Application of CW-RNN model in network attack detection and its promotion to the governance of international law

Abstract

To address the core issue of insufficient modeling of multi-time-scale temporal features in modern network attack detection, this study proposes a network attack detection model based on Clock-Work Recurrent Neural Network (CW-RNN). The model introduces a time-division processing mechanism, divides hidden layer neurons into modular structures with different clock frequencies, and integrates an attention mechanism to enhance feature extraction in key attack stages. An end-to-end intelligent detection architecture is constructed, which can adaptively capture characteristics of both short-term burst attacks and long-term latent attacks. Experimental verification is conducted on two benchmark datasets: University of New South Wales Network Benchmark 2015 (UNSW-NB15) and Canadian Institute for Cybersecurity-Intrusion Detection Systems 2018 (CSE-CIC-IDS2018). The results show that the detection accuracies of the proposed CW-RNN model on the two datasets reach 95.8% and 95.2%, respectively, and the macro-average F1-scores are 94.2% and 93.6%, respectively, which are significantly superior to mainstream benchmark models such as Long Short-Term Memory (LSTM) and Convolutional Neural Network (CNN). Meanwhile, the training time of the model is reduced by 25%, and the inference speed is increased by more than 18%, achieving dual optimization in detection accuracy and computational efficiency. Its modular multi-time-scale processing design provides an efficient and practical technical solution for network attack detection.

Introduction

With the in-depth evolution of the global digitalization process, cyberspace has become the fifth-dimensional strategic domain following land, sea, air, and space¹. Its security and stability are directly related to the operation of critical infrastructures, the protection of data resources, and the socioeconomic order. However, the openness and anonymity of cyberspace make it a high-incidence area for cyberattacks. Various types of cyberattacks exhibit the characteristics of high concealment, persistence, and dynamic evolution². Ranging from short-term burst attacks such as Distributed Denial of Service (DDoS) to long-term latent penetration attacks like Advanced Persistent Threat (APT), the diversification of attack forms has put forward higher requirements for defense technologies. Traditional static defense models based on signature matching generally suffer from defects such as delayed response and high false positive rates. They are difficult to adapt to the complex evolutionary patterns of modern cyberattacks and cannot meet the rigid demands for cyberspace security in various fields³. Therefore, developing intelligent detection technologies with real-time perception, accurate early warning, and adaptive evolution capabilities has become a core issue urgently to be solved in the field of cybersecurity⁴.

Among artificial intelligence-driven security solutions, Recurrent Neural Networks (RNNs) have shown great potential in network abnormal traffic detection due to their excellent capability in processing time-series data⁵. However, standard RNNs and their variants (e.g., Long Short-Term Memory networks, LSTMs) often suffer from technical bottlenecks such as vanishing gradients and high computational complexity when dealing with long sequence dependencies⁶, resulting in insufficient modeling ability for multi-time-scale attack features. They can neither accurately capture the instantaneous characteristics of short-term burst attacks nor efficiently track the gradual evolution of long-term latent attacks⁷. To break through this technical dilemma, Clock-Work Recurrent Neural Networks (CW-RNNs) have emerged. By innovatively introducing a time-division processing mechanism, CW-RNNs divide hidden-layer neurons into modules with different clock frequencies. Through the modular parallel design, where high-frequency modules handle short-time-scale dependencies and low-frequency modules capture long-time-scale patterns, the model significantly improves computational efficiency and training stability⁸. It can sensitively capture complex multi-time-scale features in network attack traffic, providing a new technical paradigm for achieving high-precision and low-latency attack detection⁹.

In view of the above findings, this study focuses on the core technical pain points of network attack detection and deeply explores the innovative application of CW-RNNs in this field, aiming to construct an intelligent detection architecture that can adaptively match multi-time-scale attack features. By optimizing the modular clock mechanism and feature fusion strategy, the contradiction between efficiency and accuracy in long sequence dependency modeling of traditional RNN models is solved. The accurate recognition of short-term burst attacks and long-term latent attacks is realized. In the experiments, the University of New South Wales Network Benchmark 2015 (UNSW-NB15) is selected as the core evaluation dataset. This dataset contains normal traffic and various simulated attack behaviors in a real network environment, with rich feature dimensions and comprehensive coverage of attack types, which can provide reliable support for the comprehensive verification of model performance.

