed eBiTCN model has a shorter interquartile range compared to other models with higher detection efficiency, which also indicates that the eBiTCN is more stable. As presented in Figure 8(d), the eBiTCN model achieves the highest accuracy score of 100.0% on the CICIDS-2018 dataset, indicating a perfect classification performance with no errors in identifying both benign and malicious traffic. On the Stratosphere dataset, eBiTCN slightly reduces its accuracy to 99.8%, yet it continues to outperform the other models by a significant margin. The BiTCN model also exhibits strong performance with an accuracy score of 99.6% on CICIDS-2018, which is maintained at 99.4% on Stratosphere. The TCN model demonstrates a consistent performance with accuracy scores of 99.2% on CICIDS-2018 and 99.0% on Stratosphere. While these scores are high, the models especially BiTCN-MHSA, BiLSTM-CNN, S-TCN, TGMA, and TLS-MHSA perform relatively well, they have long range interquartile scores. TCN, S-TCN, BiTCN, CLAIRE, TGMA, and TLS-MHSA also have outliers in one or more datasets across all metrics. The stability of eBiTCN is evident in the observed results as the model exhibits no outliers across all metrics. This consistency suggests that eBiTCN is less susceptible to variations in data and can maintain its performance even in the presence of anomalies or noise in the traffic data. The shorter interquartile range observed in the box plots for precision, recall, and F1-score further indicates the stability of eBiTCN, as it suggests a smaller variation in the model’s performance across different segments of the dataset. The modified cross-entropy loss function used in eBiTCN, which includes a temporal consistency term, was instrumental in the model’s outstanding performance. This term ensures that the model’s predictions are not only accurate but also consistent over time, which is essential for capturing the sequential nature of network traffic. By incorporating this term, eBiTCN is better equipped to detect patterns that span across multiple time steps, thus improving its ability to identify malicious activities that may evolve.

5.5. Performance analysis of detection models on real-world dataset and evolving threats

We conducted experiments to evaluate the effectiveness of various models in detecting unknown malicious network traffic and simulating real-world dynamic network environments. To fully capture the complexity of real-world network traffic, we used the USTC-TFC2016 dataset, developed by the University of Science and Technology of China (USTC) for analyzing and detecting malicious traffic. This dataset contains a diverse range of malicious traffic types, representing various malware families such as Cridex, Geodo, Htbot, Miuref, Neris, Nsis-ay, Shifu, Tinba, Virut, and Zeus. The traffic images in the dataset originate from different real-world scenarios and cover multiple categories, making it diverse and representative of actual network environments.

To simulate the challenge of detecting previously unseen threats, we withheld specific attack categories from the training phase. This approach required the models to identify and detect new, unseen attack types during testing, thereby providing a more rigorous assessment of their generalization capabilities in real-world scenarios. We withheld specific attack types from the training phase to evaluate the models’ ability to detect previously unseen malicious network traffic, thereby simulating a zero-day attack detection scenario. Specifically, we excluded the malware types Cridex, Geodo, Virut, Htbot, and Tinba from the training dataset. The remaining attack types, including Miuref, Neris, Nsis-ay, Shifu, and Zeus, were retained in the training dataset to assess the models’ generalization capability. After training, the models were tested on the full test dataset, which included all attack categories, including the withheld types. For each model, we recorded the recall, misclassification rate, and accuracy under the condition of withheld attack categories to evaluate their effectiveness in identifying evolving attack types in real-world scenarios.

The detection efficiency of various models on the USTC-TFC2016 dataset, covering metrics such as recall, misclassification rate, and accuracy, highlights notable distinctions in each model’s capability to detect diverse malware types. The eBiTCN model consistently outperforms other models across all metrics, achieving the highest recall (average 98.29%), the lowest misclassification rate (average 1.71%), and the highest accuracy (average 98.35%) across all tested attack types. This superior performance indicates that eBiTCN is highly effective at identifying malicious traffic accurately, with minimal false positives. In comparison, the BiTCN and BiTCN_MHSA models also demonstrate high detection efficiency, with average recalls of 97.07% and 97.76%, respectively, coupled with low misclassification rates. Although they slightly trail eBiTCN, these models still maintain commendable detection performance across known attacks, showcasing the advantage of BiTCN architectures for classifying both benign and malicious traffic. Conversely, models such as TCN, TGMA, and CLAIRE exhibit more moderate performance, with recall values ranging between 86% and 96% and misclassification rates between 3.83% and 14.48%. This variation suggests that these simpler architectures may lack the depth needed to reliably capture and differentiate complex attack patterns across diverse malware types. The BiLSTM-CNN model, while balancing detection with an average recall of 95.76%, displays a higher misclassification rate, indicating that its BiLSTM layers are somewhat limited in handling a diverse array of network traffic types compared to models with refined convolutional mechanisms.

