Spiking neural networks have attracted considerable research interest for network security applications owing to their inherent energy efficiency and temporal processing capabilities [7,8]. Rathi and Roy proposed LITE-SNN, which exploited natural temporal variations to achieve energy-efficient sequential learning in security-related classification tasks [13]. More recently, Gao et al. advanced SNN deployment on FPGAs through neuromorphic architectures, demonstrating real-time edge computing capability for network performance monitoring [6]. Nevertheless, standalone SNNs consistently exhibit accuracy limitations in the presence of the high-dimensional and complex feature spaces of contemporary network traffic [9,10,20].

Transformer architectures have set new performance standards in network intrusion detection using multi-head self-attention to model long-range dependencies between traffic flow sequences [2,12]. Karthik et al. introduced TASNN, which was a protocol-conscious transformer-spiking hybrid model from a transformer capable of achieving competitive detection rates and lower energy consumption with built-in spiking computation [2]. The Spike-Driven Transformer architecture proposed by Yao et al. showed that spiking-based systems could be successfully put into practice in the context of transformer architectures in large scale pattern recognition applications [7,12]. The Spiking Wavelet Transformer, proposed by Fang et al. and including the frequency decomposition based on the wavelet technique better extract the temporal features, was introduced [15]. In spite of these developments, the current transformer-based NIDS solutions have quadratic computational complexity and no means of constant adaptation to changing threat environments [4,5,21].

Catastrophic forgetting represents the primary obstacle to deploying deep learning models in dynamic network environments [1,3]. Minhas et al. provided a comprehensive survey of continual learning with neuromorphic computing, categorizing NCL approaches into STDP-based, predictive coding, active dendrite, Bayesian, and Hebbian learning methods [1]. Shi et al. proposed hybrid neural networks inspired by corticohippocampal circuits that achieve continual learning without catastrophic forgetting through complementary learning systems [3]. The Hebbian Learning-based Orthogonal Projection (HLOP) algorithm utilized lateral connections to ensure new task weight updates do not interfere with previously acquired representations [17,18]. Chen and Merchant proposed the NEURAL architecture for elastic neuromorphic execution with hybrid data-event processing and on-the-fly attention dataflow [22]. Neelesh and Aditya conducted a thorough review of neuromorphic computing for SNN applications, highlighting its energy-efficient deployment potential [20]. Nevertheless, no existing method integrates continual learning with sparse attention mechanisms specifically tailored for network intrusion detection on neuromorphic hardware [1,6,23].

The combination of SNN temporal processing with transformer representational power has become an active research area [4,5,12]. Song et al. introduced Xpikeformer, a hybrid analog-digital hardware acceleration framework for spiking transformers that demonstrated real-time inference feasibility [4]. Xiang et al. developed Vision Spiking Transformers, which integrate spiking neurons with attention mechanisms for image classification [5]. Vishwamith et al. presented HPCNeuroNet, which is the next step in neuromorphic audio signal processing using transformer-based SNNs [8]. Wang et al. introduced SSTFormer, a hybrid architecture that bridges spiking neural networks and memory-support transformers for recognition tasks [24]. Spike-HAR++ model reported energy-efficient parallel spiking transformers in the identification of event-based human actions [25]. Although there has been an increasing amount of research on SNN-transformer hybrids, understanding how these systems can be used in always-on network intrusion detection with the ability to do continuous learning has been very little studied [11,16,26–31], which is the driving force behind the current research.

The proposed NeuroPulse architecture consists of four interconnected modules: (1) a Spike Encoder that encodes network traffic features into temporal spike trains via population rate coding; (2) an SNN Temporal Feature Extractor that processes spike-encoded inputs using leaky integrate-and-fire (LIF) neurons with recurrent lateral connections; (3) a Rate-Coded Cross-Attention (RCCA) module that converts spike-train population codes into attention queries for sparse self-attention computation; and (4) a Hebbian Synaptic Consolidation (HSC) mechanism for catastrophe-free continual learning, designed to operate within the strict sub-milliwatt power budget of neuromorphic network processor.

Given a raw network traffic feature vector x ∈ ℝ^d, the spike encoder transforms continuous-valued features into temporal spike trains through population rate coding. For each input dimension j, we define a population of Np encoding neurons with Gaussian receptive fields. The instantaneous firing rate of the k-th neuron in the j-th population is given by:(1)rjk(t)=rmax⋅exp(−(xj(t)−μjk)2(2σjk2))where rmax denotes the maximum firing rate, μjk and σjk represent the center and width of the k-th Gaussian receptive field for dimension j, respectively. The spike generation process follows a Poisson process with intensity parameter λjk(t)=rjk(t)Δt, where Δt is the simulation timestep.

