Search papers, labs, and topics across Lattice.
This paper introduces Slips, a novel network intrusion detection system that aggregates behavioral evidence over time to enhance host-centered assessments. By organizing network activity into time windows and employing a modular architecture, Slips improves the detection of malicious behavior that spans multiple connections. The evaluation shows that Slips outperforms Suricata with an 83% increase in recall and a 70% increase in F1 score, while maintaining zero false positives, demonstrating the effectiveness of context-aware decision-making in network security.
Time-window-based evidence aggregation in Slips leads to a significant boost in detection performance, outperforming traditional methods without increasing false positives.
Network intrusion detection systems often analyze individual packets or flows, although malicious behavior may develop across many connections and over time. This may limit their ability to combine isolated detections into a coherent assessment of host behavior. Packet-level features may also be too low-level for complex AI-based detection, requiring additional processing to improve accuracy while maintaining a low false-positive rate. We present Slips, a network intrusion detection system that builds host-centered behavioral profiles and organizes activity into time windows. It uses a modular architecture in which independent modules report evidence rather than generating final alerts directly. Slips then accumulates this evidence into host-level decisions. We evaluate Slips against Suricata on an expert-labeled PCAP dataset. At the profile-time-window level, Slips achieved 83% higher recall and a 70% higher F1 score than Suricata, while neither system produced false positives. These results indicate that time-window-based evidence accumulation can produce context-aware decisions that better align with expert judgment.
