Intrusion detection weaves logic rules into the neural net: a few labeled packets per attack class cut false alarms from 0.075 to 0.001
DeepWeave places interpretable logic rules and neural predictions inside one probabilistic reasoning program, so the two act as potentially conflicting evidence for each alert. Machine-learning intrusion detection previously needed large labeled attack sets, degraded under deployment shift, and offered analysts little to inspect. With only a few labeled packet observations per attack class, the Anchored DeepWeave variant raises macro-F1 by up to 34.5% over the matched neural baseline and lowers the attack false-positive rate from 0.075 to 0.001.