DeepWeave: Weaving Neural and Symbolic Evidence for ML-Based Network Intrusion Detection System

D EEP W EAVE : W EAVING N EURAL AND S YMBOLIC E VIDENCE FOR ML- BASED N ETWORK I NTRUSION D ETECTION S YSTEM A P REPRINT

arXiv:2610.41541v1 [cs.CR] 30 Oct 2026

Raoul Saad

Enkeleda Bardhi

Andrea Agiollo

Fernando Kuipers

Delft University of Technology Van Mourik Broekmanweg 6, Delft, The Netherlands, 2628 XE raoul.e.saad@gmail.com, {E.Bardhi-1, A.Agiollo-1, F.A.Kuipers}@tudelft.nl

A BSTRACT Machine learning-based network intrusion detection systems can recognize complex traffic patterns, but often require substantial labelled attack data, degrade under deployment shift, and provide limited evidence for analysts. We present D EEP W EAVE, a probabilistic neuro-symbolic Network Intrusion Detection System (NIDS) that makes logic an integral part of detection. D EEP W EAVE automatically constructs and validates interpretable rules, represents neural predictions as probabilistic predicates, and reconciles both evidence sources through explicit coupling policies over packet, flow-, and hybrid-views. The resulting proofs provide intrinsic explanations for rule-supported alerts. Across multiple datasets, D EEP W EAVE improves low-data detection, false-positive control, transferability, and robustness. With only 50 labelled packet observations per attack class, it improves macro-F1 from 0.632 to 0.924 and reduces the attack false-positive rate from 0.075 to 0.008 over the matched neural baseline. Its proofs are also more stable than post-hoc neural attributions, while batched inference keeps probabilistic reasoning practical. These results demonstrate labelefficient, adaptable, and inspectable neuro-symbolic intrusion detection. Keywords Network intrusion detection · Neuro-symbolic AI · Probabilistic logic programming · Explainable Security · Automated rule generation

1

Introduction

Network Intrusion Detection Systems (NIDSs) are a fundamental component of defense architectures. By continuously inspecting packets, flows, or aggregated network events, a NIDS seeks to distinguish benign activity from traffic associated with malicious behaviour. Malicious events are rare, benign traffic is heterogeneous, while both traffic patterns and adversaries evolve. Moreover, sustained volumes of low-value alerts contribute to costly triage and alert fatigue [4, 54]. A practical NIDS must not only be accurate on a static benchmark, but rather control false alarms, remain useful under traffic shifts, and provide evidence that an analyst can inspect [56, 51, 57]. Existing NIDSs largely follow symbolic or machine learning (ML) paradigms [47, 39, 20, 14, 45, 6]. Signature-based engines such as Snort and Suricata match explicit conditions over payloads, protocol fields, and flow state [47, 41, 13]. Their rules are auditable and dependable for known behaviors, but authoring and maintaining them requires substantial expertise, and environment-specific assumptions can produce false positives or miss unseen attack variants [48, 30]. ML approaches instead infer decision boundaries from packet bytes, flow statistics, or temporal behavior and can capture patterns that are cumbersome to specify manually [1, 24, 57, 39, 5]. Yet, supervised models require labelled traffic that is costly and time-consuming to collect and annotate, particularly at the scale of operational networks [51, 61]. Moreover, learned models may rely on dataset-specific correlations and fail under distribution shift, changing benign traffic, or previously unseen attacks [51, 9]. Their limited transparency further complicates operational use since they provide little actionable evidence and post-hoc explanations fail to capture a meaningful rationale for the decision of the security analyst [57, 52]. Finally, because an adversary can manipulate observable traffic characteristics while preserving malicious functionality, the learned decision boundary itself becomes a target for evasion [22]. Thus, although

DeepWeave

A P REPRINT

ML provides flexibility and powerful pattern-recognition capabilities, its limited generalization, explainability, and adversarial robustness prevent ML-based NIDS from constituting a complete solution. To overcome such limitations, recent studies have begun to explore neuro-symbolic intrusion detection [8, 55]. Neurosymbolic approaches broadly integrate prior symbolic knowledge into neural learning by encoding logical constraints into the learning objective, compiling symbolic structure into neural architectures or coupling neural perception with discrete or probabilistic symbolic reasoning [36, 18]. Existing work provides an initial exploration of neuro-symbolic NIDS, but remains limited in the scope of the symbolic knowledge and reasoning considered, offering neither a systematic procedure for constructing and validating expressive security rules nor a principled mechanism for resolving conflicts between neural and symbolic evidence. This paper addresses these challenges through D EEP W EAVE, a probabilistic neuro-symbolic NIDS which treats the neural and symbolic components as distinct, potentially conflicting attack evidences. The neural component learns from packet-, flow-, or hybrid-level traffic and defines a neural predicate over benign and attack classes. In parallel, the symbolic component evaluates interpretable predicates over traffic features. D EEP W EAVE constructs candidate rules automatically, identifying class-relevant features on held-out traffic data, deriving candidate predicates, and calibrating their behavior on traffic data. Lastly, D EEP W EAVE combines neural and symbolic evidence through a coupling policy that may enforce strict agreement between neural and logic or favor either component. Relying on the neural symbolic weave, D EEP W EAVE requires fewer data to optimize, as the knowledge encoded in the symbolic rules is excluded from the neural training process. Additionally, D EEP W EAVE generalizes well even under network or – possibly adversarial – traffic changes, as the symbolic guidance enables D EEP W EAVE to ignore spurious signals coming from noisy data during learning. Lastly, making its coupling policy explicit and relying on intelligible symbolic rules, D EEP W EAVE exposes the supporting proof path for its predictions. These proofs identify the satisfied predicates and rules supporting an alert, providing an explanation that is intrinsic to the model’s inference rather than generated by a separate post-hoc explainer. This paper makes the following contributions: • We introduce D EEP W EAVE, a Neuro-Symbolic NIDS combining neural attack evidence with symbolic reasoning over packet, flow, and hybrid traffic views. • We design and develop a data-driven rule-construction pipeline that discovers and validate candidate rules without requiring any manual signature base. • We formalize coupling policies that govern agreement and conflict between neural and symbolic evidence and generate proof-based explanations. • We extensively evaluate D EEP W EAVE through predictive performance, false alerts, cross-distribution generalization, explainability, and robustness to adversarial traffic. The remainder of this paper is organized as follows. § 2 presents the paper motivation and the necessary background. § 3 describes D EEP W EAVE architecture, while § 4 details its implementation and § 5 elaborates on its evaluation. Lastly, § 6 discuss limitations and § 7 the related work, while § 8 concludes the paper.

2

Motivation and Background

2.1

Motivating Rationale

Learning with scarce attack labels. Operational NIDSs often deal with limited labelled attack traffic. Although benign observations may be abundant, representative labels for each attack family are expensive to obtain and attacks are rare. A practical NIDS must therefore learn from scarce attack labels. Fitting dataset-specific correlations, ML-based detectors may fail to learn less frequent attack manifestations and their performance improves only when additional labels become available. Anomaly-based ML detectors such as Kitsune [39] reduce dependence on labelled attack data but still require the collection of large amount of benign traffic data to be optimized. Meanwhile, symbolic detectors provide a complementary starting point as explicit conditions encoding attack-relevant properties require little data to be defined. However, their accuracy plateaus as more data become available, since they require substantial effort to be maintained. As Figure 1a illustrates, a neuro-symbolic detector can instead use symbolic knowledge as a structured prior in the low-data regime, while allowing its neural component to learn additional patterns as labelled evidence increases. Accuracy and explainability. Figure 1b illustrates a second limitation of state-of-the-art NIDSs. ML-based systems may achieve strong detection accuracy, but fail to provide a security rationale for their prediction. Post-hoc explainability methods can associate neural decisions with influential features [57], yet the explanation is generated 2

DeepWeave high

low-data regime

combines prior knowledge with learned evidence

A P REPRINT

high

Desired region Symbolic-only

Detection accuracy

Neuro-symbolic

Explainability

explicit reasoning, limited coverage

structured prior, limited coverage flexible but data-hungry

scarce

Neural-only

Neural-only Symbolic-only Neuro-symbolic

low

strong prediction, limited intrinsic explanation

low

moderate

Available labelled attack data

low

abundant

(a) Detection accuracy as the amount of labelled data increases.

high accuracy, intrinsic proof

Detection accuracy

high

(b) Trade-off between detection accuracy and explainability.

