# SERA-IDS

In network intrusion detection, small language models reading raw numerical flow records often cannot separate traffic classes. SERA-IDS has an 8B model analyze only misclassified flows and turn each confusion into a structured rule carrying a behavioral description, feature conditions, class-confusion information, tool-derived confidence and provenance, admitted through a confidence gate into an experience library. At test time the library is frozen; up to five class-diverse rules are retrieved and condition-matched, lifting macro F1 from 1.94%–11.66% to 69.50%–87.66% for Llama 3.1, Phi-4:14B and Qwen2.5:7B on NF-BoT-IoT and NF-ToN-IoT, with no fine-tuning and no paid hosted inference.

In network intrusion detection, small language models reading raw numerical flow records often cannot separate traffic classes. SERA-IDS has an 8B model analyze only misclassified flows and turn each confusion into a structured rule carrying a behavioral description, feature conditions, class-confusion information, tool-derived confidence and provenance, admitted through a confidence gate into an experience library. At test time the library is frozen; up to five class-diverse rules are retrieved and condition-matched, lifting macro F1 from 1.94%–11.66% to 69.50%–87.66% for Llama 3.1, Phi-4:14B and Qwen2.5:7B on NF-BoT-IoT and NF-ToN-IoT, with no fine-tuning and no paid hosted inference.