Memristor-Based Neuromorphic System for Unsupervised Online Learning and Network Anomaly Detection on Edge Devices

Abstract

An ultralow-power, high-performance online-learning and anomaly-detection system has been developed for edge security applications. Designed to support personalized learning without relying on cloud data processing, the system employs sample-wise learning, eliminating the need for storing entire datasets for training. Built using memristor-based analog neuromorphic and in-memory computing techniques, the system integrates two unsupervised autoencoder neural networks—one utilizing optimized crossbar weights and the other performing real-time learning to detect novel intrusions. Threshold optimization and anomaly detection are achieved through a fully analog Euclidean Distance (ED) computation circuit, eliminating the need for floating-point processing units. The system demonstrates 87% anomaly-detection accuracy; achieves a performance of 16.1 GOPS—774× faster than the ASUS Tinker Board edge processor; and delivers an energy efficiency of 783 GOPS/W, consuming only 20.5 mW during anomaly detection.

1. Introduction

Artificial Intelligence (AI) computation is undergoing a transformative shift, with a significant movement toward edge computing. By 2025, it is projected that 75% of enterprises will adopt edge-based computation to leverage its advantages in latency reduction and localized processing [1]. With billions of devices connected to the internet through various protocols, the volume of generated and transmitted data has grown exponentially. However, this proliferation of internet-connected devices has escalated concerns about system integrity and data security. Consequently, real-time learning of network packets for intrusion detection has become essential for ensuring uninterrupted and secure network operations [2].

Network intrusion detection systems are broadly categorized into two types: (i) signature-based systems and (ii) anomaly-based systems [3]. Signature-based systems detect threats by comparing incoming packets against a database of known signatures using state machine algorithms such as Snort, Sagan, and Suricata [4]. However, these systems are ineffective against unknown or zero-day attacks. In contrast, anomaly-based systems evaluate the similarity between incoming packets and previously known packets to identify potential threats. These systems employ statistical models, finite state machines, or Artificial Neural Networks (ANNs) [5]. ANNs are particularly effective due to their ability to dynamically adapt to new knowledge by adjusting synaptic parameters, making them a robust tool for anomaly detection in dynamic network environments.

ANNs are further classified based on their training methodologies, such as supervised and unsupervised learning [6]. Supervised neural networks, like Multilayer Perceptrons (MLPs) and Convolutional Neural Networks (CNNs), require labeled data and excel at classifying known patterns. However, their reliance on labeled data limits their suitability for real-time training, where data labels may not be readily available. In contrast, unsupervised neural networks do not require labeled data, making them ideal for real-time and adaptive applications.

Traditionally, training ANN architectures demands high-power computing platforms, such as GPUs in data centers, which come with substantial memory and energy requirements [7]. Transferring data to these centralized facilities for training introduces latency, memory overhead, and high power consumption, all of which are significant challenges in the edge AI paradigm. Additionally, deploying GPU-based training systems on resource-constrained edge or IoT devices is impractical.

As edge computing becomes increasingly prevalent, the security of edge devices has emerged as a critical concern. To address these challenges, there is a pressing need for AI training platforms capable of performing real-time data processing and online learning directly on local devices. These platforms enable personalized and secure applications while reducing reliance on centralized, energy-intensive facilities [8].

Low-power AI neural-network accelerators present a promising solution to these challenges. However, most commercially available AI accelerators are designed for inference tasks only, limiting their applicability for on-device training [9]. Furthermore, CMOS technology is nearing its physical and performance limits, with Von Neumann computing architectures facing bottlenecks due to Moore’s law, the memory wall, and the heat wall [10]. Non-Von Neumann computing paradigms, such as neuromorphic on-chip learning, offer a viable alternative for implementing neural-network systems with on-device training capabilities. In this paradigm, data are processed and stored in the same location, eliminating the need for extensive data movement. This approach, known as Processing-In-Memory (PIM), significantly enhances computational efficiency [10].

Among emerging technologies, memristors have garnered significant attention as a fundamental building block for neuromorphic computing systems. Memristors are nanoscale, non-volatile memory devices that enable non-Von Neumann computing and on-chip learning without off-chip memory access [10,11]. These devices, fabricated in crossbar architectures, perform multiply–accumulate operations—a dominant function in neural networks—efficiently and in parallel within the analog domain [11]. The small feature size of memristors enables the development of high-density neuromorphic systems with exceptional computational efficiency [10].

