DeepWeave neuro-symbolic NIDS improves low-data detection and provides explanations
Original title: DeepWeave: Weaving Neural and Symbolic Evidence for ML-Based Network Intrusion Detection System
DeepWeave combines neural predictions with interpretable rules for robust, label-efficient NIDS.
DeepWeave is a probabilistic neuro-symbolic Network Intrusion Detection System that automatically constructs interpretable rules and reconciles neural and symbolic evidence through explicit coupling policies. It improves low-data detection, false-positive control, transferability, and robustness across datasets while providing intrinsic explanations for alerts. The method supports packet-, flow-, and hybrid-views and keeps probabilistic reasoning practical via batched inference.
- Macro-F1 rises from 0.632 to 0.924 with 50 labelled packet observations per class
- Attack false-positive rate drops from 0.075 to 0.008
- Proofs are more stable than post-hoc neural attributions
- Applicable to multiple datasets for adaptable NIDS
From the original article
1 min read at arxiv.orgMachine learning-based network intrusion detection systems can recognize complex traffic patterns, but often require substantial labelled attack data, degrade under deployment shift, and provide limited evidence for analysts. We present DeepWeave, a probabilistic neuro-symbolic Network Intrusion Detection System (NIDS) that makes logic an integral part of detection.
By Raoul Saad · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.