When specific attack types (Cridex, Geodo, Virut, Htbot, and Tinba) were withheld during training, eBITCN outperformed other models’ ability to detect these withheld attacks during testing. The eBiTCN model achieved an average recall of 95.63% on withheld attacks, with a misclassification rate of 4.37% and an accuracy of 95.76%. This high detection efficiency in an evolving attack context underscores eBiTCN’s capacity to generalize well beyond the known attacks it was trained on, likely due to its lightweight gating mechanism and temporal attention components that allow the model to identify subtle patterns even in previously unseen traffic. The superior performance of eBiTCN in evolving attack detection confirms its suitability for real-world applications where new threats are continuously emerging.

The BiTCN and BiTCN_MHSA models also adapt reasonably well to evolving attacks, maintaining recall rates of 91.57% and 92.80%, respectively, and relatively low misclassification rates. This indicates a high degree of adaptability to evolving attacks, though with a slight reduction in accuracy compared to eBiTCN. These results highlight the effectiveness of BiTCN architectures in adapting to evolving threats, but they also suggest that additional architectural elements, such as the temporal attention mechanism in eBiTCN, provide a measurable advantage. In contrast, the performance of TCN and CLAIRE reveals limitations when it comes to evolving attack detection. Their recall values drop significantly, to an average of 86.59% and 85.52%, respectively, while misclassification rates increase substantially. This performance gap, particularly when moving from known to evolving attacks, suggests that these simpler architectures may overfit to the attack patterns observed during training, thus struggling to identify new, dynamic threats accurately. CLAIRE and TCN both lack the advanced temporal features present in more complex architectures like eBiTCN, which may explain their inability to generalize effectively and their increased tendency to misclassify benign traffic as malicious in evolving attack scenarios. The BiLSTM-CNN model demonstrates the intermediate performance in this scenario, achieving an average recall of 89.09% and an accuracy of 89.53% on withheld attacks. Its higher misclassification rate in this context suggests that while its sequential LSTM layers capture some dependencies effectively, they may lack the nuanced temporal feature extraction required for accurately identifying unknown attacks. Consequently, the BiLSTM-CNN model is less robust than eBiTCN and BiTCN_MHSA in scenarios involving rapidly evolving threats.

Finally, while most models perform well on known attacks, their capacity to detect evolving attacks varies notably. The eBiTCN model, with its high recall, low misclassification rate, and strong generalization capabilities, emerges as the top performer for both known and evolving attacks, making it particularly suitable for real-world applications where new threats continuously emerge. BiTCN and BiTCN_MHSA also provide reliable detection capabilities, showing a moderate reduction in accuracy for evolving attacks but remaining adaptable in dynamic environments. However, simpler architectures like TCN and CLAIRE face substantial challenges in evolving attack detection, limiting their applicability to more predictable network environments. The BiLSTM-CNN model, while moderately robust, may still fall short in dynamic threat scenarios due to its limited temporal feature extraction capabilities.

5.5.1. MAWILab dataset

The MAWILab dataset,³⁸ which comprises a mix of normal, malicious, and background network traffic, posed a significant challenge for testing the model’s robustness. The model achieved a precision of 99.47%, recall of 99.53%, and F1-score of 99.50% as shown in Table 9. These results affirm the model’s high efficacy in accurately classifying and identifying network anomalies.

Table 9.
Performance results on MAWILab dataset.

Metric TCN TGMA CLAIRE BiTCN BiTCN_MHSA BiLSTM-CNN S-TCN TLS-MSHA eBiTCN

Precision (%) 97.24 98.13 96.47 94.83 95.62 94.36 97.01 97.52 99.47

Recall (%) 97.58 97.93 97.04 95.25 95.87 94.72 97.34 97.81 99.53

F1-score (%) 97.31 98.02 96.75 95.02 95.74 94.53 97.12 97.66 99.50

Accuracy (%) 97.46 97.81 96.82 95.14 95.79 94.63 97.24 97.73 99.58

Metric	TCN	TGMA	CLAIRE	BiTCN	BiTCN_MHSA	BiLSTM-CNN	S-TCN	TLS-MSHA	eBiTCN
Precision (%)	97.24	98.13	96.47	94.83	95.62	94.36	97.01	97.52	99.47
Recall (%)	97.58	97.93	97.04	95.25	95.87	94.72	97.34	97.81	99.53
F1-score (%)	97.31	98.02	96.75	95.02	95.74	94.53	97.12	97.66	99.50
Accuracy (%)	97.46	97.81	96.82	95.14	95.79	94.63	97.24	97.73	99.58

5.5.2. ISCXVPN2016 dataset

The ISCXVPN2016 dataset³⁹ comprises a comprehensive collection of VPN and non-VPN traffic, providing a robust platform for evaluating network security solutions. It includes various types of encrypted and regular traffic, simulating a real-world scenario that challenges the ability of models to distinguish between benign and malicious communications effectively.