Memristors present a compelling alternative to traditional memory technologies, offering higher density, lower cost, and non-volatility compared to SRAM- and DRAM-based computing [12]. These resistive devices, characterized by their inherent memory effect, enable data storage and processing within the same physical structure, reducing latency and energy consumption. By integrating ultrahigh-density memristive memory directly into processor chips, the longstanding memory bottleneck in computing architectures can be significantly mitigated, leading to substantial improvements in system speed and energy efficiency [10,12]. Recent studies have further advanced memristor technology by addressing key challenges such as thermal stability, endurance, and energy efficiency, making them more viable for large-scale implementation [13,14]. As we evaluate the potential of memristors to drive computing beyond Moore’s law, their scalability and adaptability position them as key enablers of next-generation architectures, paving the way for novel paradigms in data-intensive and neuromorphic computing applications [10,12,13,14].

This article focuses on the design and implementation of a neural network-based intrusion and anomaly-detection system. The key contributions are as follows:

• Development of an ultralow-power memristor-based unsupervised on-chip and online-learning system for edge security applications.
• Resolution of circuit challenges for implementing online threshold computation to support real-time learning.
• Design and simulation of a Euclidean Distance computation circuit, integrated into the memristor-based neuromorphic system for unsupervised online training.

The rest of the paper is organized as follows: Section 2 describes the dataset used in the experiment. Section 3 discusses the unsupervised learning approach for anomaly detection. Section 4 details the memristor-based implementation for the on-chip and online-learning system. Section 5 provides an overview of related works, while Section 6 elaborates on the memristor-based online-learning system. Section 7 explains the threshold-computing circuits, and Section 8 presents SPICE simulation results for these circuits. Section 9 showcases the results and analysis of online learning. Finally, Section 10 concludes the paper.

2. Network Dataset

The NSL-KDD dataset is a popular benchmark for validating machine-learning and neural-network models [15]. The dataset has one normal class and four malicious classes (DoS, Probe, R2L, and U2R). The dataset is separated into training and testing categories, and they contain 125,673 and 22,544 packets, respectively. A sample of normal and malicious network data packets is presented in Figure 1a. Both datasets consist of normal and malicious packages. Nevertheless, the test dataset contains 17 more malicious data types that are not present in the training dataset. The distribution of normal and malicious packets, along with their variants, is presented in Figure 1b.

These new categories remain unknown datatypes to supervised learning networks, as they were not present in the training session. However, the anomaly-detection system can handle these unknown categories as a zero-day attack by comparing the sequence with normal or known packets.

Each packet has 43 attributes with binary, alphanumeric, and nominal values. The nominal attributes are the protocol, service, flag, and attach types and occupied 2nd to 4th and 42nd positions. First, the nominal values are replaced with integers, and then the attributes are normalized to be bounded between 0 and 1. Examples of network packets before and after normalizations are presented in Figure 1a.

3. Unsupervised Learning

An unsupervised neural network learns the input feature space without knowing the identity or label of the sample. The purpose of unsupervised learning is to learn the underlying structure of the dataset and cluster that data according to the similarity measures.

The conceptual diagram of a simples vanilla autoencoder is presented in Figure 2. In Figure 2, X is the input feature space fed to the input layer. The encoder section learns to compress the sample into lower-dimensional latent feature space at the Z bottleneck layer. On the other hand, the decoder section learns to regenerate the input feature space at the output, $\acute{X}$. Once the AE is trained, it becomes a very efficient machine to regenerate the known classes and discriminate with the unknown inputs [16].

