Idsforge learns clear rules to spot unusual network traffic fast
IDSForge: Self-Explaining Network Intrusion Detection Through Neural Behavioral Rule Learning
Cryptography and Security
Summary
Network intrusion detectors often struggle to explain why they flag traffic as suspicious, making alerts hard to trust. The authors present IDSForge, a system that learns clear behavioral rules from normal traffic and uses them to detect anomalies. Because these rules are explicit, the alerts are easier to understand and check. IDSForge also updates itself to keep up with changing network conditions and works efficiently at high speeds.
What this means in practice
- •For network security teams: Deploy IDSForge to detect unknown network attacks with transparent alerts that explain why traffic is flagged.
- •For security software developers: Integrate IDSForge’s rule sets into existing network intrusion detection engines for low-overhead, interpretable anomaly detection at scale.
Authors
Hao Fu, Jinxia Wei, Wan Wei, Chun Long, Degang Sun, Peng Gao
Abstract
Anomaly-based network intrusion detection systems (NIDS) can detect previously unseen attacks by identifying deviations from benign traffic. However, deep learning-based anomaly detectors typically rely on implicit decision boundaries, and post-hoc explanations may not faithfully reflect the detection logic. This makes alerts difficult to interpret and audit. To address this issue, we present IDSForge, an anomaly-based NIDS that directly learns explicit, executable behavioral rules from benign traffic, making its detection logic interpretable by design. IDSForge uses the same rule set for detection and explanation, ensuring explanation fidelity by construction. It uses an explicit distributional autoencoder trained only on benign samples to learn axis-aligned regions of benign traffic. A high-speed rule compiler then consolidates these instance-specific regions into a compact set of feature-level interval constraints. These rules can be executed directly by popular NIDS engines, supporting high-throughput inspection with low overhead. To adapt to changes in traffic, a self-distillation co-evolver updates the model and rule set incrementally when the false-positive rate on analyst-verified traffic exceeds a target threshold. Our evaluation shows that IDSForge reduces F1 error by $5.7\times$ to $47\times$ relative to state-of-the-art anomaly-based baselines. Deployed in Suricata, IDSForge sustains a throughput of 7.8 Gbps with a median per-packet latency overhead of 3.1 $μ\text{s}$.