The evaluation in Table 10 demonstrates robust performance across all models, highlighting the capability of our approach in handling complex VPN traffic. The proposed model, eBiTCN, achieved the highest precision of 98.21%, indicating its superior ability to accurately identify malicious traffic without falsely labeling benign traffic. Similarly, its recall rate of 98.54% underscores its effectiveness in capturing nearly all malicious activities within the dataset. The eBiTCN model also recorded an F1-score of 98.36% and an accuracy of 98.61%, further confirming its efficiency and reliability in a VPN traffic scenario, where traffic patterns can vary significantly and are often encrypted.

Table 10.
Performance results on ISCXVPN2016 dataset.

Metric TCN TGMA CLAIRE BiTCN BiTCN_MHSA BiLSTM-CNN S-TCN TLS-MSHA eBiTCN

Precision (%) 95.71 96.42 95.24 96.85 97.28 96.15 96.54 96.92 98.21

Recall (%) 95.41 96.64 95.71 97.03 97.41 96.43 96.71 97.13 98.54

F1-score (%) 95.63 96.52 95.41 96.92 97.34 96.25 96.63 97.02 98.36

Accuracy (%) 95.53 96.35 95.31 97.12 97.56 96.35 96.82 97.25 98.61

Metric	TCN	TGMA	CLAIRE	BiTCN	BiTCN_MHSA	BiLSTM-CNN	S-TCN	TLS-MSHA	eBiTCN
Precision (%)	95.71	96.42	95.24	96.85	97.28	96.15	96.54	96.92	98.21
Recall (%)	95.41	96.64	95.71	97.03	97.41	96.43	96.71	97.13	98.54
F1-score (%)	95.63	96.52	95.41	96.92	97.34	96.25	96.63	97.02	98.36
Accuracy (%)	95.53	96.35	95.31	97.12	97.56	96.35	96.82	97.25	98.61

5.5.3. UJS-IDS2022 dataset

The UJS-IDS2022 dataset,⁴⁰ collected by the Key Laboratory of Industrial Cyberspace Security Technology of Jiangsu University, represents a significant volume of network interactions from a real-time environment, encompassing 2.76 million benign and 4.91 million malicious network traffics. This dataset reflects current network threats and provides a dynamic testbed for evaluating the adaptability and accuracy of network intrusion detection systems.

As illustrated in Table 11, the proposed model eBiTCN showcased exemplary performance, achieving the highest precision of 99.89%. This remarkable precision, coupled with a recall of 99.83%, indicates the model’s exceptional ability to distinguish between benign and malicious traffic with near-perfect accuracy. The F1-score and accuracy stood at 99.86% and 99.73%, respectively, reflecting the model’s comprehensive effectiveness in a real-world setting, characterized by a high volume of complex network interactions.

Table 11.
Performance results on UJS-IDS2022 dataset.

Metric TCN TGMA CLAIRE BiTCN BiTCN_MHSA BiLSTM-CNN S-TCN TLS-MSHA eBiTCN

Precision (%) 96.85 97.13 96.34 96.77 97.05 96.41 98.57 99.01 99.89

Recall (%) 96.74 97.34 96.27 96.93 97.14 96.58 98.69 98.92 99.83

F1-Score (%) 96.79 97.23 96.30 96.85 97.09 96.49 98.63 98.96 99.86

Accuracy (%) 96.92 97.04 96.19 97.02 97.25 96.65 98.45 98.85 99.73

Metric	TCN	TGMA	CLAIRE	BiTCN	BiTCN_MHSA	BiLSTM-CNN	S-TCN	TLS-MSHA	eBiTCN
Precision (%)	96.85	97.13	96.34	96.77	97.05	96.41	98.57	99.01	99.89
Recall (%)	96.74	97.34	96.27	96.93	97.14	96.58	98.69	98.92	99.83
F1-Score (%)	96.79	97.23	96.30	96.85	97.09	96.49	98.63	98.96	99.86
Accuracy (%)	96.92	97.04	96.19	97.02	97.25	96.65	98.45	98.85	99.73

5.6. Scalability assessment

The results presented in Table 12 highlight the scalability of the eBiTCN model when applied to the USTC-TFC2016 dataset at varying dataset test sizes, ranging from 10% to the full 90% of the data. As expected, the model’s recall and accuracy show a positive correlation with dataset size. At 10% of the data, the recall is 96.5%, which gradually increases to 98.3% when using 90% of the test set. Similarly, accuracy improves from 96.4% with 10% of the data to 98.4% with 90% of the dataset. These findings indicate that as the model is exposed to a greater diversity of samples, its ability to generalize and detect malicious traffic improves. The high recall and accuracy achieved at 90% confirm the model’s effectiveness in identifying attack patterns and reducing false negatives.

Table 12.
Scalability analysis of efficient bidirectional temporal convolution network (eBITCN) with varying data sizes.