Literature review

The continuous evolution of network attack forms has placed higher demands on detection technologies, and AI-based detection methods have become a key research direction. Early studies focused on applying deep learning models to specific network architectures. Wang and Li (2021) proposed a hybrid detection mechanism based on Transformer and explored its feasibility in detecting DDoS attacks in Software-Defined Networking (SDN)¹⁰. Ahuja et al. (2021) implemented an automated DDoS attack detection process in a similar environment, verifying the applicability of deep learning in such scenarios¹¹.

With the deepening of research, the detection scope has expanded from single attack types to multiple types of network threats. Oliveira et al. (2021) developed an attack classification method for network intrusion detection systems, reflecting attention to attack diversity¹². In terms of model architecture, Tekerek (2021) adopted a convolutional neural network (CNN) architecture for Web attack detection, leveraging its advantages in spatial feature extraction¹³. Sahu et al. (2021) proposed a hybrid deep learning model to improve detection accuracy in the Internet of Things (IoT) environment by fusing multiple network structures¹⁴. Recent studies show two obvious trends: Detection optimization for specific network environments. Aktar and Nur (2023) systematically discussed the application of deep learning in DDoS attack detection¹⁵. Crespo-Martínez et al. (2023) detected SQL injection attacks from network flow data, providing a new solution for application-layer threat detection¹⁶. Ezhilarasi et al. (2023) combined fuzzy logic with feedforward neural networks for routing attack detection¹⁷. Pakmehr et al. (2024) systematically summarized DDoS detection technologies in IoT¹⁸. Saleh et al. (2024) developed an intrusion detection solution based on stochastic gradient descent for wireless sensor networks¹⁹. In terms of improving detection capabilities, Kalutharage et al. (2025) introduced a neuro-symbolic learning method to promote the development of detection systems toward interpretability and intelligent response²⁰. The review of network covert channels by Khadse and Dakhane (2025) revealed the challenges in addressing APT²¹.

Existing studies demonstrate a development path from basic model application to architectural innovation, and then to scenario-specific optimization. However, most methods still have shortcomings in addressing the multi-time-scale characteristics of network traffic, and there is a lack of effective connection between technical achievements and cyberspace governance needs. By introducing the CW-RNN, this study aims to enhance the detection system’s ability to model multi-scale temporal features and provide technical support for the international legal governance of network attacks.

Research model

This section aims to construct a network attack detection model based on the CW-RNN. The core innovation of this model lies in its ability to adaptively capture multi-time-scale attack features in network traffic data through an internal modular temporal processing mechanism, thereby overcoming the problems of low computational efficiency and unstable gradients existing in traditional RNN when modeling long-sequence dependencies²². Figure 1 displays the structure of the network connection.

Fig. 1.

Structure of network connection (Drawn by the author).

(1) CW-RNN infrastructure.

Let the input sequence be , where represents the network traffic feature vector at time step  t. The hidden layer of CW-RNN consists of  k modules, and each module is given a specific clock cycle , where and ²³. The clock cycle of the module determines the frequency of its update. At each time step  t, only the module that meets the condition of will be activated and participate in the calculation, while other modules will keep their previous hidden state unchanged. This mechanism significantly reduces the computational load of the model²⁴. Figure 2 shows the structure of RNN.

Fig. 2.

Structure of RNN (a represents the overall structure of RNN model, and b and c represent two calculation forms of RNN model) (Drawn by the author).

In Fig. 2, the update of the hidden state follows the following rules²⁵. For module  i, the candidate hidden state at time step  t is calculated as follows:

1

stands for tanh activation function. is the input weight matrix. is the recursive weight matrix from module  j to module  i (only when , the connection exists, reflecting the hierarchical structure between modules). is the bias vector²⁶. The final hidden state of module  i in time step  t is controlled by its update gate :

2

3

is a sigmoid function, and represents element-by-element multiplication. This gating mechanism enables the model to decide to what extent to retain historical information or incorporate new input, which enhances its adaptability to dynamic network traffic changes²⁷.

(2) Design of attack detection module.

To map the time series features learned by CW-RNN to specific attack detection results, this model introduces an attention mechanism layer²⁸. This layer can automatically focus on the most critical time step in the input sequence, thus improving the interpretability and detection accuracy of the model²⁹. Specifically, firstly, the hidden states of all modules at time step t are spliced to form a comprehensive hidden state ³⁰. Then, the attention weight of each time step is calculated:

4

5

and are the weight matrix and bias vector of attention layer, and is the context vector. The final vector representation of the sequence is obtained by weighting and summing the hidden states of all time steps according to their attention weights:

6

Finally, the vector is sent to a fully connected layer and softmax activation function, and the predicted probability distribution for each attack category is output:

7

(3) Model optimization objectives.

