Efficient Early Network Intrusion Detection based on Sub-Flow Segmentation

With the increasing complexity of network traffic and the diversification of cyber attacks, traditional intrusion detection systems based on full-session analysis face challenges in real-time performance and computational efficiency. To enhance early detection capability, recent research has explored using only partial flows or the first few packets for rapid classification. The few proposed approaches rely mainly on time-driven flow segmentation, making it inefficient to capture the full flow context. This paper introduces a novel framework (named Hybrid Prefix N) that combines both time-based features as well as other crucial flow features (e.g., SYN/FIN/RST) to better capture flow contextual, bidirectional and boundary features. In particular, as we shall see, the flow segmentation strategy significantly affects feature distributions and model overall performance. The Experimental results show that although the time-driven approach achieves slightly higher numerical metrics, it suffers from class imbalance and high false positive rates. On the other hand, the proposed Hybrid segmentation model provided high accuracy while providing a more reliable and semantically consistent foundation for real-time intrusion detection.