Dataset size Recall (%) Misclassification rate (%) Accuracy (%) Training time (s) Energy cost (J)

10% 96.5 3.0 96.4 35.6 78.5

25% 97.2 2.4 97.0 72.3 152.6

50% 97.8 2.0 97.6 142.4 245.3

75% 98.1 1.8 98.0 215.7 317.9

90% 98.3 1.7 98.4 285.1 382.4

Dataset size	Recall (%)	Misclassification rate (%)	Accuracy (%)	Training time (s)	Energy cost (J)
10%	96.5	3.0	96.4	35.6	78.5
25%	97.2	2.4	97.0	72.3	152.6
50%	97.8	2.0	97.6	142.4	245.3
75%	98.1	1.8	98.0	215.7	317.9
90%	98.3	1.7	98.4	285.1	382.4

Conversely, the misclassification rate follows a decreasing trend as the dataset size increases, starting at 3.0% for 10% of the data and dropping to 1.7% at size 90%. This aligns with expectations, as smaller training datasets are likely to have limited representative samples, leading to higher misclassification. With more extensive data, the model gains a more comprehensive understanding of both normal and malicious traffic patterns, thus reducing errors.

In terms of computational efficiency, both training time and energy cost rise as the dataset size increases. Training time escalates from 35.6 seconds for 10% of the data to 285.1 seconds at size 90%, while energy consumption grows from 78.5 to 382.4 J. These metrics highlight the computational burden associated with processing larger volumes of data, reflecting the model’s scalability requirements. While these increases are expected, they underscore the potential need for efficient resource management and optimization strategies in real-world deployments, especially in environments where computational resources or energy are constrained.

5.7. Ablation experiments

In this section, we examine the performance of the proposed eBITCN model under different architectural components. The results are illustrated in Table 13 and Figures 9 and 10 and discussed as follows. First, we investigated the impact of different activation functions on the eBiTCN model by comparing the original ReLU with GELU and ELU activation functions. Figure 9 presents the training progress of eBiTCN with each activation function across the epochs. It is observed that the GELU activation function consistently leads to higher performance, as indicated by loss values. Replacing the traditional ReLU activation function with GELU in eBiTCN has resulted in a notable performance improvement. GELU demonstrates a more rapid convergence and achieves a higher final performance metric, suggesting that it better handles the challenges of neuron death and mitigates the vanishing gradient problem associated with ReLU. This is evident in both the CICIDS-2018 and Stratosphere datasets, where GELU outperforms ReLU and ELU across the training epochs. The GELU activation function has been shown to have several advantages over ReLU and ELU. Its design incorporates a probabilistic weighting of inputs, allows for a non-linear and adaptive transformation that can lead to better representation learning. This is particularly beneficial in the context of network traffic analysis, where the temporal dynamics and feature interactions are complex.

Table 13.
Performance metrics and computational efficiency of efficient bidirectional temporal convolution network (eBiTCN) with ablated components.

Components Parameters $b_{s}$ $d_{h}$ k N $P_{d}$ Prec (%) Acc (%) Rec (%) F1 Training time (s) Energy cost (J)

Full model (eBiTCN) 49k 512 12 9 5 0.01 96.18 96.19 98.57 97.61 121.26 230

W/o temporal attention 56k 512 12 9 5 0.01 95.87 95.92 98.02 96.60 230.45 320.60

W/o lightweight gating mechanism 54k 512 12 9 5 0.01 95.92 95.95 97.75 96.48 225.30 310.75

W/o dilated convolutions 52k 512 12 9 5 0.01 95.95 96.00 97.63 96.53 220.80 305.50

Components	Parameters	$b_{s}$	$d_{h}$	k	N	$P_{d}$	Prec (%)	Acc (%)	Rec (%)	F1	Training time (s)	Energy cost (J)
Full model (eBiTCN)	49k	512	12	9	5	0.01	96.18	96.19	98.57	97.61	121.26	230
W/o temporal attention	56k	512	12	9	5	0.01	95.87	95.92	98.02	96.60	230.45	320.60
W/o lightweight gating mechanism	54k	512	12	9	5	0.01	95.92	95.95	97.75	96.48	225.30	310.75
W/o dilated convolutions	52k	512	12	9	5	0.01	95.95	96.00	97.63	96.53	220.80	305.50

Figure 9.

Activation function.

Figure 10.

Loss function.

Next, we assessed the influence of our proposed loss function and compared to cross entropy loss function is used. As shown in Figure 10, the modified cross-entropy with temporal consistency (TC-CE) loss function consistently outperforms the traditional cross-entropy across a range of epochs for both datasets. Notably, the TC-CE loss demonstrates a marked improvement in convergence speed, achieving a lower error rate in fewer epochs compared to the CE and CE-CICIDS-2018 loss functions. This enhanced performance can be attributed to the temporal consistency component of our loss function, which encourages the model to learn from the sequential nature of the data and maintain stable predictions over time. For instance, on the CE Stratosphere dataset, the TC-CE loss function achieves an error rate of approximately 0.030 at the 50th epoch, which is significantly lower than the error rates of the CE and CE-CICIDS-2018 loss functions. Similarly, on the CE-CICIDS-2018 dataset, the TC-CE loss function exhibits a comparable advantage, with a notable decrease in error rate as the number of epochs increases. The results highlights the importance of considering temporal dependencies in the design of loss functions for sequential data analysis. The TC-CE loss function’s ability to adapt to these temporal dynamics and achieve superior performance in our experiments suggests that it is a promising approach for tasks involving time-series data or any scenario where the temporal aspect plays a significant role.