The encoder and decoder transformation of an AE can be denoted by $\varphi$ and $\psi$, $\varphi : X\to Z$ and $\psi :Z\to \acute{X}$. For instance, if we consider the simplest vanilla autoencoder [17] with a single hidden layer (Z) with input and output layers, as in Figure 2, the mathematical expression for the layer-wise signal propagation can be expressed as in Equations (1) and (2).

$$Z=f\left({{\displaystyle \sum }}_{i=1}^{n1}w{x}_i+b\right)$$

(1)

$$\acute{X}=g\left({{\displaystyle \sum }}_{j=1}^{n2}{w}^T{z}_j+b^T\right)$$

(2)

where b is biasing toward the neuron, f is the activation function, and n is the number of neurons in any layer. The inputs $x_i\in X$ and $z_j\in Z$ are the elements in latent space. The model is trained by backpropagation of error [17] to minimize the reconstruction error or loss function, $\mathcal{l}\left(X,\acute{X}\right)={\left|\left|X-\acute{X}\right|\right|}^2$. The same technique can be applied for layer-wise computation for autoencoders with multiple hidden layers, as presented in Figure 3. Equations (3)–(6) represent the system of equations for layer-wise implementation.

$$L_{1j}=f\left({{\displaystyle \sum }}_{i=1}^{41}{w}_{1\left(i,j\right)}.x_i+b_{1j}\right)$$

(3)

$$L_{2k}=f\left({{\displaystyle \sum }}_{j=1}^{90}{w}_{2\left(j,k\right)}.h_{1j}+b_{2k}\right)$$

(4)

$$L_{3j}=f\left({{\displaystyle \sum }}_{k=1}^{10}{w}_{2\left(k,j\right)}^{\prime }.h_{2k}+b_{3j}\right)$$

(5)

$$L_{4i}=f\left({{\displaystyle \sum }}_{j=1}^{90}{w}_{1\left(j,i\right)}^{\prime }.h_{3j}+b_{4i}\right)$$

(6)

4. Memristor Implementation

4.1. Memristor Device Model

The memristor SPICE model is governed by a generalized I–V relationship, as expressed in Equation (7), where the current, I(t), depends not only on the applied voltage, V(t), but also on the state variable, x(t), which dynamically modulates the device resistance. The variation in x(t) is dictated by two primary functions: g(V(t)) and f(x(t)).

$$I\left(t\right)=\left\{\begin{array}{c}{a}_{1}x\left(t\right)\sinh \left(bV\left(t\right)\right), V\left(t\right)\ge 0\\ a_{2}x\left(t\right)\sinh \left(bV\left(t\right)\right), V\left(t\right)<0\end{array}\right.$$

(7)

$$g\left(V\left(t\right)\right)=\left\{\begin{array}{c}{A}_{p }\left(e^{V\left(t\right)}-e^{V_p}\right), V\left(t\right)>V_p\\ -A_{n }\left(e^{-V\left(t\right)}-e^{V_n}\right), V\left(t\right)<-V_n\\ 0, -V_n\le V\left(t\right)\le V_p\end{array}\right.$$

(8)

The variation in x(t) is dictated by two primary functions: g(V(t)) and f(x(t)). The function g(V(t)), defined in Equation (8), enforces a threshold voltage requirement, ensuring that the state variable changes only when V(t) exceeds a certain positive or negative threshold (V_p and V_n respectively). This feature is crucial for accurately capturing the switching behavior of practical memristive devices.

$$f\left(x\right)=\left\{\begin{array}{c}{e}^{-a_p\left(x-x_p\right)}{w}_p\left(x,x_p\right), x\ge x_p\\ 1, x<x_p\end{array}\right.$$

(9)

$$f\left(x\right)=\left\{\begin{array}{c}{e}^{a_n\left(x+x_n-1\right)}{w}_n\left(x,x_n\right), x\le 1-x_n\\ 1, x<1-x_n\end{array}\right.$$

(10)

Meanwhile, the function f(x(t)), presented in Equations (9) and (10), models the nonlinear motion of ions within the memristor, accounting for the increased difficulty in altering the state as x(t) approaches its boundary limits. The overall state variable dynamics are then expressed in Equation (10), where the time derivative, dx/dt, is determined by the product of g(V(t)) and f(x(t)), scaled by a coefficient, η. This comprehensive modeling framework ensures that the proposed memristor model can accurately represent devices with varying physical structures, making it suitable for simulating diverse memristive systems. Readers are referred to [18,19] for more details on the memristor model.

$${\displaystyle \frac{dx}{dt}}=\eta g\left(V\left(t\right)\right)f\left(x\left(t\right)\right)$$

(11)