The probability of spike generation at each timestep is given by:(2)P(sjk(t)=1)=1−exp(−λjk(t))

Remark on Eqs. (1) and (2): We acknowledge that the double use of the exponential function in Eq. (1) (Gaussian receptive field) and Eq. (2) (Poisson spike generation) may raise concerns regarding hardware implementation complexity, critical path delay, and power overhead. However, these functions are evaluated only during the spike encoding phase, which executes once per input sample rather than at every inference timestep. On neuromorphic hardware such as Intel Loihi 2, Gaussian receptive fields can be approximated using piecewise-linear lookup tables with negligible accuracy loss (<0.2%), substantially reducing the exponential computation cost. This biological encoding scheme is retained because it provides superior representational fidelity compared to simpler rate-coding alternatives [7,13], and the encoding overhead contributes <3% of total system power at the 0.23 mW operating point.

The temporal feature extractor of SNN uses an architecture of adaptive threshold multi-layered neurons (based on leaky integrate-and-fire (LIF) neurons. The dynamics of the membrane potential of the i th neuron in layer l are described by:(3)τm⋅(dVil(t)dt)=−(Vil(t)−Vrest)+Rm⋅Iil(t)where τ_m is the membrane time constant, V_rest is the resting potential, Rm is the membrane resistance, and Iil(t) is the total synaptic input current. The synaptic input current aggregates contributions from presynaptic neurons:(4)Iil(t)=Σjwijl⋅sjl−1(t)+bilwhere w_ij^l1 denotes the synaptic weight from neuron j in layer l − 1 to neuron i in layer l, s_j^l−1(t) is the binary spike output of presynaptic neuron j, and b_i^l is the bias term. A spike is emitted when the membrane potential exceeds the adaptive threshold θ_i^l(t):(5)sil(t)=H(Vil(t)−θil(t))where H(·) is the Heaviside step function. The adaptive threshold evolves according to:(6)θil(t+1)=θ0+β⋅sil(t)+(1−α)⋅(θil(t)−θ0)where θ_0 is the baseline threshold, β controls threshold increase upon spiking, and α is the threshold decay rate. In our implementation, β = 0.1 and α = 0.9 are selected empirically via grid search on the NSL-KDD validation set, balancing spike-rate homeostasis against temporal responsiveness. Larger β promotes stronger spike-frequency adaptation, while α close to 1 enforces slow threshold decay, preventing runaway excitation. These values are fixed across all datasets.

The RCCA module constitutes the core innovation of NeuroPulse, bridging the spike domain with the attention domain through biologically plausible rate coding. The design intuition behind RCCA stems from the need to bridge the binary spike domain with the continuous attention domain. While sparse attention mechanisms have been explored in prior work [19], the RCCA module differs fundamentally in two aspects: (1) it operates on population-coded spike-train rate representations rather than dense token embeddings, making it the first cross-modal bridge between the binary spike domain and the continuous attention domain; and (2) it is co-designed with the HSC continual learning mechanism to maintain sparse, biologically-plausible representations that resist catastrophic forgetting. The sparse attention in Eq. (9) is thus not a standalone contribution but an integral component enabling the energy-accuracy-continual-learning tradeoff that is the primary novelty of NeuroPulse. Given the spike output tensor S ∈ {0, 1}^(T × N) from the SNN feature extractor over T timesteps and N neurons, we first compute the population firing rate matrix:(7)R=(1T)⋅ΣtS(t)

The rate matrix R ∈ [0,1]^N is then projected into query (Q), key (K), and value (V) representations through learned linear transformations. Note that R is a population-level firing rate vector aggregated across all N neurons over the full T-timestep window, distinct from the instantaneous single-neuron firing rate r_jk(t) defined in Eq. (1). While r_jk(t) captures the moment-to-moment spiking probability of individual encoding neurons, R represents the mean activity of the entire neural population and serves as the spike-domain summary passed to the attention module. (8)Q=R⋅WQ,K=R⋅WK,V=R⋅WVwhere W_Q, W_K, W_V ∈ ℝ^(N × d_k) are learnable projection matrices and d_k is the attention head dimension. To maintain sub-milliwatt operation, we employ top-k sparse attention that selects only the k most relevant key-value pairs for each query:(9)Asparse=softmax(topk(Q⋅KTdk,k)) (10)RCCA(S)=A_sparse⋅V

The sparsity factor k is set to ⌊√N⌋, ensuring logarithmic attention complexity O(N log N) rather than the quadratic O(N²) of standard self-attention.