Furthermore, Table 13 presents the ablation study results for eBiTCN, showing the performance metrics and computational efficiency when temporal attention, gating mechanism, and dilated convolutions are removed. Removing temporal attention increases the parameter count to 56k, with training time and energy cost significantly rising to 230.45 seconds and 320.60 J, respectively. Detection metrics decrease slightly, particularly F1-score, indicating that temporal attention not only improves accuracy but also enhances computational efficiency by focusing on relevant temporal patterns. Without the gating mechanism, the parameter count increases to 54k, with training time and energy costs also rising. This setup leads to a minor reduction in precision, accuracy, and F1-score, suggesting that the gating mechanism plays a key role in optimizing feature selection and computational efficiency by filtering out less relevant information. Removing dilated convolutions results in a parameter count of 52k, with increased training time and energy consumption. Detection performance remains high, but recall and F1-score experience a small drop. Dilated convolutions enable efficient capture of long-range dependencies, reducing the need for additional layers to maintain temporal accuracy.

5.8. Application of eBITCN in real-world environments

The eBiTCN model is purpose-built for deployment in resource-constrained environments. The model leverages a combination of bidirectional temporal convolutions and temporal attention mechanisms, enabling it to capture nuanced temporal dependencies and adaptively focus on significant features within the traffic data. This allows eBiTCN to consider both past and future traffic contexts, enhancing its ability to differentiate between malicious and benign traffic in real-time. The innovations presented in eBiTCN address key real-world challenges, including scalability, adaptability, privacy compliance, and operational efficiency. These features, combined with strong performance on real-world datasets, demonstrate the model’s potential to serve as a practical and reliable solution for modern network security.

Designed to handle diverse attack types, eBiTCN has shown effectiveness in detecting new attack types. The model’s ability to recognize these types of attacks highlights its adaptability and strength in real-world scenarios. In particular, experiments demonstrate that eBiTCN is capable of detecting new and evolving attacks, a critical feature given the rapidly changing nature of network threats. The bidirectional temporal convolutions enable the model to capture complex, multi-directional patterns within network traffic, making it challenging for attackers to evade detection by modifying isolated traffic features. Furthermore, the self-attention mechanism enhances the model’s robustness by dynamically prioritizing the most relevant traffic characteristics. This adaptability allows eBiTCN to adjust its focus based on the data context, effectively capturing evolving traffic patterns and making it resilient against minor traffic modifications that attackers may use to avoid detection.

Scalability is another critical consideration for real-world deployment, as eBiTCN is expected to operate in environments with varying resource constraints and data volumes. The scalability analysis demonstrates that eBiTCN maintains high detection and accuracy rates with increasing data volumes, albeit with rising computational demands. These results suggest that the model is well-suited for real-world deployment, where large-scale data is available, and also highlight the trade-off between model performance and computational cost. This scalability is essential for practical applications, where the ability to handle extensive and evolving datasets is critical for robust, real-time detection of network threats. Its relatively lightweight architecture enables it to be deployed on resource-constrained devices, such as edge or IoT systems. However, in high-throughput environments like large enterprise networks or ISP-level monitoring, additional strategies may be required to ensure consistent performance. Scaling eBiTCN through parallel processing or distributed deployment can support its ability to handle large data volumes without compromising speed or detection accuracy. This adaptability to different deployment environments underlines the model’s potential as a versatile solution for diverse network security needs.

Last, eBiTCN integrates bidirectional temporal convolutional layers with adaptive temporal attention to detect a broad spectrum of network threats efficiently and with high accuracy. Its architecture supports real-time performance in diverse settings, from high-capacity networks to resource-limited devices. The model’s robustness in identifying both known and emerging attack types makes it highly suited for deployment in dynamic, real-world environments, where adaptability and resilience against evolving threats are essential.

6. Conclusion, implications, and future directions

The rapid increase in encrypted malicious network traffic poses a significant challenge to traditional cybersecurity measures, necessitating efficient detection methods. In this study, we introduced eBiTCN, an efficient BiTCN, specifically designed to detect encrypted malicious network traffic with high efficacy and computational efficiency. Our model addresses the limitations of existing TCN and BiTCN architectures by significantly reducing the number of parameters required, thus lowering memory requirements and training costs. The eBiTCN framework integrates innovative features such as dilated convolutions, depthwise separable convolutions, a GELU activation function, temporal attention, dropout, and a novel loss function to enhance its detection capabilities and efficiency. Our extensive experiments on the CICIDS-2018 and Stratosphere datasets demonstrated that eBiTCN outperforms eight state-of-the-art models in terms of detection accuracy, computational complexity, training time, energy consumption, and stability. The eBiTCN model, as presented in this study, has demonstrated a significant advancement in the detection of encrypted malicious network traffic. The incorporation of the GELU activation function has proven to be a key factor in the model’s performance, offering an adaptive transformation of inputs compared to traditional ReLU.³⁰ As depicted in Figure 9, GELU consistently led to higher performance across training epochs, suggesting its effectiveness in capturing the complex temporal dynamics inherent in network traffic data.