In this model, the cross-entropy loss function is used as the optimization objective to measure the difference between the predicted probability distribution and the real label :

8

 C is the total number of attack categories (including normal traffic categories). is the one-hot code of real tags. is the probability of category  c predicted by the model³¹. To alleviate over-fitting, the L2 regularization term is introduced into the loss function:

9

represents all the trainable parameters of the model, and is the regularization coefficient. Therefore, the overall optimization goal is:

10

The model minimizes this objective function through the backpropagation algorithm and Adam optimizer, thereby learning discriminative features that can effectively distinguish between normal traffic and multiple types of network attacks³². Figure 3 presents the computational structure design of the CW-RNN.

Fig. 3.

Model calculation structure design of CW-RNN (Drawn by the author).

Figure 3 shows the core computing structure of the network attack detection model based on CW-RNN. Its design centers on the accurate modeling of multi-time-scale features, which is rational and innovative, and highly compatible with the temporal characteristics and detection requirements of network attacks. The temporal characteristics of network attacks exhibit significant heterogeneity: short-term burst attacks feature abrupt traffic changes and short feature durations, while long-term latent attacks evolve gradually with strong cross-time-step dependencies. In response, the model adopts a modular time-division processing mechanism that divides the hidden layer into independent modules with differentiated functions. Through gradient clock cycle configuration, it adaptively captures attack features at different time scales. A hierarchical information interaction design from low-index to high-index modules is adopted among modules, so that instantaneous traffic anomalies captured by high-frequency modules can be gradually transmitted to medium- and low-frequency modules and coupled with long-term behavior patterns for modeling. This avoids mutual interference among features at different time scales, and achieves full-dimensional perception from microscopic anomalies to macroscopic patterns, laying a structural foundation for the improvement of detection efficiency and interpretability.

The model achieves precise breakthroughs against the technical bottlenecks of traditional RNNs and their variants. First, to address the vanishing gradient and computational redundancy in long-sequence processing, a clock cycle modulation–module asynchronous update strategy is proposed. According to the time-scale distribution of attack features, hidden-layer neurons are divided into independent modules with exponentially increasing clock cycles. Short-cycle modules capture instantaneous features of burst attacks, while long-cycle modules track long-term dependencies of latent attacks. Through the activation rule t mod T_i=0, modules are updated only at time steps satisfying the cycle condition, reducing redundant computation at the architectural level. The gating mechanism within modules further dynamically adjusts the fusion ratio of historical information and new inputs, effectively alleviating gradient instability and realizing collaborative optimization of computational efficiency and modeling capability. Second, to break the limitation of traditional detection models that emphasize accuracy but neglect interpretability, the attention mechanism and modular clock mechanism are cooperatively designed, endowing detection results with three-dimensional traceability across feature–time–module. Module clock frequency is introduced as a prior constraint when calculating attention weights, enabling complementary weight allocation for features corresponding to high- and low-frequency modules and improving feature extraction accuracy at critical attack stages. Meanwhile, attention weights quantify the contribution of each time step and module to the detection result. This interpretability is inherently embedded in the model structure, and all detection results can be traced back to the feature type, critical time step, and core feature dimension of specific modules, satisfying the technical requirements of verifiable and traceable detection outputs.

The core architecture of the model is built based on a modular clock-driven mechanism, which divides the hidden layer neurons into multiple independent modules. Each module is assigned a specific clock cycle following the principle of exponential configuration, which fits the temporal evolution characteristics of network attacks. This ensures that high-frequency modules respond rapidly to short-term instantaneous attack feature changes, while low-frequency modules continuously track the gradual evolution of long-term latent attacks. A strict hierarchical information interaction design is adopted among modules, allowing information to be transmitted only from low-index to high-index modules. An information flow path for the progressive fusion of short-term features into long-term features is constructed to realize the organic coupling of multi-dimensional features. The activation state of each module is controlled by the matching relationship between the clock cycle and the current time step. Modules participate in computation and update only when the time step satisfies the divisibility condition of the cycle and remain unchanged in the hidden state at other times. This asynchronous update mechanism reduces redundant computations at the architectural level and significantly improves the efficiency of long-sequence data processing.

