Intrusion detection weaves logic rules into the neural net: a few labeled packets per attack class cut false alarms from 0.075 to 0.001
Synopsis
DeepWeave places interpretable logic rules and neural predictions inside one probabilistic reasoning program, so the two act as potentially conflicting evidence for each alert. Machine-learning intrusion detection previously needed large labeled attack sets, degraded under deployment shift, and offered analysts little to inspect. With only a few labeled packet observations per attack class, the Anchored DeepWeave variant raises macro-F1 by up to 34.5% over the matched neural baseline and lowers the attack false-positive rate from 0.075 to 0.001.
Interpretation
An intrusion detector can now treat symbolic rules and neural predictions as two independent evidence sources and combine them into one verdict inside a probabilistic logic program, rather than using rules only for post-hoc explanation or preprocessing. Earlier neuro-symbolic intrusion-detection explorations covered only a limited scope of symbolic knowledge and reasoning, offering neither a systematic rule construction and validation procedure nor a principled way to resolve conflicts between neural and symbolic evidence. In the packet view with only a few labeled packets per attack class, Anchored coupling improves macro-F1 by up to 34.5% over the neural baseline sharing the same classifier and reduces the attack false-positive rate from 0.075 to 0.001.
Rules are not a hand-written signature base; they are mined from labeled traffic, filtered on separate validation traffic, and assigned roles that determine how far each rule may sway the verdict. Signature engines need expert-authored and maintained rules whose environment-specific assumptions produce false positives or miss unseen variants, while purely learned models bury attack knowledge implicitly in their parameters. Rule proposal and validation use disjoint traffic partitions that belong to neither the training nor the test set; across five CIC-IDS2017 training replicates, DeepWeave selects the same winning rule for a larger share of observations than Integrated Gradients or SHAP select the same top feature.
Every alert carries a proof path listing the satisfied predicates, rules and their roles, so the explanation comes from the inference itself rather than from post-hoc attribution. Post-hoc explanation methods associate influential features after inference and may not correspond to the reasoning process that produced the decision. In a deletion-based fidelity evaluation, removing the complete DeepWeave explanation leaves less probability on the original predicted class than removing the top-ranked Integrated Gradients or SHAP feature, and its explanations contain fewer conditions on average.
Perspective
The evaluation covers the CIC-IDS2017 flow view, the NF-CSE-CIC-IDS2018-v3 packet and hybrid views, and transfer from an enterprise network to the NF-ToN-IoT-v3 IoT environment; adversarial experiments modify flow features directly on CIC-IDS2017 under the attacker capabilities modeled in PANTS. These results establish DeepWeave's behavior in the evaluated environments, not universal superiority in operational networks.
The label-efficiency results assume limited current labels supplemented by historical symbolic knowledge rather than equal information budgets for rule discovery and neural training; proofs are faithful to inference but have not been shown to improve analyst decisions or reduce investigation effort; inference includes grounding, predicate evaluation and symbolic solving, so it is slower than optimized ML classifiers and line-rate deployment may require parallelization or lightweight screening.