A thin layer of sparse multi-head self-attention enhances the feature representations after the RCCA module. Individual attention head h calculates:(11)headh=SparseAttn(Z⋅WQh,Z⋅WKh,Z⋅WVh) (12)MultiHead(Z)=Concat(head1,…,headH)⋅WOwhere Z denotes the output of the RCCA module, H is the number of attention heads, and W_O is the output projection matrix. The feed-forward network following the attention layer employs Gaussian Error Linear Unit (GELU) activation:(13)FFN(Z)=GELU(Z⋅W1+b1)⋅W2+b2

In Eq. (13), W1∈Rdmodel×dffandW2∈Rdff×dmodel are learnable weight matrices of the two-layer feed-forward network, and b1∈Rdff,b2∈Rdmodel are the corresponding bias vectors, where dff = 256 is the inner hidden dimension (set to4×dk). The GELU activation is selected over ReLU because it provides smoother gradients and has been shown to improve convergence in transformer-based architectures [4,12].

The HSC mechanism enables catastrophe-free continual learning by computing per-synapse importance scores based on Hebbian co-activation statistics [32,33]. The design intuition behind HSC is rooted in Hebbian plasticity: synapses that participate frequently in co-activating pre- and post-synaptic neurons encode task-critical information and should be protected. Unlike Fisher information-based EWC [34], HSC computes importance online via an exponential moving average (Eq. (14)), requiring only O(|W|) memory overhead and zero additional forward passes—making it uniquely suited to neuromorphic edge hardware where both memory and compute are severely constrained. For each synaptic weight w_ij, the importance score Ω_ij is computed as:(14)Ωij=γ⋅Ωij+(1−γ)⋅|ai⋅aj|where a_i and a_j are the activation values of pre- and post-synaptic neurons, and γ ∈ (0, 1) is an exponential moving average decay factor. The continual learning loss function incorporates a regularization term that penalizes modifications to important synapses:(15)Ltotal=Ltask+(λ2)⋅ΣijΩij⋅(wij−wij∗)2where L_task is the task-specific cross-entropy loss, λ is the consolidation strength hyperparameter, and w_ij* represents the optimal weights learned for the previous task. The λ/2 scaling factor—rather than λ as in SI [33] and EWC [34] is a standard convention adopted to cancel the factor of 2 that arises when differentiating the squared penalty term with respect to w_ij, yielding a cleaner gradient expression ∂L_reg/∂w_ij = λ·Ω_ij·(w_ij − w*_ij). This is mathematically equivalent to SI [33] and EWC [34] formulations when λ is re-scaled accordingly, and does not alter the qualitative behaviour of the regularizer. The synaptic update rule follows a modified Hebbian formulation:(16)Δwij=η⋅(∂Ltask∂wij)⋅(1−ω⋅Ωij)where η is the learning rate and ω controls the strength of synaptic protection. This ensures that highly important synapses are protected from large updates, while less important synapses remain plastic for new task learning. The synaptic protection strength ω = 0.8 is determined via cross-validation on the first five sequential tasks of the NSL-KDD continual learning benchmark, optimizing for knowledge retention while maintaining plasticity for new task acquisition. Higher values of ω (approaching 1.0) yield stronger protection but slow adaptation to new tasks, while lower values increase plasticity at the cost of knowledge retention. The selected value ω = 0.8 is reported in results and held constant across all experiments.

Training employs surrogate gradient learning for the SNN components and conventional backpropagation for the attention layers. The non-differentiable Heaviside function is approximated using the following surrogate gradient:(17)σ′(V)=(1π)⋅(αsg(1+(αsg⋅(V−θ))2))

The total power use of NeuroPulse is modelled as:

In Eq. (17), α_sg is the surrogate gradient sharpness parameter, which controls the width of the smooth approximation to the Heaviside step function. We use α_sg = 5.0, selected to provide a balance between gradient magnitude and approximation fidelity, following established practice in SNN surrogate gradient training [7,13]. Larger α_sg values produce sharper approximations closer to the true Heaviside but risk vanishing gradients; smaller values yield smoother gradients but degrade the biological fidelity of the spike model. The exponential moving average decay factor γ in Eq. (14) governs how rapidly historical co-activation statistics are discounted; γ = 0.95 retains approximately 20 steps of effective history, providing stable importance estimates while remaining responsive to recent activity patterns. (18)Ptotal=Espike⋅favg⋅Nactive+Pattention⋅(kN)where E_spike is the energy per spike event, f_avg is the average firing rate, N_active is the number of active neurons, P_attention is the power for full attention, and kN represents the sparsity ratio.