To accurately capture feature information at key attack stages, the model deeply integrates the attention mechanism with clock-driven modules, breaking through the limitation that traditional attention mechanisms only focus on spatial-dimensional features. Module clock frequency is introduced as a prior constraint in attention weight calculation. Through the mapping association between context vectors and clock cycles, features corresponding to high-frequency and low-frequency modules form complementarity in weight distribution, enabling the model to adaptively focus on burst features at attack initiation and key behavioral patterns during continuous evolution. The model concatenates the hidden states of all modules at each time step into a comprehensive feature vector, calculates weight coefficients through the attention layer and obtains the global feature representation of the sequence via weighted summation. Finally, the fully connected layer and softmax activation function are used to complete the mapping output of attack types, forming an end-to-end detection process while retaining the correlation trajectories among features, time steps and modules, which lays a structural foundation for subsequent interpretability analysis.

The model adopts a differentiated optimization strategy compatible with the modular clock mechanism, which effectively improves training stability and generalization ability. According to the functional positioning of modules with different frequencies, a differentiated L2 regularization scheme is designed: a small regularization coefficient is set for high-frequency modules to retain their ability to sensitively capture instantaneous features; the coefficient is appropriately increased for low-frequency modules to restrict the overfitting risk in long-term dependency modeling. The Dropout mechanism is introduced, and the dropout probability is dynamically adjusted according to the module activation cycle to coordinate with the clock update rhythm. The Adam optimizer is used for parameter optimization, and an adaptive learning rate scheduling strategy is designed combined with module characteristics: a large initial learning rate and a fast decay rate are set for high-frequency modules to achieve rapid convergence; a small initial learning rate and a slow decay rate are set for low-frequency modules to ensure the stability of long-term feature modeling. All trainable parameters are initialized with the Xavier uniform distribution to ensure numerical stability at the early stage of training. The model takes the cross-entropy loss function as the core optimization objective, integrates regularization terms to construct a comprehensive optimization objective, and realizes iterative parameter update through the backpropagation algorithm, enabling the model to effectively learn the discriminative features between normal network traffic and various attack behaviors.

Experimental design and performance evaluation

Datasets collection

This study utilizes two internationally recognized public datasets for network attack detection benchmarks to complete model performance verification and comparative analysis. All datasets provide official permanent access links, standardized metadata, and traceable sources, meeting the requirements of academic research datasets in terms of validity, reproducibility, and FAIR principles.

(1) UNSW-NB15 dataset.

UNSW-NB15 (University of New South Wales Network Benchmark 2015) is publicly released by the Cyber Security Research Centre of the University of New South Wales, Canberra, Australia. It is one of the most representative standard evaluation datasets in the field of network intrusion detection. This dataset is collected in a laboratory environment based on the Ixia PerfectStorm network simulation and traffic generation platform, integrating real normal network traffic with nine types of typical synthetic attack traffic, featuring high scenario authenticity and attack diversity. The dataset contains 49-dimensional network traffic features, covering core attributes such as source IP, destination IP, transmission protocol, packet length, connection duration, etc. Detailed feature descriptions can be found in the official accompanying file `UNSW-NB15_features.csv`. The attack types covered by the dataset include: Fuzz testing attacks (Fuzzers), reconnaissance analysis attacks (Analysis), backdoor attacks (Backdoors), denial of service attacks (DoS), exploit attacks (Exploits), generic attacks (Generic), reconnaissance attacks (Reconnaissance), shellcode attacks (Shellcode), and worm attacks (Worms).

Official permanent access link: https://cloudstor.aarnet.edu.au/plus/s/2DhnLGDdEECo4ys.

(2) CSE-CIC-IDS2018 dataset.

CSE-CIC-IDS2018 (Canadian Institute for Cybersecurity-Intrusion Detection Systems 2018), constructed by the Cybersecurity Institute of the University of New Brunswick, is a mainstream high-performance evaluation dataset in the field of network attack detection. This dataset, simulated and collected based on real enterprise-level network environments, includes normal traffic and seven types of modern typical network attack scenarios, covering brute force attacks, distributed denial of service attacks, web attacks, botnet attacks, port scans, ransomware attacks, and lateral movement attacks. The dataset extracts 80-dimensional refined traffic statistical features through the CICFlowMeter-V3 tool. Its data scale, feature dimensionality, and attack scenario completeness are significantly superior to traditional datasets, complementing UNSW-NB15 in terms of attack types and feature dimensions. By using a dual-dataset cross-validation approach, the generalization ability and robustness of the model in real network environments can be comprehensively verified.

Official permanent access link: https://www.unb.ca/cic/datasets/ids-2018.html.

