IDSForge: Self-Explaining Network Intrusion Detection Through Neural Behavioral Rule Learning

Hao Fu, Jinxia Wei, Wan Wei, Chun Long, Degang Sun, Peng Gao

Oct 28, 2026arXiv:2610.38890v1

cs.CR

Scorecard· 16/16

6.5/10 impact

Neat, deployable detector-is-explanation design with real Suricata integration, but headline accuracy gains rest on a lenient evaluation protocol and untested adversarial robustness.

Abstract

Anomaly-based network intrusion detection systems (NIDS) can detect previously unseen attacks by identifying deviations from benign traffic. However, deep learning-based anomaly detectors typically rely on implicit decision boundaries, and post-hoc explanations may not faithfully reflect the detection logic. This makes alerts difficult to interpret and audit. To address this issue, we present IDSForge, an anomaly-based NIDS that directly learns explicit, executable behavioral rules from benign traffic, making its detection logic interpretable by design. IDSForge uses the same rule set for detection and explanation, ensuring explanation fidelity by construction. It uses an explicit distributional autoencoder trained only on benign samples to learn axis-aligned regions of benign traffic. A high-speed rule compiler then consolidates these instance-specific regions into a compact set of feature-level interval constraints. These rules can be executed directly by popular NIDS engines, supporting high-throughput inspection with low overhead. To adapt to changes in traffic, a self-distillation co-evolver updates the model and rule set incrementally when the false-positive rate on analyst-verified traffic exceeds a target threshold. Our evaluation shows that IDSForge reduces F1 error by $5.7\times$ to $47\times$ relative to state-of-the-art anomaly-based baselines. Deployed in Suricata, IDSForge sustains a throughput of 7.8 Gbps with a median per-packet latency overhead of 3.1 $μ\text{s}$ .

AI Impact Assessments

(1 model)

<reasoning>I need to assess this paper carefully, noting potential concerns.

Observations: the paper is IDSForge, an anomaly-based NIDS that learns hyper-rectangle rules from benign traffic. Claims F1 ≥98.79% on all six datasets, 5.7–47× error reduction. Suspicious points: test set is balanced benign/malicious, the split is 9:1 random flow-level (leakage on CIC-IDS2017 etc.), only 8 features used; per-server rules; the "w/o Compiler" ablation uses reconstruction error. Hyperparameters were tuned on the test set apparently (sensitivity default F1 peaks at 99.65 on the same CIC-IDS2017). The Sobol sampling shows F1 median 94.16%, below default, so sensitive to weights. Baselines' numbers look suspiciously uniform (Whisper ~90 across all datasets), possibly reproduced with different features. Evaluating "fidelity 100% by definition" is a tautology as the comparison is not comparable: the baselines explain an AE, IDSForge is its own detector. The faithfulness claim is by construction. The "explanation" of a flow as violated conditions of nearest rule – faithful but with thousands of rules (15,850 rules) the interpretability is questionable. Rules for 15,850 are not compact for human audit. Also the mismatch: attackers could mimic; the adversarial analysis is deferred. The "interpretable by design" claim is reasonable but rule count is large. Per-server IP rules: destination-server-specific; in datasets with attacker-victim setup... Also attacks targeting a server with training only on benign for that server; new servers have no rules. The continuous detection experiment compares against supervised baselines in a weird way (test attacks spanning the whole week while supervised trained only on early days).

The arXiv ID 2610.38890 date is odd, but ignore.

Theory: propositions are fairly straightforward (lossless reduction via Espresso, monotone updates). Corollary A.4 no forgetting at rule level is trivial, since merging only adds rules; the fine-tuning is irrelevant. Notably, the "no forgetting" is by union only, so region grows and may admit attacks.

Impact: Moderate-good; systems-security venue (WWW-style). Practical Suricata integration is a plus. Novelty: moderate; combines known elements (box embeddings/interval, Espresso, R*-tree, generative replay). Rule learned from neural net is neat.

Scores: overall ~6.5. Significance 6, rigor 5, novelty 6.5, clarity 7.5. Difficulty 6. Surprisingness 4.5. Reproducibility 5.5 (no code mentioned; hyperparameters given). Translational 6.5. Evidence 5. Generalisability 4.5. Interdisciplinarity 3.5. Refutation 3 (challenges post-hoc explanation approaches; claims anomaly baselines are weak). Replication 1.5. Resource 3. Foundationality 4.</reasoning># Impact Assessment: IDSForge

1. Core Contribution

IDSForge is an anomaly-based NIDS in which the neural model outputs an explicit benign boundary rather than an anomaly score. The detector and its explanation are therefore the same artifact: executable interval rules.

EDAE. An "explicit distributional autoencoder" has a latent space isomorphic to the input. Each flow maps to per-feature bounds [l, u] plus a feature mask. Latents are sampled uniformly inside the box via a Φ(ε) reparameterization. Training uses five losses: reconstruction, a uniform-prior KL (a log-width term), a smoothed density loss, an interval loss, and an entropy loss.

Rule compiler. Per-flow boxes are grouped by destination server IP. The union is losslessly minimized by casting orthogonal decomposition as Espresso two-level Boolean minimization. Rules are indexed with an R*-tree and templated into Suricata pass/alert rules (Lua).