Figure 1: NeSy vs. ML-based and Symbolic NIDS.

after inference and may not correspond to an explicit reasoning process used to produce the decision. Conversely, symbolic systems expose the exact conditions that triggered an alert, but their detection accuracy is bounded by rule coverage. These limitations become more consequential when a detector moves from training to production. Changes in topology, services, benign traffic, measurement processes, or attacker behavior can invalidate correlations learned by the neural model and signatures assumed by symbolic rules. A neuro-symbolic detector can achieve high detection accuracy and intrinsic transparency, since the neural component provides flexible pattern recognition, while validated rules provide inspectable evidences of their decision. 2.2

Background

Network Intrusion Detection Systems. A NIDS monitors traffic at network observation points to detect malicious activity or security-policy violations [28, 31]. Signature-based NIDSs match traffic against explicit descriptions of known attacks, providing inspectable evidence but requiring continued rule maintenance and sufficient signature coverage [25, 29]. Anomaly-based NIDSs instead learn expected traffic behavior and identify deviations, potentially detecting previously unseen activity but also flagging benign changes and providing limited explanations [31, 2]. Both paradigms may operate on individual packets, aggregated flows, or packet–flow pairs. Packet representations preserve local protocol and header evidence, while flow representations summarize communication-level properties such as duration, volume, directionality, timing, and transport flags. Instead, hybrid representations combine the current packet with its evolving flow context. 2.2.0.1 Detection task We formulate intrusion detection as classification over a label set Y = {y1 , . . . , yK } containing one benign class and one or more attack classes. For a packet, flow, or packet–flow representation x ∈ X , a NIDS parameterized by θ estimates pθ (Y = y | x) and predicts ŷθ (x) = arg maxy∈Y pθ (Y = y | x). An alert is raised when ŷθ (x) belongs to an attack class. Neuro-Symbolic AI. Neuro-symbolic AI (NeSy) encompasses a broad family of architectures that combine the representation-learning capabilities of neural networks with explicit knowledge representation and symbolic inference. These architectures differ in how knowledge, learning, and reasoning interact [36]. Symbolic knowledge may be translated into differentiable constraints that regularize neural learning [60, 37], compiled into neural architectures that approximate logical operations [44], or represented in an explicit reasoning system whose predicates are partly evaluated by neural models [34, 59, 62]. D EEP W EAVE follows the last paradigm. Neural models map unstructured inputs to distributions over symbolic values, which subsequently participate in logical inference. For example, a neural component may recognize a digit in an image, while symbolic arithmetic rules determine how that digit contributes to the result of a computation. 2.2.0.2 DeepProbLog We instantiate D EEP W EAVE using DeepProbLog [34], a neuro-symbolic language that extends the probabilistic logic programming language ProbLog [12] with neural predicates. ProbLog represents uncertainty through probabilistic facts and annotated disjunctions and computes query probabilities over the possible worlds induced by these choices. DeepProbLog preserves this semantics while allowing selected probabilities to be produced by neural networks. Given an input x, a neural predicate produces a distribution over a finite set of symbolic outputs z1 , . . . , zK . These outputs represent concepts that participate in inference together with the program’s facts and rules. For example, the annotated disjunction nn(Nθ , x, Y) :: traffic class(x, Y ) uses Nθ to assign probabilities to the possible traffic classes of x. To answer a query, DeepProbLog grounds the relevant program, evaluates its neural predicates, and 3

DeepWeave

A P REPRINT

compiles the resulting proof structure into an arithmetic circuit [34]. The query probability aggregates all valid proofs, including those containing neural predictions and satisfied symbolic rules. During end-to-end training, gradients of the query-level loss propagate through probabilistic inference to the neural parameters, enabling learning without direct supervision of the intermediate concepts z1 , . . . , zK .

3

D EEP W EAVE

3.1

Overview

D EEP W EAVE architecture is depicted in Figure 2. D EEP W EAVE operates in an offline preparation phase and an online detection phase. During offline preparation, the system constructs candidate symbolic rules, calibrates their predicates using reference traffic, and trains the neural and coupling architecture parameters. The result is a detector containing a learned traffic model, a symbolic knowledge base, and the parameters governing their coupling. During online detection, D EEP W EAVE parses incoming traffic and transforms it into traffic view observations. For each observation, the system constructs two complementary sources of evidence: (i) a neural path which learns statistical patterns from the traffic representation, and (ii) a symbolic path which evaluates attack-oriented predicates and rules. A probabilistic neuro-symbolic reasoning layer combines these evidences to produce the final decision. Lastly, D EEP W EAVE returns both an alert and its symbolic proof path to support its decision whenever it detects a malicious. OFFLINE MODEL PREPARATION AND RULE CONSTRUCTION

Historical / Labelled Traffic

Neural Model Training

Symbolic Knowledge Construction Candidate feature discovery

Learned Artifacts

Predicate Calibration

Trained Neural Model

Candidate rule generation

... Packet, Flow, Hybrid models Learn model parameters

Validation and role (sufficient / helper /disqualifier)

Symbolic Knowledge

Estimate thresholds (e.g., benign quantiles) for selected predicates

ONLINE DETECTION Operating Mode

Outputs Packet Mode

Incoming Network Traffic

...

Packet Parsing

Flow Mode

Hybrid Mode

Neural Evidence Probabilistic Neuro-Symbolic Reasoning

Packet View

Header fields Protocol info Length, flags, TTL ...

Hybrid View (packet + flow)

5-tuple tracking State update Time ...

Flow View Packets <--> Bytes Rates <--> Directionality Timing <--> Counts ...

P(Y = c | x)

Proof-based explanation

For each class c ∈ Y Output PN(Y = c | x)

Symbolic Evidence Online Flow Assembly

Class distribution

Current packet + Current flow context

Combine neural predicates and symbolic rules for a coupling architecture

Benign (no alert)

Evaluate predicates Compute rule satisfaction Aggregate by class to obtain evidence

Attack (alert) Anchored

Guarded

Deferred

Predicted class Confidence Top proof paths / contributing rules

Coupling Architectures

Traffic Processing & State Management

Traffic Views

Neural Components

Symbolic Components

Neuro-Symbolic Reasoning

Online Data Flow Outputs

Offline Preparation Flow

Figure 2: D EEP W EAVE system overview. Incoming traffic is represented at the packet level, flow level, or jointly. Neural and symbolic paths derive complementary evidence from the selected representation. A probabilistic reasoning layer integrates this evidence to produce a class prediction and an accompanying symbolic explanation. Dashed arrows denote offline model preparation and rule construction; solid arrows denote online detection.

3.1.1

Traffic views

D EEP W EAVE supports packet, flow, and hybrid traffic views. Views vary in the available traffic context and symbolic knowledge, but share the same neuro-symbolic inference pipeline. The packet view enables immediate prediction, but may miss behaviors that emerge only across multiple packets or connections. The flow view aggregates packets from the same communication to capture temporal, directional, and rate-based behavior. The hybrid view jointly reasons over packets and their evolving flow context, allowing cross-view relationships to participate directly in inference rather than combining independent predictions. We provide the complete formulation of the traffic views representation in § 3.2.1.

