# Intrusion Detection

On the corrected CIC-IDS2017 dataset, when labels and confidences from four heterogeneous detectors are corrupted under a threat model, unverified open-weight LLM investigators fall to 0.50–0.72 accuracy with one corrupted detector and to 0.13 or less with three. Conflict-Aware Evidence Verification (CAV) keeps reported confidences out of the vote and, only when tools conflict, tests the leading candidates with a nearest-neighbour trust score computed from raw traffic features. With its prompt frozen before testing, CAV-LLM reaches 0.84–0.88 under three corrupted detectors in both persistent and sporadic scopes, against at most 0.08 for the naive investigator, while calling the LLM on 0.4% of clean traffic.

On the corrected CIC-IDS2017 dataset, when labels and confidences from four heterogeneous detectors are corrupted under a threat model, unverified open-weight LLM investigators fall to 0.50–0.72 accuracy with one corrupted detector and to 0.13 or less with three. Conflict-Aware Evidence Verification (CAV) keeps reported confidences out of the vote and, only when tools conflict, tests the leading candidates with a nearest-neighbour trust score computed from raw traffic features. With its prompt frozen before testing, CAV-LLM reaches 0.84–0.88 under three corrupted detectors in both persistent and sporadic scopes, against at most 0.08 for the naive investigator, while calling the LLM on 0.4% of clean traffic.

DeepWeave places interpretable logic rules and neural predictions inside one probabilistic reasoning program, so the two act as potentially conflicting evidence for each alert. Machine-learning intrusion detection previously needed large labeled attack sets, degraded under deployment shift, and offered analysts little to inspect. With only a few labeled packet observations per attack class, the Anchored DeepWeave variant raises macro-F1 by up to 34.5% over the matched neural baseline and lowers the attack false-positive rate from 0.075 to 0.001.

DeepWeave places interpretable logic rules and neural predictions inside one probabilistic reasoning program, so the two act as potentially conflicting evidence for each alert. Machine-learning intrusion detection previously needed large labeled attack sets, degraded under deployment shift, and offered analysts little to inspect. With only a few labeled packet observations per attack class, the Anchored DeepWeave variant raises macro-F1 by up to 34.5% over the matched neural baseline and lowers the attack false-positive rate from 0.075 to 0.001.

Intrusion alerts no longer trigger remediation on a single model's word: independent notary agents re-check each verdict and co-sign it on a Hyperledger Fabric ledger only after a 2-of-3 quorum. On the class-balanced CICIDS2017 test set the calibrated ensemble reaches 96.60% accuracy over all decisions, and the certified subset reaches 99.65% accuracy at a 0.04% false-positive rate with 87.3% coverage; on the independently generated GeNIS 2025 corpus the same stack certifies 99.86% of flows at 99.98% accuracy.

Intrusion alerts no longer trigger remediation on a single model's word: independent notary agents re-check each verdict and co-sign it on a Hyperledger Fabric ledger only after a 2-of-3 quorum. On the class-balanced CICIDS2017 test set the calibrated ensemble reaches 96.60% accuracy over all decisions, and the certified subset reaches 99.65% accuracy at a 0.04% false-positive rate with 87.3% coverage; on the independently generated GeNIS 2025 corpus the same stack certifies 99.86% of flows at 99.98% accuracy.

Quantum-inspired intrusion detectors are often shown through a single high score, leaving open whether that conclusion survives a different split, preprocessing pipeline or deployment budget. Q-IDS Bench evaluates nine quantum-inspired configurations on five network and IoT datasets under one leakage-aware protocol with five random seeds, all on classical hardware. Best weighted F1 ranges from 98.86% to 99.95%, but the leading architecture changes with the dataset, and only about 1.13 percentage points separate the first- and ninth-ranked configurations by five-dataset mean.

Quantum-inspired intrusion detectors are often shown through a single high score, leaving open whether that conclusion survives a different split, preprocessing pipeline or deployment budget. Q-IDS Bench evaluates nine quantum-inspired configurations on five network and IoT datasets under one leakage-aware protocol with five random seeds, all on classical hardware. Best weighted F1 ranges from 98.86% to 99.95%, but the leading architecture changes with the dataset, and only about 1.13 percentage points separate the first- and ninth-ranked configurations by five-dataset mean.

Oilfield sites split each local-traffic update into secret shares so two non-colluding servers learn only accept or reject, holding macro-F1 at 0.641 against a 30% adaptive attacker where FedAvg falls to 0.046.

Oilfield sites split each local-traffic update into secret shares so two non-colluding servers learn only accept or reject, holding macro-F1 at 0.641 against a 30% adaptive attacker where FedAvg falls to 0.046.

A hybrid intrusion-detection framework that chains causal graph learning, entropy-guided compression, attention fusion, adversarial calibration and trust-weighted federated aggregation into one pipeline reaches 97.4% detection accuracy on CICIDS2017 while cutting the input from 78 features to 18.