4.2. Memristor Neuron Circuit

Figure 4a,b present a memristor-based neuron circuit consisting of N inputs (X) and one bias (β). The output neuron is connected to the error generation circuits (see Figure 4b). The Euclidean distance computing circuitry is implemented for online-learning experiments to compute the threshold in real time. In the neuron circuit, the synaptic element is represented by 0T2M, where there is a pair of memristor devices along the row, as presented in Figure 4 [18,20,21,22]. No transistor was used for the cell unit, which reduces the cell size and makes it about 36 times smaller than a typical SRAM cell. The synaptic weight can be negative (${\sigma }^{+}-{\sigma }^{-}<0$) or positive (${\sigma }^{+}-{\sigma }^{-}>0$) based on the magnitude of the conductance of memristor pairs. The synapse receives the inputs as an analog voltage pulse, multiplies with the synaptic conductance, and gives a resultant current that flows along the common column. The total current is sensed at the bottom of the neuron circuit as in Equation (12), and the output voltage from the op-amp circuits is the resultant voltage Y_m (see Equation (13)). The neuron circuit creates approximated sigmoid activation (Equation (14)) in op-amp circuits, where the power rail of the op-amp is connected to V_DD = 1 V and V_SS = 0 V.

The sigmoid is typically used as the activation function in deep learning, which is represented as $f\left(x\right)=1/(1+e^{-x})$. However, in the presented memristor-based neuromorphic system, the approximated sigmoid function in Equation (14) is used, as it is easier to generate using an amplifier circuit [20]. Figure 5 displays the typical sigmoid function, along with the approximation used in this work.

$$I_j={\displaystyle \sum }_N{X}_N\left({\sigma }_{ij}^{+}-{\sigma }_{ij}^{-}\right)+X_{\beta }\left({\sigma }_{\beta }^{+}-{\sigma }_{\beta }^{-}\right)$$

(12)

$$Y_m=R_f{I}_j$$

(13)

$$y=\left\{\begin{array}{c}1, y>2\\ 0.25y+0.5, \left|y\right|\le 2\\ 0, y<2\end{array}\right.$$

(14)

4.3. Crossbar Training Circuit

The memristor-based crossbar circuit is trained in the full analog domain. The forward propagation is performed the same way the inference is computed in multilayered neural networks. The training samples are applied to the input nodes of the neural networks, producing vector–matrix multiplication and giving a neuronal sum at the output nodes. An error backpropagation process [23,24] is utilized in the training process.

For training the autoencoder circuits, transposable arrays are designed where the input can be applied both row-wise and column-wise. The error (${\delta }_j$) is generated from the error generation circuit for each input sample, as shown in Figure 6. The error is backpropagated to the same crossbar circuit, but from the transposed direction, and produce a resulted sum, ${\displaystyle \sum }_j{\delta }_j{\sigma }_{ij}$.

The amount is multiplied with the derivation of neuron activation to compute the layer error gradient. The weight update of the neuron is performed based on the product of activation and error gradient ($x_N{\delta }_j$) of each layer. For weight update, pulses are produced with varible heights and widths. The height is modulated by the input activations and the widht is shaped by the product of learning rate and error gradient ($\eta {\delta }_j$), as discussed in [10]. The detailed training steps are presented in pictorial form in Figure 5, with transposable crossbar array circuits and peripheral details. The Euclidean distance computing module is necessary for determining the anomalies in the computer networks. This module is embedded in the online-learning process to calculate the threshold. Analog computations are severely affected by noise from different pieces of analog circuits, such as ADC/DAC, op-amps, and the memristor array. The noise is introduced in the circuit simulation during weight updates, as described in Equation (15), where $\eta {\delta }_j$ is the weight update amount, and $n_j$ is random noise.

$$w_{new}^j=w_{old}^j+\eta {\delta }_j+ {\mathrm{n}}_j$$

(15)

5. Online Learning and Related Works

5.1. Online-Learning Memristor Neuron Circuit

Online learning, akin to continual lifelong learning [25], addresses the challenge of sequential data streams, in contrast to the batch-learning approach commonly used in deep-learning training. In online learning, the system learns from a continuous sequence of incoming data without requiring pretrained knowledge or a fixed dataset. As new samples arrive, the network updates its parameters in real time. However, a major drawback of this approach is catastrophic forgetting [26], where the model tends to forget previously learned information when new data are introduced. This phenomenon significantly reduces model performance, as older knowledge is overwritten by new data.