4

DeepWeave

3.1.2

A P REPRINT

Neuro-Symbolic Detection

For each traffic observation, D EEP W EAVE derives neural and symbolic evidence in parallel. The neural component learns traffic features patterns to output the candidate class probability, while the symbolic component evaluates rulebased attack oriented conditions. These conditions – specified using rules – relate observable traffic properties to higher-level attack behavior. D EEP W EAVE defines its symbolic conditions automatically during offline model preparation, where it constructs candidate rules, removes uninformative or redundant ones, and calibrates them (see § 3.2.2 and 3.2.3). The rules are structured to capture behavioral relationships associated with an attack, whereas they are calibrated to reflect the normal operating conditions of a particular environment. For example, a SYN-flood rule may detect repeated connection attempts that do not complete the TCP handshake, while the number of attempts required to trigger an alert must be calibrated to the network normal connection rate. Thus, D EEP W EAVE can apply the same rules across different networks and adapt them as network conditions change. Rather than treating the neural and symbolic components as independent detectors, D EEP W EAVE combines them inside a shared probabilistic reasoning model, which triggered the name “Weave”. This combination is defined by a coupling architecture (see § 3.2.5) which determines how neural and symbolic evidence interact during inference. Following the previous example, the neural network may predict the probability that an observed packet is a TCP SYN request, while additional symbolic predicates describe whether its flow contains a high rate of SYN packets and many incomplete handshakes. The coupling architecture then relates these uncertain observations to the SYNflood class. A strict coupling may require agreement between neural predictions and symbolic conditions, whereas a more selective coupling may invoke symbolic reasoning only to refine uncertain neural predictions. These alternatives expose different trade-offs among detection coverage, false alarms, and robustness which we explore experimentally in § 5. Lastly, when the selected coupling architecture produces an attack class prediction, D EEP W EAVE raises an alert. In addition to the predicted class and its probability, D EEP W EAVE exposes its reasoning process via the symbolic proof paths that contributed to the prediction. These proofs identify the satisfied predicates and rules supporting an alert, providing an explanation that is intrinsic to the model’s inference rather than generated by a separate post-hoc explainer (see § 3.2.7). 3.2

Design

We first define the common representation through which packet, flow, and hybrid observations are supplied to the neural and symbolic components. We then formalize the structure of the symbolic rules and describe the procedure used to construct them automatically. Finally, we present the neural evidence, its integration into D EEP W EAVE, and the coupling architectures that combine neural and symbolic evidence. 3.2.1

Traffic Representation

Let pt denote a packet observed at time t, and let Ft denote the state of its associated flow. The packet, flow, and hybrid observations are represented as
P F F xP xF xH (1) t = ψP (pt ), t = ψF (Ft ), t = xt , xt , zt , where ψP and ψF are packet-level and flow-level feature extractors. The variable ztF indicates whether the flow context required by the hybrid representation is available. For the remainder of this section, xv denotes an observation under view v ∈ {P, F, H}. Packet representation and flow assembly. The packet representation xP t contains features such as network- and transport-layer protocol fields, packet length, flags, and other header-derived properties. Packets are assigned to flows using a communication key derived from their network and transport endpoints and protocol. For TCP and UDP traffic, this key corresponds to the conventional five-tuple: source address, destination address, source port, destination port, and transport protocol. When bidirectional tracking is enabled, the endpoint ordering is normalized so that packets exchanged in either direction update the same flow. Lastly, rather than recomputing the flow representation from all preceding packets, D EEP W EAVE incrementally maintains the statistics required by ψF . For instance, these statistics include packet and byte counts, communication direction, inter-arrival times, and packet-length distributions (for the full list see § B.1). To allow hybrid detection to operate before the flow completion, neural or symbolic operations that depends on unavailable flow context – i.e., ztF = 0 – are not evaluated. Neural and symbolic feature interfaces. The neural and symbolic components access the same underlying observation through different feature interfaces. The neural component receives an encoded representation ηv (xv ), in which numeric features are standardized while categorical features are transformed into numeric encodings. The symbolic 5

DeepWeave

A P REPRINT

component receives the semantically preserved feature values vf (xv ), where vf returns the original value of feature f for input xv . This separation prevents neural preprocessing from altering the meaning of a symbolic condition. For example, a rule referring to a packet-length threshold is evaluated in the original unit of the feature rather than against its standardized neural encoding. 3.2.2

Symbolic Knowledge Representation

The symbolic component operates over a vocabulary of predicates and a set of class-specific rules with their assigned roles. The design does not require the rules to originate from a particular source. They may be written by experts, imported from an external knowledge source, or constructed automatically. In the evaluated system, D EEP W EAVE uses the automated construction procedure described in § 3.2.3. We use automatic construction because expert knowledge is not generally available in the probabilistic rule representation required by D EEP W EAVE [57, 56], while data-driven construction derives and calibrates rules directly from the features observable to the detector. We then manually remove rules tied to capture-specific identifiers or known benchmark artifacts, reducing the risk of learning nontransferable correlations [51, 9]. 3.2.2.1 Symbolic Predicates. A predicate evaluates an interpretable condition over one feature or a small group of related features. For a numeric feature f , D EEP W EAVE supports upper-tail and lower-tail conditions: ϕ↑f,τ (xv ) = I [vf (xv ) ≥ τ ] ,

(2)

ϕ↓f,τ (xv ) = I [vf (xv ) ≤ τ ] ,

(3)

where τ is a threshold, I[·] is the indicator function, and the symbols ↑ and ↓ identify whether unusually high or low values satisfy the predicate. To further enhance the expressiveness of D EEP W EAVE symbolic predicates and avoid the noisy character of pure thresholding, we also define their differentiable extension. Rather than changing abruptly at a threshold, differentiable predicates provide a smooth transition near the predicate boundary leveraging a logistic sigmoid function. The steepness of the logistic sigmoid is optimized through the neuro-symbolic training objective (see § 3.2.6). Thus, we extend Equations (2) and (3) to ϕ↑f,τ (xv ) = σ (κi (vf (xv ) − τ )) ,

(4)

ϕ↓f,τ (xv ) = σ (κi (τ − vf (xv ))) ,

(5)

where σ is the logistic sigmoid and κi > 0 is the learnable parameter that controls the steepness. For categorical features, predicates have the form ϕf,C (xv ) = I [vf (xv ) ∈ C] , (6) where C is a set of values that the categorical feature can take. Lastly, D EEP W EAVE assigns a value pθ ∈ [0, 1] expressing the probability to which the observation satisfies the predicates ϕ↑f,τ , ϕ↓f,τ , ϕf,C . pθ is optimized during end-to-end training of the DeepProbLog program as it depends on the available traffic data (see § 3.2.6). 3.2.2.2 Symbolic Rules. A symbolic rule combines predicates into a class-specific condition. A rule rjc referring to class c has the general form ^ rjc (xv ) = ϕi (xv ), (7) ϕi ∈Φj

where Φj contains the predicates used by the rule. A rule therefore specifies three elements: (i) the class c to which the rule refers; (ii) the predicates that form its antecedent; and (iii) the evidential role assigned to the rule. The class-specific interpretation is important since a condition that supports one attack class does not necessarily provide evidence against every other class. 3.2.2.3

Rule Roles.

