JEV-IDS speeds up network intrusion detection with better accuracy
Jev-IDS: System One Models for Network Intrusion Detection
Cryptography and SecurityArtificial Intelligence
Summary
Detecting harmful network attacks often needs large labeled datasets or slow, expensive AI models. The authors created JEV-IDS, a new system that works well even when few example attacks are known. It asks a model two simple questions about each network flow to quickly decide if it’s an attack and what type of traffic it is. Tests showed JEV-IDS is faster, cheaper, and more accurate on new attack detection than some other methods.
What this means in practice
- •For network security teams: Detect zero day network attacks efficiently under scarce labeled data conditions with reduced cost and faster decision-making.
- •For cybersecurity product developers: Incorporate a lightweight intrusion detection model for cost-effective deployment in security appliances or cloud services.$Commercial implications: This method enables commercial IDS products to offer faster, cheaper detection of unknown attacks leveraging SOM-based models.
Authors
Paulo Severo, Silvio E. Quincozes, Amanda Dias
Abstract
Machine-learning Network Intrusion Detection Systems (IDS) depend on substantial labeled datasets and task-specific training, whereas Large Language Models (LLMs) detection can analyze flow records directly but incurs higher inference cost and latency, with less constrained outputs. This paper presents JEV-IDS, an open experimental general NIDS based on the Jev System One Model (SOM) to detect zero day intrusions Under label scarcity. JEV-IDS serializes one flow per request and asks JEV two questions: a binary attack probability and a finite-choice traffic category. Our results show that, at k=1, JEV was 4.8 times faster and 3.8 times cheaper than GPT-5.6 Luna, with 1.5 times higher novel-attack recall; it also produced 15 times fewer false alarms than a low-data Random Forest. Across 5,400 decisions on a 300-flow NSL-KDD pilot split, JEV achieved F1-Score 0.859, precision 0.941, recall 0.790, and novel-attack recall 0.838. Increasing k to 2 reduced its F1-Score to 0.839.