State-of-the-Art deep-learning algorithms have demonstrated superior performance in classification tasks, especially in large-scale data processing. However, these algorithms assume that all possible data types are included in the training set. When trained sequentially, the model experiences a decline in accuracy due to catastrophic forgetting. To mitigate this issue, an effective learning system must possess the ability to acquire new knowledge while preserving previously learned information, thus overcoming the challenge of catastrophic forgetting

5.2. Related Works on Online Learning

Real-world computational units often encounter continuous streams of information, necessitating real-time learning systems capable of handling dynamic data distributions and learning multiple tasks. Various machine-learning and deep-learning algorithms have been proposed for online-learning applications. This section highlights some relevant systems.

Continuous and lifelong learning, a key area in online learning, has been an active research frontier for decades, with numerous algorithms developed for this purpose [27]. S. A. Rebuffi et al. introduced the iCARL algorithm, a supervised lifelong online-learning approach that can identify new categories and incrementally learn classes, though it requires storing samples of all classes for fine-tuning [28]. M. Pratama et al. proposed the evolving denoising autoencoder (DEVDAN) for online incremental learning on non-stationary data streams; it adapts by generating, pruning, and learning hidden nodes on the fly [29]. S. S. Sarwar et al. presented a deep CNN (DCNN) for incremental learning, addressing catastrophic forgetting by partially sharing trained knowledge and using new branches for new classes [30]. Hierarchical temporal memory (HTM) has been applied for online learning and anomaly detection in various domains, including 3D printing and video anomaly detection [31,32]. Extreme learning machines (ELMs) and Adaptive Resonance Theory (ART) algorithms have been explored for dynamic modeling, anomaly detection, and intrusion detection [33,34,35,36,37,38,39,40].

While most of these systems are implemented in software, there are a few hardware implementations of online-learning algorithms with emerging resistive memory devices. ELM has been implemented in both spiking [41] and non-spiking [42] neuromorphic systems, and ART in FPGA [43] and memristor-based systems [37]. Autoencoders have been implemented in FPGA for unsupervised learning, such as detecting new physical phenomena in the large hadron collider [44]. However, to the best of our knowledge, no one has previously implemented unsupervised autoencoders in memristor neuromorphic systems for online learning and anomaly detection. This work presents such an implementation, detailing the supporting circuits for online threshold computation and neural-network optimization [20,21].

5.3. Online-Learning Systems

The online-learning system in this study is presented in Figure 7a, with a conceptual diagram. The system is developed as a complement to the existing rule-based IDS system. AE-1 is a pretrained autoencoder that is trained on normal packets. AE-2 is implemented to learn only on malicious packets. The malicious packets are coming from AE-1 in real time.

6. Memristor-Based Online-Learning Systems

Unsupervised autoencoders are implemented in memristor-based neuromorphic architecture for anomaly-detection applications. The system has two main parts, the pretrained section and the online-learning section. In the pretrained section, the pretrained autoencoder detects potential malicious packets and directs them to the second autoencoder, where the AE-2 learns from the malicious packets only. The flowchart of the online-learning system is presented in Figure 7b. While learning about the malicious packets, the system can identify any new potential threat to the network, known as the zero-day attack, which is yet unfamiliar or an anomaly. However, with the repeated appearance of unknown packets, they become familiar to the network and are eventually recognized as known malicious packets by the system.

For online anomaly detection, the system needs to compute Euclidean distance for every network packet coming to AE-2. The ED is computed between the input and output feature vector of the network packets to determine the threshold for detecting the known or unfamiliar malicious packets. Online learning is taking place on edge devices, so there is no high-power floating processor to compute ED. In this work, we have proposed a detailed circuitry for computing ED in real time for optimizing the network and computing the threshold.

In online learning, the system needs to update the threshold for network anomaly detection, as it continuously learns and optimizes the network parameters for detecting the newly learned packets and the unknown packets. The threshold is computed using a series of analog squaring circuits that are able to compute reconstruction errors in a single shot. The block diagram of the Euclidean distance computing block is presented in Figure 8a. The differences between the input vector and generated output vector are d₁, d₂, …, d_n fed into the analog squaring circuit. A summing amplifier accumulates the output currents of the squaring circuits. The output of the summing amplifier is digitized through an analog-to-digital converter (ADC) and stored as the equivalent Euclidean distance in the look-up table (LUT), a peripheral memory module. After each learning cycle, the stored data are used to compute the threshold as the standard deviation in the digital system and then convert the result into an analog equivalent voltage signal for anomaly detection, as described in Figure 8b.