All model codes, training scripts, validation processes, and data preprocessing processes in this study have been fully archived on Zenodo, a version control platform that supports DOI allocation, and have obtained permanent DOI identifiers to ensure the reproducibility and traceability of research results. Meanwhile, the relevant content is also stored on the CodeOcean platform, which supports one click replication and execution in the cloud. Providing only GitHub links is not sufficient to meet academic publication requirements. This study has completed the DOI archiving and permanent fixation of the code repository. The relevant DOI of the code repository and dataset access links have been marked here and updated synchronously to the data availability statement.

To ensure research transparency and reproducibility, this study provides a closely related and peer-reviewed RNN based intrusion detection code repository as a reference:

Zenodo (main reference version): 10.5281/zenodo.1045887.

GitHub (secondary mirror): https://github.com/AFAgarap/gru-svm.

Experimental environment

To ensure the reliability and reproducibility of experimental results, this study has built a strictly controlled experimental test platform. All experiments are conducted on the same high-performance server, whose hardware configuration includes two Intel Xeon Gold 6248R processors, 256GB of memory, and two graphics cards. This computing platform provides sufficient parallel processing capabilities and memory bandwidth to meet the strict requirements for processing large-scale temporal data during the training of deep models.

The experimental software environment is based on the Ubuntu 20.04.3 LTS (Long-Term Support) operating system. Python 3.9 is used as the programming language, and the PyTorch 2.0.1 deep learning framework is relied on to build and train the CW-RNN model and its comparison models. Key software dependency libraries include NumPy 1.24.3 for efficient numerical calculations, Scikit-learn 1.2.2 for data preprocessing and evaluation index calculation, and Pandas 1.5.3 for the organization and analysis of experimental data. All library versions are strictly managed through the Conda environment to ensure the consistency of experimental conditions.

During the model training process, the Adam optimizer is used for parameter updates, with an initial learning rate set to 1e-3 and a cosine annealing scheduling strategy applied for dynamic adjustment. The batch size is fixed at 64, and the number of model training epochs is set to 100. To avoid overfitting, in addition to introducing L2 regularization into the loss function, a Dropout mechanism with a rate of 0.5 is applied before the fully connected layer of the model. To ensure the comparability of experimental results, all comparative experiments are initialized with the same random seed, and performance evaluation is conducted under the same data division.

Parameters setting

To ensure the reliability and comparability of experimental results, this study uniformly controls the parameter settings of all models. The CW-RNN model adopts a hidden layer structure with 4 modules, whose clock cycles are set to 1, 2, 4, and 8 respectively. This exponentially increasing cycle configuration can effectively capture multi-scale temporal features of network traffic, ranging from short-term sudden bursts to long-term persistence. The hidden layer dimension of each module is fixed at 128, ensuring the model has sufficient feature expression capability.

During the training process, the Adam optimizer is employed for parameter updates, with an initial learning rate set to 0.001, coupled with an exponential decay scheduling strategy where the decay rate is set to 0.95. The batch size is fixed at 64 samples, and the maximum number of training epochs for the model is set to 200. Additionally, an early stopping mechanism is introduced to monitor the validation set loss, which automatically terminates training when no performance improvement is observed for 10 consecutive epochs.

To prevent overfitting, a Dropout technique with a rate of 0.5 is applied before the fully connected layer of the model. The weight decay coefficient is set to 0.001, and this L2 regularization term can effectively constrain model complexity. The loss function adopts the standard multi-class cross-entropy loss for classification tasks. All parameters are initialized using the Xavier uniform distribution method to ensure numerical stability in the initial stage of training.

To verify the robustness of parameter selection, this study conducted a grid search on key hyperparameters during the preliminary experiment phase, including learning rate, hidden layer dimension, and Dropout rate. The finally determined parameter combination achieved the optimal balanced performance on the validation set, which can simultaneously balance model convergence speed, generalization ability, and computational efficiency.

