Tenko: A Streaming Intrusion Detection Framework with Context-Aware Anomaly Scoring

Abstract

Unsupervised intrusion detection systems (IDS) are appealing because they can identify previously unseen attacks without labeled data; however, many reconstruction-based detectors are sensitive to benign traffic variability in deployment. Packet-derived anomaly scores fluctuate, fixed thresholds become unstable, and instantaneous alerts generate persistent false positives in streaming and resource-constrained environments. In reconstruction-based detectors, this instability arises when observations lack multi-packet, partial-flow, or persistent entity-level context, while malicious activity is associated with entities evolving over time. We present Tenko, a lightweight unsupervised intrusion detection framework that augments packet-level detection with persistent context by synthesizing reconstruction-error observations into continuously updated node-level risk scores and conditioning each packet-level decision on the corresponding node’s behavioral state. An autoencoder-based detector provides instantaneous anomaly measurements, while temporal aggregation interprets these measurements using persistence and entity context, enabling operation under thresholds calibrated without labeled attack data. Across diverse attack scenarios, distribution shifts, and memory-constrained conditions, Tenko produces more consistent, lower-variance decision behavior while remaining computationally suitable for streaming gateway and IoT workloads under sequential trace replay. The results show that persistence-aware interpretation can improve the practical usability of reconstruction-based detection under benign-only training. At the same time, unavoidable false alarms for some traffic patterns and degradation under extreme distribution shift reflect the operational limits of unsupervised detection from a single benign reference regime. These findings indicate that, in deployment-constrained streaming environments, effective unsupervised intrusion detection depends less on instantaneous anomaly magnitude alone than on how anomaly evidence is accumulated and interpreted within a bounded operating regime.