Time Matters: Temporal NetFlow Features for ML-Based Network Intrusion Detection

Abstract

Most machine learning-based network intrusion detection systems (NIDS) rely on per-flow time-agnostic feature vectors, representing each flow using structural NetFlow features without explicit temporal information. This representation limits the ability to capture the intrinsic temporal structure of network traffic, such as event sequencing, inter-arrival dynamics, and non-stationary rate fluctuations. Consequently, the contribution of these temporal dependencies to detection performance remains under-characterised. In this work, we evaluate the extent to which sequential architectures, specifically Transformers, Long Short-Term Memory networks, and one-dimensional Convolutional Neural Networks, can exploit time-dependent information under controlled cross-dataset conditions. To facilitate this analysis, we introduce NF3, a temporally enriched extension of existing NetFlow-based benchmarks, which integrates fine-grained timestamps and inter-arrival-time statistics. Using these augmented datasets, we quantify temporal regularities in benign and malicious traffic and benchmark the ability of each architecture to learn time-dependent representations in both binary and multi-class settings. Our results demonstrate that augmenting conventional flow features with temporal information yields consistent gains; binary detection improves by up to 3% in F1 score, while macro-averaged multi-class F1 increases by approximately 27%, with the most significant improvements occurring in attack classes with pronounced temporal signatures. These findings indicate that incorporating time-dependent information enhances both the discriminative power and behavioural interpretability of modern NIDS.