The training and validation of the CW-RNN network attack detection model in this study are based on the complete original experimental code with Zenodo DOI as the permanent authoritative reference address (10.5281/zenodo.1045887), while keeping the GitHub repository as a secondary image backup address (URL: https://github.com/AFAgarap/gru-svm). This code repository is maintained by researchers in the field of network security and contains all executable source code files, including model training scripts, testing and validation scripts, network architecture core code, and data processing auxiliary tool scripts. The requirements.txt file in the repository clearly indicates the development environment that the code depends on, and is developed based on the TensorFlow framework. The README.md document provides detailed information on the environment deployment method, program execution instructions, model hyperparameter configuration, and dataset calling method. The fixed version of the repository is v0.3.11-alpha, ensuring that the experimental code version is unique and controllable, and avoiding experimental differences caused by iterative updates. The UNSW-NB15 dataset used in this study can be obtained through the official permanent link of the Australian Cybersecurity Centre (URL: https://research.unsw.edu.au/projects/unsw-nb15-dataset); The CSE-CIC-IDS2018 dataset is sourced from the Canadian Institute of Cyber Security’s public platform (URL: https://www.unb.ca/cic/datasets/ids-2018.html). Both datasets are official long-term publicly accessible addresses. The code repository has built-in data preprocessing scripts that are completely consistent with the experiments in this article. Combined with the experimental hardware configuration recorded in the official documentation, readers can fully reproduce all the training, validation, and comparative experimental results in this study.

Performance evaluation

(1) Internal comparison and ablation research.

To deeply analyze the specific contribution of each component in the CW-RNN model to the final performance, this study designs a systematic ablation experiment. By sequentially removing or replacing key modules while keeping other parameters consistent, the effectiveness of the time-sharing processing mechanism and the attention layer in the overall architecture can be accurately quantified. This rigorous internal comparison helps understand the working principle of the model and provides a clear direction for subsequent structural optimization, ensuring that any performance improvement stems from the innovative design. Figure 4 presents the results of the internal comparison and ablation study.

Fig. 4.

Internal comparison and ablation study (Drawn by the author).

In Fig. 4, the experimental results indicate that when the modular clock mechanism is removed and a unified update frequency is adopted, the macro-F1 score of the model on the UNSW-NB15 dataset significantly decreases from 94.2% to 89.7%, confirming the necessity of multi-time-scale processing for capturing complex attack patterns. Further removal of the attention layer leads to a 5.3% point drop in detection accuracy for Web attacks, a type of attack where local features are critical. Comparisons of different module cycle configurations reveal that the exponentially increasing sequence (1, 2, 4, 8) outperforms linear sequences in long-dependency tasks, with a 7.1% improvement in recall rate for DDoS attack detection, verifying the rationality of the current parameter configuration. All performance changes of each component in the ablation experiments have been confirmed to be statistically significant via paired t-tests (p < 0.05).

(2) Comparative analysis of external benchmarks.

To objectively evaluate the comprehensive performance of the CW-RNN model in network attack detection tasks, this study conducts comparative experiments with various mainstream detection models. The selected benchmark models cover typical methods from traditional machine learning to cutting deep learning, including RNN represented by LSTM and Gated Recurrent Unit (GRU), convolutional networks represented by CNN, and classic classifiers such as Random Forest. Through systematic comparison under the same dataset, identical data partitioning, and consistent evaluation metrics, the relative strengths and weaknesses of each model in processing complex network traffic data can be fairly assessed. Figure 5 presents the results of the external benchmark comparison analysis.

Fig. 5.

Comparative analysis of external benchmarks (Drawn by the author).

In Fig. 5, under the same experimental conditions, the CW-RNN achieves the optimal comprehensive performance on the UNSW-NB15 dataset. Its accuracy rate reaches 95.8% and macro-F1 score is 94.2%, which are 2.1% and 2.4% higher than those of the best benchmark model, respectively. Specifically, the CW-RNN performs prominently in handling long-temporal dependency threats such as slow penetration attacks, with a false negative rate 6.2% lower than that of LSTM. In terms of computational efficiency, the training time of CW-RNN is approximately 25% shorter than that of LSTM with the same hidden layer size, and its inference speed is increased by 18%, this benefits from its time-sharing processing mechanism, which effectively reduces redundant computations. All performance differences have been verified through repeated experiments and are statistically significant. In Tables 1 and 2, the quantitative analysis results of the model on the CSE-CIC-IDS2018 dataset are presented.

Table 1.

Performance comparison between CW-RNN model and benchmark model in CSE-CIC-IDS2018 dataset (Drawn by the author).

Model	Accuracy (%)	Macro Average F1 Score (%)	False alarm rate (%)	Missed report rate (%)	Inference speed (samples/s)
LSTM	93.5	91.8	4.2	5.7	892
GRU	92.9	91.2	4.5	6.1	915
CNN	90.7	88.9	5.8	7.6	958
Random forest	89.2	87.5	6.5	8.3	786
CW-RNN	95.2	93.6	2.8	4.1	1068

Table 2.

Detection performance of CW-RNN model in different attack types of CSE-CIC-IDS2018 dataset (Drawn by the author).