Each rule rjc receives one of three roles:

Sufficient: a high-precision rule with a sufficiently low false-positive rate on benign traffic data, which identifies its associated attack class independently of the neural prediction. These resemble the type of detection rules that a signature-based NIDS would use in practice. Helper: identifies behavior associated with an attack, while not being sufficiently selective to determine the class independently. It may reinforce compatible neural evidence or challenge an uncertain benign prediction. Disqualifier: captures a condition that is inconsistent with a candidate class and blocks the assignment of prediction to the class they refer to. 6

DeepWeave

A P REPRINT

The role assigned to a rule is distinct from its semantic, i.e., predicates and thresholds. The semantic condition determines when the rule is satisfied, while its role determines how a coupling architecture is permitted to use it. This separation allows the same rule to be used under different coupling architectures without modifying its conditions. 3.2.3

Symbolic Knowledge Construction

The automated construction procedure transforms labelled traffic into a set of symbolic rules following the pseudoalgorithm detailed in § B.2. For each attack class A, it performs the following steps: (i) identify features that distinguish A from benign traffic; (ii) instantiate predicates from the selected features; (iii) combine compatible predicates into candidate rules; (iv) validate the candidate rules on held-out construction data; and (v) assign a role to each retained rule. The automated procedure can optionally be followed by expert review to further remove statistically retained rules that are semantically implausible, operationally unsafe, or likely to encode artifacts of the traffic collection process. The rule proposal and validation steps use disjoint traffic. A construction partition is used for feature discovery, predicate instantiation, and candidate generation, while a separate validation partition is used for rule acceptance and role assignment. In our experiments this traffic data belong to neither training nor testing set to avoid information leakage and performance overestimation. Attack-Specific Feature Discovery. For each attack class A, the construction procedure compares the distribution of every candidate feature with its corresponding distribution in benign traffic. This comparison identifies features whose values differ systematically between the attack and benign observations. Additionally, for numeric features, D EEP W EAVE records the directionality of such difference—i.e., if the attack class A distribution contains values that are higher or lower than the benign ones. Both numeric and categorical features are eventually ranked. For the former D EEP W EAVE uses complementary measures of distributional separation, effect magnitude, ordering, shape, and univariate discrimination. Instead, the latter are ranked using distributional distance, statistical association, and smoothed category-specific attack rates. The evaluated measures include the Kolmogorov-Smirnov statistic [23], Cliff’s delta [11], Hellinger distance [19], and the univariate ROC-AUC for class discrimination [17]. Let M(f ) be the ranking measures applicable to feature f . After normalizing the individual measures, their values are aggregated into the attack-specific feature score P b A) m∈M(f ) wm m(f, P S(f, A) = , (8) m∈M(f ) wm where m(f, b A) is the normalized value of measure m for feature f and attack class A, and wm is the configured weight of that measure. Predicate Instantiation. D EEP W EAVE selects the top-K features to transform them into candidate predicates of the forms defined in Equations (4) to (6). For a numeric feature, the directionality established during feature discovery determines whether D EEP W EAVE constructs upper-tail (ϕ↑f,τ ) or lower-tail (ϕ↓f,τ ) predicates. Candidate thresholds are obtained from selected quantiles of the benign feature distribution. More in detail, let τf,q = Qq (f | Y = benign)

(9)

be the q-th quantile of numeric feature f in benign reference traffic, where q belongs to a user-specific set of quantiles. D EEP W EAVE then defines a candidate upper-tail (lower-tail) predicate following Equation (4) (Equation (5)) using τf,q as the threshold. These directional predicate instantiation procedure allows D EEP W EAVE to maintain flexibility. The feature f and directionality encode the behavioral relationship associated with an attack, while the threshold τf,q determines what constitutes an unusual value in a particular environment. Therefore, D EEP W EAVE can preserve a predicate such as “unusually high flow rate” while recalibrating its threshold from benign traffic whenever changes in the network occur. For each categorical feature f , D EEP W EAVE constructs predicates of the form of Equation (6), by enumerating all the values that f takes in the construction data. Values with insufficient target-class support or excessive prevalence in non-target traffic are discarded. Candidate Rule Generation. For each attack class A, D EEP W EAVE combines its most promising atomic predicates into logical conjunctions of the form shown in Equation (7). The maximal size of these conjunctions are user-defined. The search prioritizes predicates that provide sufficient support and discriminative performance, and avoids redundant combinations. Lastly, candidate conjunctions that lack sufficient support are discarded. Restricting rules to a small number of predicates controls the search space, preserves interpretability, and reduces the risk of capturing accidental relationships specific to the construction data. The search bounds and support requirements are configurable and their evaluated settings are reported in § B.2. 7

DeepWeave

A P REPRINT

Rule Validation and Role Assignment. Each candidate rule is evaluated on the construction and validation partitions. For a rule associated with attack class A, D EEP W EAVE measures its precision and benign false-positive rate on both partitions, as well as its attack recall on the validation partition. The comparison between the two partitions acts as a stability check. A rule is rejected when its precision deteriorates substantially on validation data or when its benign false-positive behavior does not remain within the permitted tolerance. The remaining rules are assigned a role according to their validated behavior. A rule with high attack precision and a very low benign false-positive rate is retained as a sufficient rule. A rule that covers a sufficiently large portion of A while maintaining an acceptable benign false-positive rate is retained as a helper rule. Finally, a condition that identifies a class different from A with high precision and low benign false-positive rate is retained as a disqualifier for class A. Candidates that satisfy neither the stability requirement nor the role-specific validation criteria are discarded. The exact hyperparameters of validation criteria together with candidate quantiles and role-assignment thresholds are reported in § B.2. 3.2.4

Neural Evidence Interface

The neural component maps the observation ηv (xv ) – encoded under view v – to a categorical distribution over the set of classes Y: nv (xv ) = hv (ηv (xv ); θv ) , (10) where hv is a trainable classifier with parameters θv . The output expresses the neural evidence – i.e., probability – for class c ∈ Y to be true. In this paper, we consider Y to be the set of attack classes A1 , . . . , Ak and the benign class. Nevertheless, D EEP W EAVE design is general and supports any output class that can be defined to enable the identification of attacks—e.g., the neural component can predict the probability that an observed packet is a TCP SYN request. Lastly, the neural outputs are to be interpreted as probabilistic inputs to the reasoning program through the coupling architectures. They are not the final D EEP W EAVE prediction. D EEP W EAVE design does not depend on a particular neural architecture. It requires only that the model produces a probability for each value in the class vocabulary and that these probabilities can be exposed through a neural predicate. The concrete architecture and training configuration used in the evaluation are reported in § B.3. 3.2.5

Coupling Architectures

A coupling architecture specifies which evidence combinations constitute successful proofs of an attack class. The architectures share the same neural predicates and symbolic rules but differ in the authority assigned to the two evidence sources. D EEP W EAVE characterizes a coupling architecture according to two properties: (i) whether symbolic evidence can independently support a class or must accompany neural evidence, and (ii) whether symbolic reasoning is applied to every observation or only when a condition on the neural prediction is satisfied. Considering these two properties, D EEP W EAVE instantiates the following coupling architectures. Guarded. requires class-matched agreement between the neural and symbolic components for every attack prediction. Let N c , S c , and H c denote the probabilistic outcomes of the neural prediction, sufficient rules, and helper rules for c c c attack class c, respectively. W Thej attack-class support is then defined as Cc = N ∧ (S ∨ H ), whereas benign b support is Cb = N ∧ ¬ j̸=b S . Thus, sufficient and helper rules may corroborate a neural attack prediction, but neither can independently assign an attack class. Only the higher-precision sufficient rules may challenge a neural benign prediction by suppressing it. Guarded coupling therefore filters unsupported neural attacks and false benign predictions while avoiding independent symbolic classification. Anchored. generates classification support in one of two ways. First, a satisfied rule S c with sufficient role can independently support the class c. Alternatively, classification support can arise from the V conjunction of a neural prediction N c and the aggregate satisfaction of the class-specific rules with helper roles j Hjc . In both cases, the resulting support is accepted as valid only when no disqualifier rule is valid. Consequently, sufficient rules can recover cases missed by the neural model, whereas less decisive helper rules must be corroborated by neural evidence, and all candidate classifications remain subject to symbolic rejection. Deferred. relies mainly on the neural component and invokes symbolic rules only when the neural model is insufficiently decisive. Let ∆(xv ) be the difference between the largest and second-largest class probabilities predicted by the neural component. When ∆(xv ) ≥ τ∆ , the Deferred coupling leverages the neural prediction without symbolic intervention, thus being equivalent to pure neural inference. Meanwhile, when ∆(xv ) < τ∆ , the Deferred coupling reverts to predicting the attack class while leveraging the neural component together with sufficient, helper and disqualifier rules. The intuition behind this coupling is that the margin ∆(xv ) is a measure of relative neural decisiveness which identifies when neural inference alone is sufficient to predict an attack instance. Lastly, the threshold τ∆ determines the fraction of observations for which symbolic intervention is activated and thus is a hyperparameter that allows to balance the neural-symbolic trade-off. 8