The novel loss function, which integrates a temporal consistency term with weighted cross-entropy, has been instrumental in addressing the challenges of class imbalance and the temporal sensitivity required for sequence modeling (equation (10)). This function has shown to enhance the model’s ability to detect underrepresented malicious patterns while maintaining a focus on temporal dependencies, a necessity for encrypted traffic analysis where anomalies can be rare and subtle. Depthwise separable convolutions allowed eBiTCN to reduce the number of parameters, thus lowering the computational burden without compromising the model’s ability to capture intricate patterns. This approach has been central to creating a more efficient architecture, aligning with the model’s goal of being lightweight yet powerful. Dropout, as a form of regularization, has played a critical role in preventing overfitting, particularly in the context of limited and imbalanced datasets. By randomly deactivating neurons during training, dropout has contributed to the robustness of the eBiTCN model, ensuring that it generalizes well to unseen data. The temporal attention mechanism has been crucial for isolating subtle anomalous signals indicative of encrypted threats, thereby enhancing the model’s detection capabilities.

The advantages of the eBiTCN model are manifold, including its efficiency, speed, scalability, and stability. As shown in the results, eBiTCN achieves state-of-the-art performance with fewer parameters, leading to reduced computational and memory requirements. The model’s training speed and energy efficiency, as demonstrated in Table 1, position it favorably for deployment in environments with constrained resources. Furthermore, the stability of eBiTCN across different datasets, as evidenced by the consistent performance in Table 7, validates its reliable operation in diverse real-world scenarios. Several aspects of the model’s design contribute to its scalability, ensuring that it can handle large volumes of data efficiently while maintaining high detection accuracy. The eBiTCN model leverages bidirectional processing and temporal attention mechanisms, which, despite their complexity, have been optimized to enhance scalability. By incorporating dilated convolutions, adaptive batch processing, depthwise separable convolutions and a novel loss function, we significantly reduce the parameter count and computational load. These optimizations ensure that the model remains lightweight and efficient, capable of processing high volumes of network traffic without performance degradation. Our model is inherently parallelizable due to the nature of convolutional operations. This allows for efficient utilization of parallel and distributed computing resources. Implementing distributed training frameworks, such as TensorFlow’s distributed strategy or PyTorch’s distributed data-parallel, enables the model to scale seamlessly across multiple GPUs or even clusters of machines. This scalability ensures that the model can handle real-time detection tasks in large-scale network environments, significantly reducing training and inference times. The model dynamically adjusts batch sizes based on current traffic loads, optimizing computational resource usage. This adaptability ensures that eBiTCN can maintain high detection accuracy and timely responses, even under peak traffic conditions, making it highly scalable for varying network environments. Memory management is crucial for scaling deep learning models. The use of lightweight gating mechanisms and depthwise separable convolutions in eBiTCN minimizes memory requirements. Additionally, we employ memory optimization techniques such as gradient checkpointing, which reduces memory usage during training. These optimizations enable the processing of larger batches and longer sequences, further enhancing the model’s scalability. For real-time deployment, the latency introduced by the model’s processing is minimal. The bidirectional nature of eBiTCN, combined with our optimization strategies, ensures that any additional computation steps do not significantly impact real-time performance. The design and optimization of eBiTCN ensure that it is not only accurate and efficient but also highly scalable. By leveraging parallel and distributed computing, adaptive batch processing, efficient memory management, and real-time deployment techniques, we demonstrate that eBiTCN is well-equipped to handle the complexities of high-volume network traffic. These features make eBiTCN a robust and scalable solution for encrypted malicious network traffic detection, ready for deployment in diverse and demanding network settings.

Future research should aim to test eBiTCN across a wider array of datasets to ensure its generalizability. In terms of future research directions, it would be beneficial to conduct adversarial training to bolster the model’s robustness against sophisticated threats. Testing eBiTCN in real-time network environments would provide insights into its practical applicability and potential optimization for such use cases. Moreover, enhancing the model’s explainability could facilitate better understanding and trust from practitioners, which is essential for cybersecurity solutions.

Footnotes

Acknowledgements

This work was partly supported by the National Natural Science Foundation of China (NSFC) (grant nos. 62172194, 62202206, and U1836116), the National Key R and D Program of China (grant no. 2020YFB1005500), the Natural Science Foundation of Jiangsu Province, China (grant no. BK20220515), the China Postdoctoral Science Foundation, China (grant no. 2021M691310), and Qinglan Project of Jiangsu Province, China.