The computational complexity of NeuroPulse is analyzed as follows. The SNN feature extractor operates with complexity O(T · N · f_avg), where T is the number of timesteps, N is the number of neurons, and f_avg is the average firing rate (typically 0.05–0.15). The RCCA module introduces complexity O(N · k · d_k) with k = ⌊√N⌋. The sparse self-attention layer operates at O(N · k · H · d_k). The HSC mechanism adds O(|W|) overhead per training step, where |W| is the total number of parameters. The total inference complexity is therefore O(T⋅N⋅favg+3/2⋅dk⋅H), which is significantly lower than the O(N²· d_k · H) of standard transformer architectures. This theoretical complexity is empirically validated in results, where NeuroPulse achieves 0.42 ms inference at 2381 samples/s on neuromorphic hardware, consistent with the O(N32) scaling prediction and 5× faster than the O(N²) Transformer-IDS baseline (2.15 ms). Algorithm 1 shows the NeuroPulse Inference Pipeline. Algorithm 2 shows the HSC Continual Learning Update.

We evaluated NeuroPulse on two publicly available benchmark datasets and a realistic 5G RAN telemetry trace. The characteristics of each dataset are summarized in Table 1.

The dataset of NSL-KDD is taken on the site of the Canadian Institute of Cybersecurity (URL: https://www.unb.ca/cic/datasets/nsl.html) and consists of 125,973 training and 22,544 testing samples in 41 features and it includes 4 attack types (DoS, Probe, R2L, U2R) and normal traffic. The UNSW-NB15 data was obtained in University of New South Wales (URL: https://research.unsw.edu.au/projects/unsw-nb15-dataset) and consists of 175,341 training and 82,332 testing samples that comprise 49 features representing nine types of attacks (Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms). The telemetry data of the 5G RAN gathered in a testbed setting that simulated the actual 5G network conditions. Table 2 shows the Hyperparameter Configuration.

All simulations were performed in Python (version 3.10) with PyTorch 2.1 and the SpikingJelly SNN simulator. Training was conducted on an NVIDIA A100 GPU with 80 GB memory. Neuromorphic power estimation was performed using the NEST-ML energy model calibrated on Intel Loihi 2 hardware measurements and validated against Intel Loihi 1 benchmarks with <8% discrepancy. Regarding the power estimation of synchronous components (Q1): the Sparse Self-Attention layer and GELU activation are non-native to standard neuromorphic asynchronous hardware. Their power consumption was modelled as equivalent digital logic co-processors running at low clock rates, with energy estimated from published 28 nm CMOS characterisation data for similar multiply-accumulate operations. The spike-to-tensor conversion overhead in the RCCA module (population rate computation) was explicitly included in P_attention of Eq. (18) via the k/N sparsity factor, accounting for ~0.031 mW of the total 0.23 mW budget, as broken down. Regarding sparse attention complexity (Q2): the top-k selection is implemented using a structured block-sparse indexing scheme inspired by [19], which avoids evaluating all N² attention scores. Specifically, queries are partitioned into fixed-size local windows, and top-k selection is performed within each window using pre-computed locality-sensitive hashing (LSH) indices, reducing the effective complexity from O(N²) to O(N·k) = O(N^(3/2)) during inference. Regarding per-dataset hyperparameter sensitivity (Q3): while T = 16 and τ_m = 20 ms are held fixed across datasets, the population size N_p = 8 operates on each input feature independently, so the total spike encoding capacity scales as N_p × d_features (8 × 41 = 328 for NSL-KDD; 8 × 49 = 392 for UNSW-NB15). The additional 64 encoding neurons for UNSW-NB15’s extra 8 features provide sufficient representational capacity, as confirmed by the competitive 93.8% accuracy on that dataset. No per-dataset hyperparameter tuning was performed to ensure fair cross-dataset comparisons.

Fig. 2 shows the convergence curves of training losses of NeuroPulse and baseline techniques on NSL-KDD dataset. NeuroPulse reaches convergence faster and final loss is lower than all baselines, which is due to the effective gradient flow facilitated by the RCCA module and sparse attention mechanism.