DeepWeave

A P REPRINT

Hard Gate. predicts a class c only when both the neural and symbolic – either sufficient or helper rules – components provide evidence for c. Thus, this coupling policy represents a logic AND gate between the neural and symbolic components and the stricter policy for attack detection. Same-Class Boost. relaxes the Hard Gate requirements, adding the probability of sufficient symbolic evidence to the neural evidence, without requiring explicit agreement to support the same class. Therefore, the role of the symbolic component is to reinforce uncertain neural predictions when the defined rules are consistent with the information provided by the input. Safety Net. predicts an attack class c when either the neural or symbolic – either sufficient or helper rules – components provide evidence for c. Therefore, this coupling represents the logical complement of the Hard Gate policy, giving the symbolic component the greatest independence. Product of Experts. applies specifically for hybrid traffic view. It predicts an attack class c when neural agreement is achieved between both neural components – i.e., packet- and flow-view – or when the symbolic evidence coming from sufficient rules S c is satisfied. Thus, the Product of Experts coupling favors classes jointly supported by both components, while not being as strict as Hard Gate. 3.2.6

Learning and Inference

For every class c ∈ Y, D EEP W EAVE evaluates the probability of class c being true using the DeepProbLog program PΓ which implements the coupling architecture Γ, the symbolic rules rjc and the neural component hv . Within DeepProbLog, the class probability is obtained identifying a successful proof of the query classify(xv , c), which asks what combination of neural and symbolic evidence permitted by Γ leads to class c being true and the associated probability. Several proof paths may support the same class and DeepProbLog grounds the dependencies among probabilistic predicates before aggregating the probabilities of the successful proofs to obtain the final probability of class c. For end-to-end training, D EEP W EAVE minimizes the negative log-probability of the ground-truth class query LN S (xv , y) = − log PPΓ (classify(xv , y)). Gradients propagate through the probabilistic program to the neural, predicate, and any learnable coupling parameters. The logical rule structure, selected features, and semantic directionality of each predicate remain fixed after symbolic knowledge construction. Meanwhile, environment-dependent thresholds are calibrated separately from the learned model parameters. For example, for a threshold represented by benign quantile q, recalibration consists of estimating Equation (9) from benign reference traffic in the target environment. This changes the numeric boundary without changing the feature, directionality, associated class, or logical structure of the rule. 3.2.7

Proof-Based Explanations

For a predicted class, D EEP W EAVE retains the successful proofs contributing to its class-query probability. Therefore, a proof records: (i) the neural predicates used by the proof, (ii) the symbolic predicates satisfied by the observation, (iii) the feature values and thresholds involved in those predicates, (iv) the rules constructed from the predicates, (v) the role of each contributing rule, and (vi) the coupling through which the evidence supported the class. A proof can therefore distinguish, for example, between a sufficient rule that independently supported an attack, a helper rule that reinforced a neural prediction, and an attack signal that prevented acceptance of a benign prediction. Meanwhile, the proof probability determines the contribution of a path to the class query. When several proofs support the predicted class, D EEP W EAVE ranks them according to their contribution and reports the most influential paths. A visual example of one such explanation is provided in § 5.5.

4

Implementation

We implement D EEP W EAVE in Python using PyTorch [42] and DeepProbLog [35]. Neural models. The neural components of the packet- and flow-view D EEP W EAVE models are implemented as feedforward Multi-Layer perceptrons (MLP) with identical hidden-layer architectures and view-specific input dimensions (see § B.3). In our experiments, we define a neural-only baseline which uses the same classifier as the corresponding neuro-symbolic model to isolate the effect of neuro-symbolic integration on attack detection performance. In hybrid-view operation, D EEP W EAVE instantiates two feed-forward MLPs as the packet and flow classifiers which remain separately accessible to the probabilistic program, allowing symbolic rules to distinguish packet- and flow-level evidence. DeepProbLog Optimizations. Each query carries a tensor handle that identifies the traffic view and observation, allowing neural and symbolic predicates to access their respective encodings through a shared reference. During 9

DeepWeave

A P REPRINT

training, D EEP W EAVE evaluates the ground-truth class query and minimizes its negative log-probability. Instead, during inference, it evaluates all candidate classes and selects the most probable one. A naive implementation would ground and compile a separate arithmetic circuit for every observation and class query. Here, an arithmetic circuit is the compiled computation graph of a probabilistic query. Its leaves contain neural or symbolic probabilities, while its internal operators combine them according to the program’s logical structure. Instead, we reformulate queries so that observations share the same symbolic structure and differ only through tensor substitutions. The resulting circuits are compiled once using placeholder handles and reused across observations. A batched graph semiring then supplies observation-dependent neural and symbolic probabilities as leaf vectors and evaluates each shared circuit elementwise over the batch. We further reduce substitution overhead through direct placeholder lookup and reuse of input templates across neural predicates. Together, these optimizations enable batch-level inference and produce a 26.8× speedup in our development benchmark without changing predicted labels. Their impact on end-to-end latency is reported in § B.4.

5

Experiments and Results

We evaluate D EEP W EAVE via detection performance and efficiency under low-data regimes (§ 5.2), generalization capability (§ 5.3), robustness to adversarial perturbations (§ 5.4), explainability (§ 5.5), and computational efficiency (§ 5.6). Unless stated otherwise, all methods rely on the same task definition, data preprocessing and partitions. To avoid information leakage across D EEP W EAVE optimization and testing, the test set is not used for symbolic knowledge construction, threshold calibration, hyperparameter selection, or model selection. 5.1