ORCID iDs

Ernest Akpaku

Jinfu Chen

Mukhtar Ahmed

Rexford Nii Ayitey Sosu

Francis Kwadzo Agbenyegah

Dominic Kofi Louis

Funding

The author(s) received no financial support for the research, authorship, and/or publication of this article.

Conflicting interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

References

El-Maghraby

Abd Elazim

Bahaa-Eldin

. A survey on deep packet inspection. In: 2017 12th International conference on computer engineering and systems (ICCES), 2017, pp.188–197. DOI:10.1109/ICCES.2017.8275301.

Chen

Song

Cai

, et al. TLS-MHAA: an efficient detection model for encrypted malicious traffic based on multi-head self-attention mechanism. ACM Trans Priv Secur 2023c; 26: 1–21.

Roques

. Detecting malware in tls traffic, 2019, https://api.semanticscholar.org/CorpusID:208194045.

Xie

Wang

Cao

, et al. Rosetta: enabling robust tls encrypted traffic classification in diverse network environments with tcp-aware traffic augmentation. In: Proceedings of the ACM turing award celebration conference - China 2023, 2023, ACM TURC ’23, pp.131–132, New York, NY, USA. Association for Computing Machinery.

Elmaghraby

Abdel Aziem

Sobh

, et al. Encrypted network traffic classification based on machine learning. Ain Shams Eng J 2024; 15: 102361.

Papadogiannaki

Ioannidis

. A survey on encrypted network traffic analysis applications, techniques, and countermeasures. ACM Comput Surv 2021; 54: 33.

Song

Luktarhan

Shi

, et al. TGA: a novel network intrusion detection method based on TCN, Bigru and attention mechanism. Electronics 2023; 12: 2849.

Cao

Xie

Sun

, et al. When match fields do not need to match: buffered packets hijacking in SDN. Proc. of the Network and Distributed System Security Symposium (NDSS’20), 2020, DOI: 10.14722/ndss.2020.23040. https://par.nsf.gov/biblio/10172419.

Cai

Liu

, et al. A malicious network traffic detection model based on bidirectional temporal convolutional network with multi-head self-attention mechanism. Comput Sec 2024; 136: 103580.

10.

Chen

Cai

, et al. A novel detection model for abnormal network traffic based on bidirectional temporal convolutional network. Inf Softw Technol 2023b; 157: 107166.

11.

Xin

Ziang

Yingli

, et al. Tcn enhanced novel malicious traffic detection for IOT devices. Conn Sci 2022; 34: 1322–1341.

12.

Cao

Wang

, et al. AUTER: automatically tuning multi-layer network buffers in long-distance shadowsocks networks. In: IEEE INFOCOM 2022 - IEEE conference on computer communications, 2022, pp.1689–1698. DOI: 10.1109/INFOCOM48880.2022.9796882.

13.

Sprangers

Schelter

de Rijke

. Parameter-efficient deep probabilistic forecasting. Int J Forecast 2023; 39: 332–345.

14.

Yang

Cao

Liu

, et al. Good learning, bad performance: a novel attack against RL-based congestion control systems. IEEE Trans Inf Forens Sec 2022; 17: 1069–1082.

15.

Wang

Fok

Thing

. Machine learning for encrypted malicious traffic detection: approaches, datasets and comparative study. Comput Sec 2022; 113: 102542.

16.

Chen

Kang

Chen

, et al. Probabilistic forecasting with temporal convolutional neural network. Neurocomputing 2020; 399: 491–501.

17.

Zhu

Wang

, et al. A deep learning approach for network anomaly detection based on AMF-LSTM. In: Network and parallel computing: 15th IFIP WG 10.3 international conference, NPC 2018, Muroran, Japan, November 29–December 1, 2018, Proceedings 15, 2018, pp.137–141. Springer.

18.

Lopes

Zou

Abdulqadder

, et al. Network intrusion detection based on the temporal convolutional model. Comput Sec 2023; 135: 103465.

19.

Mehta

Yang

. NAC-TCN: temporal convolutional networks with causal dilated neighborhood attention for emotion understanding. In: Proceedings of the 2023 7th international conference on video and image processing, 2024, ICVIP ’23, pp.9–16, New York, NY, USA. Association for Computing Machinery.

20.

Lin

, et al. A novel multimodal deep learning framework for encrypted traffic classification. IEEE ACM Trans Netw 2023; 31: 1369–1384.

21.

Huang

Wang

Zhao

, et al. Malicious network traffic detection method based on traffic behavior characteristics and machine learning. In: 2023 IEEE 6th International conference on automation, electronics and electrical engineering (AUTEEE), 2023, pp.167–172. DOI: 10.1109/AUTEEE60196.2023.10407590.

22.

