Leveraging Inter-Arrival Time for Efficient Threat Filtering: A Parsimonious Approach

Abstract

In this study, we propose a streamlined approach to intrusion detection by leveraging the Interpacket Arrival Time (IAT) as a primary metric for identifying malicious network traffic. Our objective is to enhance the efficiency of intrusion detection systems by implementing a preliminary filtering layer that rapidly identifies easily detectable attacks, thereby reducing the computational load on more sophisticated, resource-intensive models. Using datasets such as CICIoT2023, CIC-IDS-2017, and UNSW-NB15, we conducted extensive experiments to validate the effectiveness of our approach. The study employed techniques like SMOTE to address dataset imbalances and Min-Max scaling to normalize the IAT feature, ensuring optimal performance of machine learning models. We evaluated models such as Random Forest, K-Nearest Neighbors, and Multilayer Perceptron, with a particular emphasis on their ability to generalize across various datasets. Our findings demonstrate that by focusing on a single, well-chosen feature like IAT, it is possible to achieve high detection accuracy while significantly reducing training and prediction times. This method not only improves the overall efficiency of intrusion detection systems but also suggests a practical solution for real- time applications where resource constraints are a critical concern.