Experimental Settings

Datasets and tasks. The CIC-IDS2017 [50] dataset is used for D EEP W EAVE flow-view testing, as it represents the state-of-the-art benchmark for NIDS. Instead, for the packet- and hybrid-view testing we run experiments on the NFCSE-CIC-IDS2018-v3 dataset [49] since it enables the reconstruction of flow features from packet captures using NetFlow-v3 [10]. Furthermore, we test D EEP W EAVE’s generalizability capabilities training it on one of the above mentioned datasets and testing it on the NF-ToN-IoT-v3 dataset [32]. This dataset is selected as it provides a distinct Internet-of-Things (IoT) environment which is radically different from the enterprise networks that characterize the other datasets. Moreover, it shares the same NetFlow-v3 schema of NF-CSE-CIC-IDS2018-v3, ensuring that transferred rules retain the same feature semantics. Lastly, in low-data experiments, we exclude classes with insufficient samples for reliable training and testing, mitigating instability caused by extreme class imbalance in the selected benchmarks [51, 3]. Data partitioning and preprocessing. Each dataset is divided into 60% training, 20% validation, and 20% test partitions using stratified sampling to maintain the natural classes distributions. The validation and test partitions remain fixed across model variants and training-set sizes to ensure fairness. For packet-view and hybrid-view experiments, we partition the data grouping them by flow so that all packets from the same communication remain in one partition and thus avoiding information leakage of packets coming from the same flow but belonging to train and test splits. Where packet labels are derived by matching packets to labelled flow records, matching is completed before partitioning and unmatched or ambiguous packets are excluded. Following established evaluation practice, we remove label-derived fields and capture-specific identifiers to prevent models from exploiting dataset-construction artifacts rather than attack behavior [3, 16, 51]. IP addresses and timestamps are retained only when required for flow assembly or packet-flow association, while they are removed from the neural inputs. Lastly, we standardize the input features only for the neural component, while symbolic predicates access feature values in their original format. Baselines. We compare D EEP W EAVE with Decision Tree, Logistic Regression, Random Forests, Histogram-based Gradient Boosting Classification Tree (HGB), an MLP having the same architecture of the D EEP W EAVE’s neural component, a symbolic baseline containing only the symbolic rules in the D EEP W EAVE model, and state-of-the-art compatible NIDSs, such as CNN-WDLSTM [21], and SPHBI [15] for packet-view, Kitsune [39] and KnowML [20] for flow-view, and DST-IDS [43] for hybrid-view. Kitsune is implemented both using its original AfterImage flow constructor and relying on the same flow features used by D EEP W EAVE. Meanwhile, KnowML is implemented in combination with the KitNet model used in the original paper. KnowML and Kitsune are implemented in their original anomaly detection mode. Metrics. We measure detection performance using F1 scores and attack false positive rate (FPR). For multi-class classification baselines, we consider Macro-F1 which assigns equal weight to every retained class. Meanwhile, for the anomaly detection baselines, such a score represents the binary-F1. Attack FPR is the fraction of benign observations classified as any attack. Where relevant, we additionally report per-class precision and recall, PR-AUC and ROC-

10

DeepWeave

A P REPRINT

AUC. For adversarial robustness experiments, we use metrics related to attack success rate (ASR) and attacked F1 that represents the F1 score on perturbed data. 5.2

Detection Performance and Efficiency

To measure D EEP W EAVE detection performance and efficiency, we follow a low-data protocol where training subsets are parametrized by k ∈ {50, 500, 1000, 2500, 5000, 10000}. Each retained attack class contributes k labelled observations. Benign observations are sampled to match the total attack count, maintaining a controlled balance between benign and aggregate attack traffic. For every value of k, we draw five independent training subsets and re-initialize each model from scratch. Neural-only and neuro-symbolic models use matched subsets and random seeds. Rather than reconstructing symbolic rules for each k batch, we derive them once from a larger historical knowledge pool. The resulting rule base is fixed and shared across experiments, reducing construction cost and preventing batch-specific rule variation. Packet-view. Results for the packet-view detection are presented in Table 1 for k ∈ {50, 1000, 5000}, while the extended results are shown in Table 11 of § C.1. When compared to the simple neural baseline, D EEP W EAVE improves the F1 rate of up to 34.5% at k = 50 using the Anchored coupling architecture. Similarly, D EEP W EAVE reduces falsepositive rate from 0.075 to 0.001. Although CNN-WDLSTM [21] and SPHBI [15] systems improve over the simple neural baselines, they underperformed compared to D EEP W EAVE in low-data regime (k = 50). The D EEP W EAVE Anchored coupling model achieves an improvement of 8.1% in terms of F1, while reducing the false positive rate by 0.011 points. As the available data grow in size, all data-driven baselines – including the symbolic baseline that learn symbolic rules thresholds from data – improve in performance with some of them achieving results similar to D EEP W EAVE. Across different values of k, D EEP W EAVE shows high performance stability, highlighting the effectiveness of neuro-symbolic integration. Lastly, D EEP W EAVE shows substantial detection improvements over Suricata rules which become effective only when considering custom rules defined using the rate and behaviour of the attack derived from the documented CIC-IDS2017 attack profiles—i.e., ET Open + published. However, even custom made Suricata rules result in a high number of false positives compared to D EEP W EAVE, showing the limitations of purely signature-based NIDS and confirming our intuition of § 2.1. Table 1: Packet-view comparison on CIC-IDS2018, across per-class training sizes of k=50, k=1000 and k=5000. F1 indicates the macro-F1 for multi-class classification models and binary-F1 for Suricata. Both F1 and FPR are reported as average ± standard deviation. Best per column in bold. k=50 System

k=1000

k=5000

F1

FPR

F1

FPR

F1

FPR

Neural baseline Symbolic baseline Decision tree Logistic regression Random forest HGB

0.632±.044 0.725±.005 0.688±.035 0.542±.016 0.884±.052 0.811±.045

0.075±.029 0.046±.000 0.064±.019 0.318±.031 0.017±.010 0.021±.013

0.843±.024 0.834±.013 0.776±.059 0.493±.016 0.924±.061 0.857±.128

0.020±.010 0.018±.013 0.082±.127 0.362±.017 0.012±.021 0.070±.123

0.863±.019 0.857±.006 0.881±.048 0.499±.017 0.995±.003 0.943±.031

0.013±.006 0.007±.000 0.026±.017 0.366±.023 0.000±.000 0.001±.001

D EEP W EAVE (Anchored) D EEP W EAVE (Guarded) D EEP W EAVE (Hard Gate) D EEP W EAVE (Safety Net) D EEP W EAVE (Same-Class Boost) D EEP W EAVE (Deferred)

0.977±.013 0.924±.009 0.823±.023 0.876±.018 0.644±.030 0.951±.019

0.001±.001 0.008±.002 0.005±.002 0.030±.008 0.071±.017 0.007±.003

0.969±.023 0.936±.026 0.931±.012 0.867±.045 0.838±.017 0.977±.003

0.000±.000 0.001±.000 0.001±.000 0.018±.008 0.021±.009 0.001±.000

0.985±.007 0.916±.084 0.927±.012 0.878±.046 0.822±.094 0.974±.002

0.000±.000 0.001±.000 0.000±.000 0.012±.006 0.016±.015 0.000±.000

SPHBI [15] CNN-WDLSTM [21]

0.896±.019 0.742±.030

0.012±.004 0.034±.014

0.992±.005 0.845±.017

0.001±.000 0.008±.003

0.992±.010 0.884±.016

0.000±.000 0.007±.001

0.449 0.624

0.279 0.280

0.449 0.624

0.279 0.280

0.449 0.624

0.279 0.280

Suricata (ET Open)† Suricata (ET Open + published)†

Flow-view. Results for the flow-view detection are presented in Table 2 for k ∈ {50, 1000, 5000}, while the extended results are shown in Table 12 of § C.1. We implement Kitsune using both the same flow features used by D EEP W EAVE and the original AfterImage pipeline (noted with † in the table). Such a pipeline is unsupervised and trains once on the first 3 million packets of the benign Monday capture, so its performance does not change across ks. Its testing runs