Attack type	Accuracy (%)	F1 score (%)
brute force	96.5	95.8
DDoS	97.2	96.9
Web attack	94.8	93.9
Botnet	93.7	92.6
Port scanning	95.5	94.7
Blackmail software	92.9	91.8
Transverse penetration	93.2	92.3

In Tables 1 and 2, CW-RNN still achieves the best overall performance on the CSE-CIC-IDS2018 dataset. Compared with the optimal baseline model LSTM, the accuracy and macro-average F1-score are improved by 1.7 and 1.8%, respectively, and the false positive rate and false negative rate are significantly reduced, verifying the strong generalization ability of the model. Its multi-time-scale processing design delivers satisfactory detection performance for both short-term burst attacks and long-term latent attacks, and the inference speed is also significantly superior to that of the baseline models, balancing accuracy and efficiency. Only the detection performance for highly concealed attacks such as ransomware and lateral movement is slightly weaker, and the clock cycle configuration of low-frequency modules can be optimized to improve the detection capability in future work.

Discussion

The network attack detection model based on the CW-RNN constructed in this study effectively addresses the deficiencies in multi-time-scale temporal feature modeling and the computational efficiency bottlenecks of traditional detection methods through the synergistic optimization of the modular clock mechanism and the attention mechanism. It exhibits excellent detection accuracy and generalization capability on two major benchmark datasets, namely UNSW-NB15 and CSE-CIC-IDS2018, and this result stems from the deep matching between the model architecture and the temporal characteristics of network attacks. Network attacks possess the dual characteristics of short-term burstiness and long-term latency. The design of CW-RNN with modular clock cycles in exponential growth enables high-frequency modules to accurately capture instantaneous traffic anomalies and low-frequency modules to effectively track long-term behavioral patterns. Combined with the hierarchical information interaction mechanism among modules, the complementary fusion of features at different time scales is realized, which fundamentally avoids problems such as gradient vanishing and short-term feature dilution faced by traditional RNNs and LSTMs in long-sequence processing. While maintaining detection accuracy, the model reduces redundant computations through the asynchronous update mechanism, achieving a 25% reduction in training time and an 18% improvement in inference speed, and thus is more in line with the real-time requirements of practical network security protection.

The ablation experiments further verify the technical value of the core modules of the model. The clock mechanism brings a 4.5% improvement in the macro-average F1-score, confirming the necessity of hierarchical modeling of multi-time-scale features. The attention mechanism increases the recognition rate of Web attacks by 5.3%, highlighting the effectiveness of the feature enhancement strategy for key attack stages. Compared with existing detection methods based on Transformer or CNN, the proposed model breaks through the dual limitations of single-scale modeling and accuracy-efficiency imbalance. While maintaining a high detection accuracy of 95.8%, it possesses the potential for lightweight deployment. Moreover, the built-in three-dimensional traceability design of “feature-time-module” frees detection results from the limitations of traditional black-box models, providing technical support for network attack forensics analysis and building a practical bridge for the integration of technical models and international cyber law governance frameworks. This three-dimensional traceability can directly address core practical issues in international cyber law. In national-level cyber attack attribution, it can locate the technical feature identifiers of attack behaviors through the feature dimension, restore the complete behavioral timeline of attacks in the time dimension, and trace the evolutionary features of each attack stage from probing and penetration to execution in the module dimension, forming a verifiable and traceable technical evidence chain. In the compliance verification of international norms, the three-dimensional traceability results can be relied on to clarify the time nodes, feature manifestations and behavioral modules of network actions, and determine whether they conform to international cyberspace norms of conduct. This enables technical detection results to serve as an important basis for fact-finding in international cyber law governance, realizing the concrete integration of technical models and legal governance rather than mere conceptual association.