Self-distillation co-evolver. Rules are inverted into boxes and decoded into synthetic benign flows. EDAE is fine-tuned on these plus operator-confirmed false positives, then the rules are regenerated and merged.

The main idea is "learn the rule set directly, deploy it as the detector," which removes the fidelity gap of post-hoc surrogates. This is sensible and attractive for operational security. Each ingredient (box/interval embeddings, Espresso, R*-trees, generative replay) is known. The novelty lies in the integration and in the Boolean-minimization step, which connects a neural model to line-rate engines.

2. Methodological Rigor

Strengths

Evaluation covers six datasets and nine detectors, plus a post-hoc explainer comparison, an ablation, a sensitivity study, and a real Suricata deployment with throughput and latency numbers.

Proofs are correct and appropriately scoped. Lossless reduction follows from the cell decomposition. The certified margin is a simple L∞ argument.

Concerns

Weak evaluation protocol. Random 9:1 flow-level splits on CIC-IDS2017, CSE-CIC-IDS2018 and similar datasets are known to inflate results through temporal leakage and near-duplicate flows. The test set is artificially balanced. Only 8 hand-extracted features are used, and the paper does not say how baselines were re-run under that regime.

Suspicious baseline numbers. Baselines such as Whisper, HyperVision and Diff-RF are near-uniform across very different datasets, which suggests reimplementation rather than faithful reproduction. The 5.7–47× error reduction headline depends on this.

Hyperparameters tuned on the evaluation data. Default weights give the peak F1 of 99.65% on CIC-IDS2017, the same set used for ablations. The Sobol sweep gives a median F1 of 94.16%, so performance is sensitive to the five loss weights. The paper does not discuss how they would be set in a new deployment.

Tautological fidelity comparison. "100% fidelity by definition" is true but not a comparison. The baselines explain a different detector, the AE, so Table 3 mixes detection quality with explanation. The real question is whether 15,850 rules for one dataset are auditable. The paper claims auditability but offers no human study, rule-count-per-alert analysis, or comparison of rule complexity.

Weakest corollary. "No forgetting" (Cor. A.4) is trivially true because the update only unions rules. It says nothing about whether fine-tuning remains stable, and it bounds growth only by volume. Attack-admission risk after poisoned or noisy false-positive feedback is not evaluated.

Unfair continuous-detection comparison. Supervised baselines trained on early days are tested on attacks from later days. This is expected to fail, so the comparison is somewhat strawman.

No adversarial evaluation. This is deferred to future work, although the paper touts the certified margin.

Design limits. Per-server rules require benign history for each destination IP and assume stable per-server behavior. Axis-aligned boxes may need many rules for correlated features, which the authors acknowledge.

No statistical variance. No repeated runs or error bars are reported.

3. Potential Impact

Practical value. The compile-to-Suricata path (7.8 Gbps, 3.1 µs median latency, 42 MB, 0.8 s compilation for 15,850 rules) is a practical differentiator. It makes learned anomaly detection deployable on existing infrastructure without a GPU in the data path.

Editable detector. Editable, auditable rules that operators can disable or extend address a real trust barrier.

Likely uptake. Security venues will probably cite it alongside rule-extraction work (Trustee, SCD-Tree, Genos, Helios). It could inspire "learn executable rules directly" approaches elsewhere, such as in-network switch deployment and log anomaly detection.

Caveat. Real-world impact depends on whether the headline accuracy survives realistic splits and richer features.

4. Timeliness & Relevance

Interpretability and trust in ML-based NIDS, drift handling, and line-rate deployment are active bottlenecks. The Rudin-style "interpretable by design versus explain black boxes" framing is timely and well matched to the security community's complaints about post-hoc explainers. The work is directly responsive to recent CCS/NeurIPS rule-extraction papers.

5. Strengths & Limitations

Strengths

Clean conceptual unification of detection and explanation.

End-to-end system with real engine integration and performance numbers.

Lossless rule reduction with a proof.

Thorough ablation and sensitivity reporting.

Clear writing and figures, including a worked rule-to-Suricata example.

Limitations

Evaluation validity (random splits, balanced test sets, 8 features, possibly weak baseline reproductions). Near-99% F1 across all six datasets invites skepticism.

Weight sensitivity.

Unquantified rule-set size and human auditability.

No adversarial or poisoning evaluation, even though the update relies on trusted operator feedback.

The theory is straightforward and the "no forgetting" claim is trivial.

No code or data release is mentioned.

Overall

A solid, practically motivated systems-security paper with a neat design, but its headline numbers rest on a lenient protocol. Expect moderate-to-good impact in the NIDS/explainability community rather than field-changing influence.

Rating:6.5/ 10

Significance 6Rigor 5Novelty 6.5Clarity 7.5

Generated Oct 30, 2026

Comparison History (0)

No comparisons yet.

Scorecard· 16/16

6.5/10 impact

Neat, deployable detector-is-explanation design with real Suricata integration, but headline accuracy gains rest on a lenient evaluation protocol and untested adversarial robustness.