11

DeepWeave

A P REPRINT

over the raw Tue-Fri captures rather than the held-out 20% split and we report its most favourable run with threshold q=0.995 found experimentally. Across all k values, D EEP W EAVE represents the best performing model. While at k = 50, KnowML achieves a higher F1 score, its score is based on a binary classification task – i.e., predicting either attack or benign –, while D EEP W EAVE is a multi-class classifier. When considering binary F1, D EEP W EAVE achieves a much higher performance around 0.95 (see Table 12). Moreover, D EEP W EAVE achieves a much lower FPR with a 0.124 points reduction when comparing the Anchored coupling architecture with KnowML. Similarly to the packet-view results, as the value k increases most baselines improve. However, they are not capable of reaching the same level of performance of D EEP W EAVE, as shown by the 9.6% F1 gap between the Guarded coupling and the best performing baseline (HGB). Anomaly-based approaches in Kitsune and KnowML, however, do not improve their performance with larger k. We analyze this effect in App C.2 and find that it depends on these models being effective for detecting volumetric attacks that distort traffic statistics – e.g., DoS, DDoS, PortScan –, while collapsing on low-footprint attacks, where the anomaly score is uninformative. This confirms the findings of [20], showing how both Kitsune and KnowML perform particularly well mainly for DoS or DoS-related attacks. Regarding the coupling architectures, the results show the importance of the symbolic component in detecting the attack at flow-view. Coupling architectures that rely mostly on the neural component, such as Deferred and Safety Net, show limited performance at low k. Overall, these results confirm our intuition on low-data regime operation depicted in § 2.1. Table 2: Flow-view comparison on CIC-IDS2017 across training k = 50, k = 1000, and k = 5000. F1 indicates the macro-F1 for multi-class classification models and binary-F1 for the anomaly-based baselines of Kitsune and KnowML. Both F1 and FPR are reported as average ± standard deviation. Best per column in bold. k=50 System

k=1000

k=5000

F1

FPR

F1

FPR

F1

FPR

Neural baseline Symbolic baseline Decision tree Logistic regression Random forest HGB

0.595±.016 0.584±.060 0.452±.098 0.443±.014 0.679±.044 0.574±.077

0.071±.015 0.142±.000 0.174±.072 0.275±.026 0.049±.021 0.115±.074

0.762±.024 0.626±.002 0.673±.059 0.496±.009 0.782±.033 0.778±.058

0.021±.007 0.034±.000 0.096±.026 0.231±.013 0.032±.011 0.037±.019

0.789±.004 0.603±.055 0.726±.055 0.508±.004 0.771±.011 0.825±.059

0.013±.000 0.124±.009 0.053±.014 0.221±.007 0.029±.003 0.027±.018

D EEP W EAVE (Anchored) D EEP W EAVE (Same-Class Boost) D EEP W EAVE (Guarded) D EEP W EAVE (Hard Gate) D EEP W EAVE (Safety Net) D EEP W EAVE (Deferred)

0.833±.016 0.008±.001 0.913±.005 0.009±.001 0.919±.006 0.008±.001 0.672±.013 0.045±.010 0.765±.021 0.026±.007 0.810±.013 0.018±.007 0.849±.016 0.011±.005 0.904±.009 0.008±.000 0.921±.002 0.007±.000 0.838±.018 0.010±.004 0.902±.022 0.010±.004 0.916±.006 0.009±.004 0.703±.029 0.016±.007 0.673±.022 0.069±.010 0.715±.042 0.061±.018 0.593±.020 0.074±.020 0.728±.008 0.032±.001 0.789±.008 0.020±.007

Kitsune [39] + Flow features 0.754±.022 Kitsune [39] + AfterImage (faithful)† 0.734 KnowML [20] + KitNET (unsupervised) 0.883±.019

0.066±.017 0.102 0.132±.025

0.740±.005 0.734 0.851±.036

0.028±.004 0.102 0.175±.051

0.752±.004 0.734 0.792±.024

0.018±.006 0.102 0.260±.035

Hybrid-view. Results for the hybrid-view detection are presented in Table 3 for k ∈ {50, 1000, 5000}, while the extended results are shown in Table 13 of § C.1. The neural baseline consists of a product embedding model composed of two neural networks that encode the packet and flow data and a product layer that combines the two neural embeddings before a final classification layer. Additionally, since D EEP W EAVE does not operate on payload features, we adapt the DST-IDS [43] fusion to the same packet and flow classifiers, rather than using the original payload-based mechanism for fair comparison. The neural product and DST-IDS baselines are trained using early stopping over fifty epochs, while all D EEP W EAVE models are trained for ten epochs. D EEP W EAVE represents the best performing model across all data sizes k. Moreover, its performance improvement is more evident for smaller values of k, achieving a 7.5% F1 improvement and a 0.027 FPR reduction at k = 50. For larger k, the neural and DST-IDS baselines improve their performance, but never catch up with D EEP W EAVE, showcasing the effectiveness of neuro-symbolic integration when dealing with complex input data. Overall, these results confirm the findings of packet- and flow-view on the data efficiency of D EEP W EAVE. Moreover, they also prove that the explicit cross-view rules constructed during the D EEP W EAVE’s offline preparation are particularly useful when the packet and flow classifiers have insufficient data to learn an effective combination policy.

12

DeepWeave

A P REPRINT

Table 3: Hybrid-view comparison on CIC-IDS2018 across per-class training sizes of k = 50, k = 1000, and k = 5000. Results report F1 and FPR as average ± standard deviation. Best per column in bold. k=50 System

k=1000

F1

FPR

Symbolic-only baseline Neural product (baseline) DST-IDS fusion [43]

0.841±.023 0.782±.064 0.827±.065

0.006±.000 0.029±.015 0.024±.014

D EEP W EAVE (Product of Experts) D EEP W EAVE (Guarded) D EEP W EAVE (Anchored) D EEP W EAVE (Same-Class Boost) D EEP W EAVE (Deferred) D EEP W EAVE (Hard Gate) D EEP W EAVE (Safety Net)

0.867±.035 0.020±.016 0.961±.023 0.759±.036 0.008±.004 0.952±.015 0.805±.019 0.003±.002 0.818±.032 0.709±.040 0.049±.016 0.954±.007 0.870±.037 0.018±.016 0.961±.023 0.749±.041 0.016±.014 0.963±.014 0.862±.043 0.017±.011 0.956±.038

(a) Zero-shot transfer

F1

k=5000 FPR

0.857±.014 0.086±.018 0.950±.022 0.003±.001 0.962±.014 0.003±.001

(b) Fine-tuning k=10

F1

FPR

0.849±.001 0.077±.007 0.970±.012 0.002±.001 0.970±.008 0.002±.001

0.006±.005 0.985±.002 0.005±.004 0.004±.004 0.971±.015 0.002±.001 0.091±.024 0.828±.044 0.096±.035 0.005±.004 0.960±.011 0.003±.000 0.006±.005 0.985±.002 0.005±.004 0.004±.001 0.969±.010 0.003±.000 0.020±.020 0.982±.006 0.008±.002

(c) Fine-tuning k=50

Figure 3: Generalization testing from enterprise scenario (CIC-IDS2018) to IoT (NF-ToN-IoT-v3).

