IDSForge learns explicit rules that cut F1 error 5.7-47× versus prior anomaly NIDS

The five-minute version

IDSForge cuts the F1 error of prior anomaly-based NIDS by 5.7×-47×, achieving at least 98.79% F1 on six public datasets and running at 7.8 Gbps with only 3.1 μs per-packet latency. It does this by training an explicit distributional autoencoder that maps each benign flow to an axis-aligned hyper-rectangle, compiling those rectangles into native Suricata rules, and updating them via a self-distillation co-evolver when false-positive rates rise. The evaluation compares against two supervised and seven anomaly-based baselines and shows IDSForge matches or exceeds their detection performance while providing faithful, rule-based explanations. Evidence comes from the paper’s reported tables and performance numbers; no contradictory results are presented.

What they found 1

• Sustains 7.8 Gbps throughput with 3.1 μs median per-packet latency in Suricata

  “Deployed in Suricata, IDSForge sustains a throughput of 7.8 Gbps with a median per-packet latency overhead of 3.1 μs.”

Stated limits 1

• We will also harden the co-evolver against manipulated false-positive feedback, which currently relies on trusted operator triage.

What’s new here 4

• Learns explicit, executable behavioral rules directly from benign traffic instead of post-hoc extracting them.
• Introduces an explicit distributional autoencoder that outputs per-feature interval bounds for each flow.
• Provides a lossless high-speed rule compiler with Boolean minimization and R*-tree indexing for sub-linear matching.
• Implements a self-distillation co-evolver that updates model and rules without storing historic traffic.

Artifacts & methods 5

• Explicit Distributional Autoencoder (EDAE)system
• High-speed rule compilersystem
• Self-distillation co-evolversystem
• Suricata deploymentsystem
• CIC-IDS2017, CSE-CIC-IDS2018, CIC-UNSW-NB15, TON-IoT, Kitsune, CICIoT2023 datasetsdataset

Topics