A hybrid intrusion-detection framework that chains causal graph learning, entropy-guided compression, attention fusion, adversarial calibration and trust-weighted federated aggregation into one pipeline reaches 97.4% detection accuracy on CICIDS2017 while cutting the input from 78 features to 18.

Misclassifications from power-grid intrusion detection are converted into generator-level cyber-physical risk costs that enter dispatch optimization, instead of optimizing detection F1 alone. Previously detection and dispatch were optimized separately, so the operational cost of detection errors never entered the decision objective. On the ICS and Sherlock grid datasets, after a grid search over false-positive, false-negative and risk-scaling parameters, some configurations produced lower minimum dispatch costs than their baselines, with the size of the improvement varying by dataset and configuration.

Misclassifications from power-grid intrusion detection are converted into generator-level cyber-physical risk costs that enter dispatch optimization, instead of optimizing detection F1 alone. Previously detection and dispatch were optimized separately, so the operational cost of detection errors never entered the decision objective. On the ICS and Sherlock grid datasets, after a grid search over false-positive, false-negative and risk-scaling parameters, some configurations produced lower minimum dispatch costs than their baselines, with the size of the improvement varying by dataset and configuration.

In network intrusion detection, small language models reading raw numerical flow records often cannot separate traffic classes. SERA-IDS has an 8B model analyze only misclassified flows and turn each confusion into a structured rule carrying a behavioral description, feature conditions, class-confusion information, tool-derived confidence and provenance, admitted through a confidence gate into an experience library. At test time the library is frozen; up to five class-diverse rules are retrieved and condition-matched, lifting macro F1 from 1.94%–11.66% to 69.50%–87.66% for Llama 3.1, Phi-4:14B and Qwen2.5:7B on NF-BoT-IoT and NF-ToN-IoT, with no fine-tuning and no paid hosted inference.

In network intrusion detection, small language models reading raw numerical flow records often cannot separate traffic classes. SERA-IDS has an 8B model analyze only misclassified flows and turn each confusion into a structured rule carrying a behavioral description, feature conditions, class-confusion information, tool-derived confidence and provenance, admitted through a confidence gate into an experience library. At test time the library is frozen; up to five class-diverse rules are retrieved and condition-matched, lifting macro F1 from 1.94%–11.66% to 69.50%–87.66% for Llama 3.1, Phi-4:14B and Qwen2.5:7B on NF-BoT-IoT and NF-ToN-IoT, with no fine-tuning and no paid hosted inference.

The authors formalize Distributed Collective Reconnaissance (DCR), where each identity stays valid and low-rate while the population collectively acquires system knowledge under hidden coordination, and build SwarmReconGuard, a Docker-isolated reproducible benchmark observing only service-boundary telemetry; across 11 behaviors, 10–10,000 virtual identities, 440 runs and 3,666,300 requests they compare semantic, Gaussian, conditional, graph, kernel, hybrid and CUSUM detectors, finding Gaussian likelihood-ratio detection reaches 100% detection with 0% observed false positives on known attacks but only 3% on unseen policies, CUSUM reaches 36.1% overall detection, and hybrid CUSUM reaches 85.7% at 10,000 identities.

The authors formalize Distributed Collective Reconnaissance (DCR), where each identity stays valid and low-rate while the population collectively acquires system knowledge under hidden coordination, and build SwarmReconGuard, a Docker-isolated reproducible benchmark observing only service-boundary telemetry; across 11 behaviors, 10–10,000 virtual identities, 440 runs and 3,666,300 requests they compare semantic, Gaussian, conditional, graph, kernel, hybrid and CUSUM detectors, finding Gaussian likelihood-ratio detection reaches 100% detection with 0% observed false positives on known attacks but only 3% on unseen policies, CUSUM reaches 36.1% overall detection, and hybrid CUSUM reaches 85.7% at 10,000 identities.

The paper presents CyTReX, an explainable threat reasoning framework for distributed energy resource (DER) networks that consolidates edge anomaly detection evidence, cloud attack interpretation, SHAP feature attributions, surrogate decision rules, and MCP-enabled cyber threat intelligence into a unified evidence packet that constrains large language model reasoning to produce ranked threat hypotheses and attack trees; across five configurations on a DNP3 case study, adding reasoning components improved hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.

The paper presents CyTReX, an explainable threat reasoning framework for distributed energy resource (DER) networks that consolidates edge anomaly detection evidence, cloud attack interpretation, SHAP feature attributions, surrogate decision rules, and MCP-enabled cyber threat intelligence into a unified evidence packet that constrains large language model reasoning to produce ranked threat hypotheses and attack trees; across five configurations on a DNP3 case study, adding reasoning components improved hypothesis specificity, evidence traceability, and analytical grounding, with the complete pipeline providing the richest evidence-grounded reasoning context.