7. Analog Threshold Computing

The analog squaring circuits are integral to computing the training error as the Euclidean distance for online training. Each incoming sample’s distance is digitized using a low-precision ADC, stored in peripheral memory, and periodically used to update the anomaly-detection threshold. The distance computing circuit, shown in Figure 9, is divided into three main components: (A) absolute differential voltage computation, (B) voltage-to-current conversion, and (C) the squaring section.

Section A computes the absolute L1 norm (Manhattan distance) between the input and output vectors of the autoencoder circuit, providing the result at node P. Section B converts the input voltage Vp into a proportional current. Section C calculates the square of the Manhattan distance using the current input, (I_x-y).

In the online training of the NSL-KDD network packet dataset, the system requires 41 squaring circuits to efficiently perform training and anomaly detection. The system can also employ time-multiplexing techniques for enhanced functionality. All 41 squaring circuits compute the Euclidean distance simultaneously. After computation, the output current is passed through transistor M₇, where the current, I_out, generates a voltage drop at the output node Q. The voltage outputs from all squaring circuits are then accumulated using a summing amplifier and stored in a look-up table (LUT). The square root of the accumulated voltage values is used to determine the actual Euclidean distance.

The circuit presented in Figure 9 is implemented in SPICE simulation with actual device parameters to obtain the realistic characteristics of the training and anomaly-detection performance. Figure 10a presents the SPICE simulation for the switching time of analog squaring circuits implemented for computing the reconstruction error of the autoencoder. The graph shows two inputs (X and Y) applied at the differential circuit in Figure 10a and the differential voltage at node P. The timing for executing this circuit operation is 400 ns, considered the switching time. The switching time is required for the transistors in Figure 10a to develop the maximum output voltage level at node Q, while the input voltage is applied to the differential circuits. To compute the reconstruction error of the NSL-KDD, network packets need 41 of these circuits; thus, total energy consumption can be computed accordingly, as shown in Equation (16).

$$E=41{{\displaystyle \int }}_{t_1}^{t_2}P·t dt$$

(16)

The power consumption of the error computing circuit is presented in Figure 10b over the simulated switching time. To compute the total energy consumption, the area under the curve in Figure 9B is computed by the integration over time t₂ to t₁, and the computed energy consumption is 20.2 nJ for computing the reconstruction error of an NSL-KDD packet.

8. Simulation of Online Threshold-Computing Circuit

The squaring circuit is the main computing component for online learning and anomaly detection. The actual circuit is implemented in the LTSpice and simulated with realistic circuit parameters by using actual device parameters. For this implementation, the ASU 90 nm transistor model was utilized as a well-established hardware preference. For differential calculations, ideal op-amp devices are considered for simplicity. The simulation results of Figure 9 are presented in Figure 11a,b.

The output current is the resulted mirror current flowing through M7, and that is a squared value normalized by the bias current (I_bias). The simulated result is compared to the theoretical fitting relation, (${\displaystyle \frac{I_{in}^2}{I_{bias}}}$) [45], and follows the quadratic fit. The output voltage is measured at node Q (Figure 11b), and fitting parameters of the output voltage are utilized in the MATLAB R2022a simulation to estimate the threshold for anomaly detection. All the parameters for circuit simulation are presented in

Table 1. Parameters for threshold-computing circuit simulation.

Parameter	Magnitude	Unit
R	1000	Ohm
R1	1.50 × 106	Ohm
M1	1.99/0.65	W/L
M2	1.99/0.65	W/L
M3	0.2/0.16	W/L
M4	0.24/0.18	W/L
M5	1.28/0.65	W/L
M6	1.85/0.65	W/L
M7	1.85/0.65	W/L
Vbias	0.4	volt
Ibias	210	nA
RH	10,000	Ohm

. The W and L are the width and length of the transistor and given in µm.

9. Results and Discussion

The proposed online-learning and anomaly-detection system is highly dependent on the threshold-computing system. This work implemented an analog threshold-computing system with a low-precision and power-efficient ADC [46] for data conversion.