Tang

Deng

, et al. Research on malicious traffic detection methods based on deep learning. In: 2021 4th International conference on pattern recognition and artificial intelligence (PRAI), 2021, pp.469–475.

23.

Chen

Yin

Cai

, et al. An efficient network intrusion detection model based on temporal convolutional networks. In: 2021 IEEE 21st International conference on software quality, reliability and security (QRS), 2021, pp.768–775. DOI: 10.1109/QRS54544.2021.00086.

24.

Owoh

Riley

Ashawa

, et al. An adaptive temporal convolutional network autoencoder for malicious data detection in mobile crowd sensing. Sensors 2024; 24: 2353.

25.

Liu

Ziang

Zhang

, et al. TCN enhanced novel malicious traffic detection for IOT devices. Conn Sci 2022; 34: 1322–1341.

26.

Yiling

Xiyong

. Network abnormal traffic detection model based on CNN-bibasru-at. Microelect Comput 2024; 41: 93–99.

27.

Chen

Lin

Cai

, et al. Bitcn_drsn: an effective software vulnerability detection model based on an improved temporal convolutional network. J Syst Software 2023a; 204: 111772.

28.

Wang

Yang

. Industrial time-series modeling via adapted receptive field temporal convolution networks integrating regularly updated multi-region operations based on PCA. Chem Eng Sci 2020; 228: 115956.

29.

Gao

. Rethinking dilated convolution for real-time semantic segmentation. In: 2023 IEEE/CVF conference on computer vision and pattern recognition workshops (CVPRW), 2023, pp.4675–4684. DOI: 10.1109/CVPRW59228.2023.00493.

30.

Hendrycks

Gimpel

. Gaussian error linear units (GELUs), 2023.

31.

Bai

Kolter

Koltun

. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. CoRR, 2018, abs/1803.01271, http://arxiv.org/abs/1803.01271.

32.

Khan

Alahmadi

Ullah

, et al. A new deep boosted CNN and ensemble learning based IOT malware detection. Comput Sec 2023; 133: 103385.

33.

van den Oord

Dieleman

Zen

, et al. Wavenet: a generative model for raw audio. ArXiv, 2016, abs/1609.03499, https://api.semanticscholar.org/CorpusID:6254678.

34.

Cheng

, et al. Jointly attentive spatial-temporal pooling networks for video-based person re-identification. In: 2017 IEEE International conference on computer vision (ICCV), 2017, pp.4743–4752, Los Alamitos, CA, USA. IEEE Computer Society.

35.

Sharafaldin

Lashkari

Ghorbani

. Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: International conference on information systems security and privacy, 2018, https://api.semanticscholar.org/CorpusID:4707749.

36.

Stratosphere. Stratosphere laboratory datasets. Available, from https://www.stratosphereips.org/datasets-overview (2022, accessed 13 March 2020).

37.

Wang

Zhu

Zeng

, et al. Malware traffic classification using convolutional neural network for representation learning. In: 2017 International conference on information networking (ICOIN), 2017, pp.712–717. DOI: 10.1109/ICOIN.2017.7899588.

38.

Liu

. An abnormal network traffic detection method on mawilab dataset based on convolutional neural network. In: 2022 IEEE 2nd International conference on electronic technology, communication and information (ICETCI), 2022, pp.1233–1235.

39.

Draper-Gil

Lashkari

Mamun

MSI

, et al. Characterization of encrypted and vpn traffic using time-related features. In: International conference on information systems security and privacy, 2016, https://api.semanticscholar.org/CorpusID:21535780.

40.

Chen

Xie

Cai

, et al. GCN-MHSA: a novel malicious traffic detection method based on graph convolutional neural network and multi-head self-attention mechanism. Comput Sec 2024; 147: 104083.

41.

Anitha

Aanjankumar

Poonkuntran

, et al. A novel methodology for malicious traffic detection in smart devices using BI-ISTM–CNN-dependent deep learning methodology. Neural Comput Appl 2023; 35: 20319–20338.

42.

Andresini

Appice

Malerba

. Nearest cluster-based intrusion detection through convolutional neural networks. Knowl Based Syst 2021; 216: 106798.

43.

García-Martín

Rodrigues

Riley

, et al. Estimation of energy consumption in machine learning. J Parallel Distrib Comput 2019; 134: 75–88.

44.

NVIDIA. Geforce gtx 1080 ti specifications. Online. Available: https://www.nvidia.com/en-gb/geforce/graphics-cards/geforce-gtx-1080-ti% /specifications/ ( (2024, accessed 3 May 2024).

45.

Jin

Xuan

, et al. Enhancing the locality and breaking the memory bottleneck of transformer on time series forecasting. NY, USA: Curran Associates Inc., Red Hook, 2019.

46.

Amazon. Nvidia geforce rtx 2080 ti founders edition. Online. Available: https://www.amazon.com/NVIDIA-GEFORCE-RTX-2080-Founders/dp/B07HWMDDMK (2024, accessed 3 May 2024).