Small models stop guessing at traffic: misclassifications become rules with numeric conditions, lifting macro F1 from single digits to the mid-80s

When a small language model classifies network traffic, it no longer relies only on its own parameters to guess decision boundaries over numerical features; it pulls rules with explicit numerical conditions from an external experience library and uses them as evidence. The earlier approach handed the model free-form textual experience, leaving it to infer the numerical conditions that separate traffic classes; the MA-IDS comparison configuration is exactly free-form experience with single-rule retrieval. On NF-BoT-IoT, macro F1 for Llama 3.1, Phi-4:14B and Qwen2.5:7B rises from zero-shot 11.66%, 9.26% and 7.83% to 86.46%, 69.50% and 83.51%; on NF-ToN-IoT it rises from 3.82%, 6.17% and 1.94% to 84.16%, 87.66% and 83.37%, with the decision model held fixed in every comparison.

The experience library is built only from misclassified flows during training, and correctly classified flows generate no rules. A Llama 3.1 classifier runs over training flows, and only for misclassified samples does an error analysis agent convert the observed confusion into a candidate rule. At the end of construction the active library held 7,326 rules for NF-BoT-IoT with 56 lower-confidence candidates queued for review, and 10,664 rules for NF-ToN-IoT with 3,043 queued; rule-generation rates generally declined in later construction stages.

At inference the library stays frozen, and each held-out flow is first semantically retrieved against, then its retrieved rules are checked condition by condition. Retrieval takes a nearest-neighbor candidate pool, keeps the highest-similarity rule per class, and selects the classes with the highest best-rule similarity to form a class-diverse set of at most five rules. Rule descriptors and query flows are embedded with all-MiniLM-L6-v2 while raw numerical and categorical values are preserved for condition verification; condition evidence serves as contextual support rather than a deterministic vote, and the selected small model still produces the final class.

Evaluation is confined to the NF-BoT-IoT-v3 and NF-ToN-IoT-v3 NetFlow datasets, with five-class and ten-class tasks respectively, and rare classes retained. The decision models are three locally deployable open-weight small models in the 7B to 14B parameter range, all experiments run on a single NVIDIA T4 GPU at temperature zero with no parameter fine-tuning. The experience library is built by Llama 3.1 and then frozen, and test labels are used only to compute metrics. Latency is end-to-end local inference time per flow, not line-rate intrusion-detection throughput, so the setting suits analysis of flows pre-filtered by a lightweight detector. Future work will explore component ablations, unseen attacks and library robustness.

Relative to MA-IDS, SERA-IDS lowers macro precision for Llama 3.1 and Qwen2.5 by 1.12 to 6.62 points while raising their macro recall by 17.22 to 34.87 points; the authors attribute this trade-off to five class-diverse rules exposing the model to more candidate classes, but do not separate retrieval width from rule representation. Phi-4 reaches the highest macro F1 of 87.66% on NF-ToN-IoT yet the lowest on NF-BoT-IoT, and takes 3.05 to 3.45 seconds per flow, about an order of magnitude slower than the other two. The external signals behind admission confidence come from an offline synthetic testbed rather than a live threat-intelligence feed. The 87.66% figure is obtained on a ten-class task, whereas the earlier GPT-4o result of 85.22% used nine classes.