9.1. Crossbar Training Analysis

The crossbar training is performed completely in the analog domain, without using any data conversion units attached with crossbar circuits. The crossbars layers are connected toe-to-toe style. The crossbar training procedure is discussed in section III(B). This section discusses the training results and performance of AE on intrusion detection. The circuit parameters for training are presented in

Table 2. Parameters for memristor circuit simulation.

Parameter	Magnitude	Unit
Cycle time	2 × 10−9	s
Max training pulse duration	5 × 10−9	s
Roff	10	MΩ
Ron	50	KΩ
Ravg	5.025	MΩ
Wire resistance	5	Ω
Vmem	1.3	V
Pmem	0.336	µW
Op-amp power	3	µW
Max read voltage	1.3	V
Feature size, F	45	nm
Transistor size	50	F2
Memristor area	10,000	nm2
Cycle time	2	ns
Crossbar processing time	50	ns

. The realistic SPICE model was utilized for memristor device circuit simulation [18,19]. The memristor device with a higher Roff/Ron ratio was considered from practical memristor device data presented in [47].

9.2. Pretrained AE

The pretraining of AE-1 in Figure 7a is performed on-chip, and the threshold is computed in floating. For AE-based intrusion detection, $V_{th}$ is used as the reference or threshold voltage in the comparator circuit to find knowns/anomalies among the incoming packets. If the amount of V_ED − V_m > Vth, then the system identifies the incoming packet as an unknown and labels it as 1. Otherwise, the packet is labeled as known or 0. The comparator op-amp is biased with 1 and 0 voltage supply. Figure 12a is a comparator circuit to detect the incoming packets as normal or malicious. Figure 12b presents the intrusion detection accuracy, sensitivity, and precision of memristor-based AE-1, while the baseline software accuracy is 95.86% and 93.54%, respectively, for known and unknown network packets. AEs outperform supervised models in zero-day attack identification using anomaly-based intrusion detection, as discussed in our previous work [21].

9.3. Online-Training Analysis

The training process of AE-2 (Figure 7a) operates in real time without relying on a floating-point processor. Various test datasets, including subsets of the NSL-KDD dataset, were used for online-learning experiments. For instance, in Set-1, Normal and Probe packets were sent to the system, and AE-2 was instructed to learn only the Probe packets since AE-1 identified them as potential threats. Online training of AE-2 is illustrated in Figure 13a.

When new malicious packets, such as those in Set-2, breached the rule-based IDS, AE-1 flagged and routed them to AE-2 for further learning. AE-2 identified these zero-day attacks by flagging the unknown packets, leading to a temporary increase in anomalous packets and training errors (Figure 13a). However, with subsequent learning cycles, the system adapted, reducing anomalies and training errors as the packets became familiar. Pretraining of AE-1 (Figure 7a) was performed on-chip, with the threshold Vth computed in floating point for reference in AE-based intrusion detection.

Figure 13b illustrates network packet detection at different stages of the intrusion and anomaly-detection system. While incoming packets are unlabeled, labels 0 (True Normal) and 1 (True Malicious) are used to assess detection accuracy. Pretrained AE-1, recognizing only normal packets, achieves over 93.5% accuracy in distinguishing normal (PN) and malicious (PM) packets, with the threshold marked by the red line. The lower part of Figure 13b shows AE-2’s online anomaly detection, where its threshold is computed in real time using analog–digital hybrid CMOS circuits (Figure 9 and Figure 10).

The online threshold is updated after each learning cycle, with the system storing the Euclidean distance as a digital equivalent in a LUT. While neural-network computations occur entirely in the analog domain (Figure 6), an ADC is used solely for converting the AE’s generative error to compute thresholds. Training is online, learning sequentially from individual samples without batch processing. Figure 14a compares the floating-point threshold with that obtained using ADCs of various bit widths.

Figure 14b illustrates AE-2’s online incremental learning and real-time anomaly detection. Initially, AE-2’s parameters are random, and Testset-1 (containing normal and Probe packets) is processed. AE-1 identifies and forwards malicious packets to AE-2 for learning. At first, anomalies exceed 500, as AE-2 lacks knowledge of Probe packets. Over time, AE-2 learns, increasing known packets and reducing anomalies. At learning cycle 20, DoS packets cause a spike in anomalies, but subsequent cycles show adaptation, with anomalies decreasing as AE-2 becomes familiar. This iterative process enables the system to continuously learn and detect new malicious packets.