Through architectural innovation and mechanism optimization, this study provides a network attack detection technical solution integrating accuracy, efficiency, and interpretability. Its core design ideas can serve as a reference for research on multi-time-scale time-series data modeling; however, the model still has certain limitations in practical applications. Currently, model training relies on laboratory environment datasets, and its detection capability for zero-day attacks and high-intensity adversarial samples has not been fully verified. Due to the lack of known feature samples, as well as the characteristics of feature camouflage and mutation, such attacks make it difficult for the existing modular clock mechanism to quickly capture their atypical temporal evolution features. High-frequency modules are prone to interference from false instantaneous features, while low-frequency modules struggle to effectively model unknown long-term features. To address this issue, targeted improvements can be made based on the existing model structure: an adaptive feature clustering mechanism can be introduced into the clock modules, enabling high-frequency modules to quickly screen out and eliminate false instantaneous features of adversarial samples and enhance the ability to extract real abnormal features; meanwhile, a few-shot learning mechanism can be integrated into low-frequency modules to realize feature transfer through a small number of unknown attack samples, improving the recognition capability for zero-day attacks. Additionally, on the basis of the existing three-dimensional traceability, a feature mutation tracking dimension can be added to achieve real-time capture of the feature evolution of adversarial samples. Furthermore, although the model has improved performance through a differentiated module optimization strategy, the deployment cost in resource-constrained scenarios such as edge computing still needs to be further reduced, which is also a key direction to be broken through in subsequent research. Overall, the innovative application of the CW-RNN model in the field of network attack detection achieves performance breakthroughs at the technical level and provides a feasible path for the integration of technology and legal governance through its traceability design. Its adaptability in real and complex network environments and lightweight improvement will become the core directions for in-depth research in the future.

Conclusion

Research contribution

Focusing on the core pain point of insufficient modeling of multi-time-scale temporal features in modern cyber attack detection, this study conducts research on the innovative application of Clockwork Recurrent Neural Networks (CW-RNNs) in this field. It constructs an intelligent detection architecture that integrates detection accuracy, computational efficiency, and interpretability. Through theoretical innovation and technical optimization, the study effectively breaks through the bottlenecks of gradient instability and computational redundancy faced by traditional recurrent neural networks and their variants in long-sequence dependency processing. It provides new ideas and support for the development of cyber attack detection technologies.

At the theoretical level, this study pioneers the systematic introduction of CW-RNN into the field of cybersecurity. By establishing a modular multi-time-scale feature fusion mechanism, it clarifies the modeling logic of “frequency stratification-asynchronous update”, providing a new theoretical framework for capturing the temporal features of complex attack behaviors. This breaks through the technical limitation of traditional models that struggle to simultaneously adapt to both short-term sudden attacks and long-term latent attacks. At the technical level, the proposed collaborative optimization strategy of the clock-driven modular structure and attention mechanism achieves a balanced improvement in detection performance and computational efficiency through exponentially increasing clock cycle configuration, hierarchical module interaction design, and differentiated optimization schemes. The model’s advantages in core evaluation indicators fully verify the effectiveness and rationality of the technical solution. Meanwhile, the model’s built-in three-dimensional traceability capability of “feature-time-module” endows the detection results with good interpretability, providing solid technical support for attack forensics and reflecting the deep alignment between technical design and practical application needs.

Future works and research limitations

At the same time, this study still has certain limitations: the model training relies on laboratory environment datasets, and its generalization ability in real network environments when facing zero-day attacks and high-intensity adversarial examples needs further verification. The model has high requirements for computing resources, making its deployment in resource-constrained scenarios such as edge computing challenging. The standardized process for transforming technical detection results into legal evidence still requires in-depth exploration. Future research will focus on breakthroughs in three aspects: (1) Constructing a detection framework for multi-source heterogeneous data fusion to enhance the perception ability of unknown threats. (2) Developing lightweight model variants to adapt to the security needs of low-power scenarios such as the Internet of Things and mobile terminals. (3) Deepening interdisciplinary collaboration, establishing a standardized mapping system between technical detection and legal forensics, and promoting the research results to play a greater role in practical network security protection and governance.

Author contributions

Haiying Lin: Conceptualization, methodology, software, validation, formal analysis, investigation, resources, data curation, writing—original draft preparationLin Chen: writing—review and editing, visualization, supervision, project administration, funding acquisition.

Funding

This research received no external funding.

Data availability

All datasets used and analyzed in this study are publicly available official datasets: The official access link for the UNSW‑NB15 dataset is: https://research.unsw.edu.au/projects/unsw-nb15-dataset; The official access link for the CSE‑CIC‑IDS2018 dataset is: https://www.unb.ca/cic/datasets/ids-2018.html; all source codes, scripts, and experimental configuration files for this study have been stored in the DOI-generating version control repository Zenodo. Zenodo (main reference version): https://doi.org/10.5281/zenodo.1045887.GitHub (secondary mirror): https://github.com/AFAgarap/gru-svm.

Declarations

Competing interests

The authors declare no competing interests.

Ethics statement

The studies involving human participants were reviewed and approved by School of Law, Jiaying University Ethics Committee (Approval Number: 2023.0123500). The participants provided their written informed consent to participate in this study. All methods were performed in accordance with relevant guidelines and regulations.