Fig. 3 shows the detection accuracy progression during training NeuroPulse outperforms the Transformer-IDS baseline on NSL-KDD by 1.9 percentage points (94.3% vs. 92.4%) while consuming 12× less power. Table 3 shows the Performance Comparison on NSL-KDD Dataset. Table 4 shows the Performance Comparison on UNSW-NB15 Dataset.

The normalized confusion matrix of NeuroPulse appears in Fig. 4 based on the data of the NSL-KDD. The model has great true positive rates in all types of attacks, where the results are strong in Normal (0.989) and DoS (0.994) classes. U2R type also has the worst detection rate (0.952), which is also in line with its extreme class imbalance in the training data.

The receiver operating characteristic (ROC) curves for multi-class intrusion detection are shown in Fig. 5. NeuroPulse achieves the highest area under the curve (AUC = 0.987), demonstrating superior discrimination across all operating points compared with Transformer-IDS (AUC = 0.961), CNN-BiLSTM (AUC = 0.952), and SNN-Only (AUC = 0.938).

Fig. 6 gives the comparison of energy consumption of all the methods considered. NeuroPulse attains an average power consumption of 0.23 mW, which is 12.1× lower than the Transformer-IDS baseline (2.78 mW) and 13.6× lower than CNN-BiLSTM (3.12 mW). Table 5 gives a module wise breakdown of energy. Table 6 shows the Continual Learning Performance Comparison.

Fig. 7 shows that the retention level of the HSC mechanism remains steady with over 50 consecutive updates of tasks. NeuroPulse-HSC also stores 97.1% of cumulative information far exceeding EWC (84.8%), Experience Replay (78.2%), and Naive Fine-Tuning (54.6%).

The findings of the ablation experiment provided in Fig. 8 and measure the contribution of all the NeuroPulse components the greatest drop in accuracy (−3.1% on NSL-KDD) of the system is due to the removal of the RCCA module, which confirms its importance in mediating the relationship between spike-domain features and attention-based processing. The results of the extended ablation carried out in Table 7 used to measure the contribution of each architectural component in the proposed NeuroPulse framework. The best detection accuracy of 94.3 on NSL-KDD and 93.8 on UNSW-NB15 with 0.23 mW of power consumption obtained with the full NeuroPulse configuration. The removal of the sparse attention system results in the largest degradation of 3.6% bringing them to 90.7% accuracy and 0.52 mW power, with the removal of the RCCA module following immediately as 3.1% of the accuracy is lost. The SNN backbone on its own gives a result of 87.4 percent, which affirms there is a gap of 6.9 percent that confirms the requirement of the hybrid architecture. Interestingly, the HSC mechanism ablation leads to only a small accuracy degradation of 0.5 since this mechanism is used more to perform continuous learning as opposed to single-task performance but the adaptive threshold offers a significant contribution to the overall detection performance of 1.8%.

Fig. 9 is a scatter plot of the F1-score per-class across pre-attack types of NeuroPulse and baseline approach. The highest F1-scores of NeuroPulse are observed in all categories, with the significant improvements of rare attack types (U2R: 0.885 vs. 0.762 with SNN-Only), which is due to the greater ability of the RCCA module to represent the information.

The analysis of the latency-accuracy trade-off is provided in Fig. 10 illustrates the latency–accuracy trade-off. NeuroPulse occupies a strategically favorable position. Table 8 gives latency breakdown.

Tables 8–10 give the full assessment of the inference efficiency, computational cost, and cross-dataset generalization, respectively. NeuroPulse can achieve an inference latency of 0.42 ms on neuromorphic hardware at 2381 samples/s, significantly faster than the alternatives based on the use of the GPU like Transformer-IDS (2.15 ms) and CNN-BiLSTM (1.85 ms). Table 9 also indicates that NeuroPulse is computationally efficient with only 2.14M parameters, 38.4M FLOPs, and 8.6 MB memory and only consumes 0.23 mW, which is considerably lower than Transformer-IDS (12.36M parameters, 856.2M FLOPs, 2.78 mW). Table 10 shows that NeuroPulse has better cross-dataset generalization as it is able to reach transfer accuracy of 84.1 percent in UNSW-NB15 to NSL-KDD transfer, and is higher by 4.2 percent in cross dataset generalization by 10.9 percent in comparison with TASNN and SNN-Only.