During online learning, AE-1 and AE-2 detect intrusions and anomalies, with detection accuracy shown in Figure 15a. AE-1’s accuracy remains steady until new intrusions occur, while AE-2 starts at zero and improves over training cycles. At cycle 19, AE-1’s accuracy rises slightly as it identifies unknown attacks, while AE-2’s accuracy drops temporarily due to new anomalies. Over time, AE-2 adapts, and accuracy stabilizes until further anomalies appear.

The ADC resolution significantly impacts threshold computation in anomaly-detection systems. While Figure 14a shows minimal difference in anomaly-detection performance between floating-point and low-precision threshold computation, Figure 15b highlights a noticeable accuracy drop with a 5-bit ADC. However, using a 6-bit or 7-bit ADC provides a balanced trade-off, making them suitable options for developing online-learning and anomaly-detection systems in edge security applications.

Memristor-based analog computing systems are often affected by device variability and circuit noise from analog sources. Figure 16 demonstrates the system’s performance under varying levels of noise, showing a clear decline in accuracy as noise increases. The random noise in the system is scaled relative to the minimum conductivity, highlighting the impact of analog noise on system reliability.

9.4. System Energy, Power, and Performance Analysis

The anomaly-detection system was benchmarked against a low-power commercial edge processor, the ASUS Tinker Board, which features a Rockchip AI processor (RK3288), ARM Mali-T764 GPU, and 2 GB DDR3 RAM [48]. Using 2000 NSL-KDD packets, the Tinker Board required 1.8 s for detection, whereas the memristor-based system completed the task in just 0.0023 s—three orders of magnitude faster. The memristor system demonstrated 184,000× higher energy efficiency, achieving 16.1 GOPS and 783 GOPS/W, compared to the Tinker Board’s 20 MOPS and 4.12 MOPS/W.

Table 3. Hardware performance analysis.

Parameters	Tinker Board	Memristor System
Test sample	2000	2000
Time (sec)	1.807563	2.3 × 10−3
Time/sample	9.04 × 10−4	1.17 × 10−6
Speedup	1	774
Energy (joule)	4.52 × 10−3	2.08 × 10−7
Power (W)	5	0.0205
Performance (OPS)	20 × 106	16.1 × 109
Energy efficiency (OPS/W)	4.12 × 106	7.83 × 1011
Area (mm2)	---	4.43 × 10−3
Test sample	2000	2000

compares numerical results for both systems. Other NSL-KDD dataset-based systems using floating-point processors and machine-learning algorithms typically achieve a performance ranging from kilo to mega operations per second [49,50,51].

Figure 17a,b provide a breakdown of chip area and energy consumption for anomaly-detection operations. During forward propagation, crossbar arrays and op-amps occupy the largest portion of the chip area (60%) if only one autoencoder is used. When two autoencoders are stacked, they occupy less area, allowing ADCs, DACs, and LUTs to take up 16%, and other digital circuits, including weight update and control units, to occupy 27%. Implementing ADC/DAC modules beneath the autoencoder circuits can significantly reduce chip footprint.

Energy analysis shows that threshold-computing circuits account for 62% of energy usage during forward propagation. Differential and squaring circuits consume 20.2 nJ (0.493 nJ per circuit), while ADC/DAC modules, which are only used for reconstruction error and error gradient conversion, consume minimal energy. This energy-efficient design highlights the advantages of the memristor-based system over conventional processors.

10. Conclusions

In conclusion, a memristor-based on-chip system has been developed for online anomaly detection in edge devices, showcasing its potential for energy-efficient and real-time network security applications. The system integrates analog training circuits for unsupervised neural networks with a Euclidean distance computation unit for reconstruction error calculations, enabling effective detection of zero-day attacks. Compared to commercially available edge devices, this system offers significantly lower energy consumption while achieving impressive performance metrics of 16.1 GOPS and 783 GOPS/W, consuming just 20.5 mW during anomaly detection. These results highlight the system’s viability for scalable and efficient edge security solutions.

In our future work, we plan to implement this system in physical hardware and conduct extensive experiments with various edge devices. Additionally, we aim to perform a detailed experimental analysis of the proposed system to further validate its performance and feasibility.