5.3

Generalization

We evaluate whether D EEP W EAVE generalizes well across datasets and network topologies operating a crossenvironment transfer from the enterprise CIC-IDS2018 dataset to the IoT NF-ToN-IoT-v3 dataset—i.e., training a model on the former and testing it on the latter. Although these datasets differ in network devices, traffic distributions, and attack families, both adopt NetFlow-v3 flow-views. Thus, symbolic rules constructed in the source environment can be evaluated in the target without modifying D EEP W EAVE’s logical structure. Source models are trained using k = 500 labelled samples per attack class of CIC-IDS2018. The fine-tuning to the IoT dataset then proceeds in two stages. First, the learned feature extractor is frozen, and only the classifier head and environment-dependent symbolic thresholds are updated. Second, the entire neural model is unfrozen and optimized with a reduced learning rate, while symbolic-threshold adaptation continues. Rules transferred from the source to the target environment retain their logical structure but are recalibrated using only information from the target environment. The fine-tuning uses k ∈ {0, 10, 50} samples per attack class, with k = 0 representing the most challenging zero-shot generalization setting. We compare four models: (i) an oracle model trained and evaluated directly on the IoT target data which represents the achievable performance upper bound, (ii) a purely neural model trained only in the enterprise domain, (iii) a regularized neural model which applies weight decay during fine-tuning – to check whether D EEP W EAVE improvement is attributable solely to regularization –, and (iv) a D EEP W EAVE model where both the neural component and rule structures of the original D EEP W EAVE model are used without modifications. Lastly, we focus on the flow traffic-view and use the Guarded coupling architecture for D EEP W EAVE as it is the best performing coupling on average over the flow traffic-view. Figure 3 reports the enterprise-to-IoT transfer results. As expected, the oracle model achieves the highest performance on the target dataset, being directly trained on it. Meanwhile, D EEP W EAVE shows effective generalization capabilities – considering both F1 and FPR scores –, outperforming the purely neural counterparts – both with and without regularization – by 14% in the zero-shot setting and by up to 23% after fine-tuning. As more fine-tuning data become available, the purely neural baselines adapt to the target dataset, closing the gap with D EEP W EAVE. However, they never reach the same level of performance of D EEP W EAVE for the tested settings.

13

DeepWeave

(a) ASR vs. clean accuracy

A P REPRINT

(b) Performance under attack

Figure 4: Adversarial robustness analysis.

5.4

Adversarial Robustness

We evaluate the adversarial robustness of D EEP W EAVE on the CIC-IDS2017 flow-view. To model a realistic adversary, we adopt the attacker capabilities modeled in PANTS [26]. For ease of implementation, we update the affected flow features directly rather than replicating their full packet-level synthesis. Specifically, for a finite set of attacker admissible actions we modify the corresponding flow representations and evaluate the resulting attack flows without modifying the training data nor adversarially retraining the models. The threat model combines two attacker positions. An in-path attacker can delay packets in one direction, while a compromised end host can delay or pad its own forward packets, inject dummy forward packets, or both. For each flow, we limit adversarial packet injection to 20% of the original packet count, and bound the padding to the longest packet in the original flow. Lastly, reverse traffic is held fixed, so the attacker can modify only its own traffic. To isolate the effect of neuro-symbolic integration on adversarial robustness, we compare the different D EEP W EAVE coupling architectures against a purely symbolic baseline – composed of only symbolic rules – and a purely neural baseline—the neural component. Moreover, because the CIC-IDS2018 is unbalanced – DoS and PortScan account for 68.2% and 28.5% of the malicious flows, respectively, – measuring only the ASR would obscure failures on minority attack classes. We therefore report weighted ASR along with the ASR for each attack class, and the F1 detection performance over the attacked flows. As shown in Figure 4, the symbolic-only system is the most robust under adversarial attacks. Its ASR is 23.1%, while its F1 performance decreases from 0.803 to 0.761, corresponding to 94.8% performance retention. This robustness is consistent with the symbolic detection relying primarily on properties such as ports, flags, and categorical protocol conditions that a constrained attacker is not able to modify. Meanwhile, the neural baseline achieves a weighted ASR of 31.3%, showcasing surprisingly high robustness. This is largely due to it being robust mainly against perturbations that affect the DoS class, where its achieved ASR is only 13.3% (see Table 14 in § C.3). As DoS accounts for 68.2% of the malicious test flows, being robust against such perturbations make the model implicitly more robust. Nevertheless, the neural baseline does not represent a reliable model, since its F1 performance decreases to only 0.478 when considering adversarial flows. Further showing that ASR alone is not sufficient to measure the usable robustness of a NIDS. Guarded represents the strongest coupling architecture, achieving a class-averaged ASR of 25.3% (see Table 14). Thus, D EEP W EAVE is more robust than its neural counterpart, although not being able to match the symbolic-only system. Moreover, D EEP W EAVE (Guarded) provides more consistent robustness across classes w.r.t. the neural baseline, thus being more reliable in practice (see Table 14). D EEP W EAVE robustness largely depends on the chosen coupling architecture as more neural-driven couplings result in weaker models such as Hard Gate and Safety Net (see Table 14). Lastly, as show in 4b, D EEP W EAVE allows to define coupling architectures that remain effective also on adversarially perturbed traffic. For example, Guarded achieves a post-attack macro-F1 performance of 0.748, thus achieving a 84.7% performance retention. 5.5

Explainability

We evaluate whether D EEP W EAVE produces explanations that reflect its predictive reasoning and provide meaningful evidence for security analysis. Unlike post-hoc attribution methods, D EEP W EAVE explains predictions through the proof paths used to compute their class probabilities, making its explanations intrinsic to the model. Figure 5 illustrates both a global explanation of the model’s decision structure (Figure 5a) and a local explanation of one prediction 14

DeepWeave

A P REPRINT

Table 4: Deletion fidelity on CIC-IDS2017 flow-view traffic with Guarded coupling. Values report the probability retained by the originally predicted class; lower is more faithful. Probability retention after deleting top-m features/rules Explanation method

m=1

m=3

m=5

m=10

D EEP W EAVE Integrated Gradients (MLP) SHAP (MLP)

0.13 0.90 0.91

0.11 0.85 0.86

0.11 0.77 0.82

0.11 0.65 0.77

Explanation size (features/rules)

2.4 ± 0.7 27.9 ± 8.4 15.7 ± 4.3

(Figure 5b). The example uses Hard Gate coupling and the flow-view model trained on CIC-IDS2017 for SYN-flood detection, while × and + denote logical AND and OR, respectively. The optimized rule checks for an unusually high SYN rate and repeated incomplete TCP handshakes. SYN-rate evidence is evaluated at two thresholds, whose steepness is optimized during training (§ 3.2.3), to distinguish clearly anomalous high rates from stealthier medium-rate flooding. The symbolic result is gated by a neural component that directly estimates SYN-flood evidence. Consequently, D EEP W EAVE predicts SYN flood only when the neural traffic pattern and the symbolic attack conditions agree. For a particular alert, Figure 5b reports the activated predicates and their probabilities, allowing an analyst to inspect detected patterns rather than isolated features—e.g., a very high SYN rate with probability 0.94 and repeated incomplete handshakes with probability 0.88. Additional global and local examples appear in Figure 9 of § C.4.

(a) Global explanation.

(b) Local explanation.

Figure 5: Visualization of D EEP W EAVE’s global and local explanations.

Following the xNIDS evaluation setting [57], we compare D EEP W EAVE with SHAP [33] and Integrated Gradients (IG) [53], applied to the matched neural flow classifier. Across five CIC-IDS2017 training replicates, D EEP W EAVE selects the same winning rule for 96.4% of observations, whereas IG and SHAP select the same top feature for only 24.3% and 18.8%, respectively. § C.4 provides the complete protocol, representative comparisons, and per-class stability results. Lastly, we replicate xNIDS’s deletion-based fidelity evaluation [57]. For each alert, we progressively nullify features selected by its explanation and measure the probability retained by the original predicted class; lower retention indicates that the removed evidence was more important to the prediction. D EEP W EAVE selects the conditions of the clause responsible for the alert, whereas IG and SHAP rank features by the absolute magnitude of their per-sample attributions. As shown in Table 4, removing the complete D EEP W EAVE explanation – only 2.4 conditions on average – reduces probability retention to 0.11. By comparison, removing the highest-ranked IG or SHAP feature retains 0.90 and 0.91 of the original decision, respectively, while removing their top ten features still retains between 0.65 and 0.77. D EEP W EAVE is also substantially sparser: its explanations contain 2.4 conditions on average, compared with 28 IG features and 16 SHAP features required to account for 90% of total attribution. Thus, D EEP W EAVE identifies a compact set of conditions directly responsible for each prediction, while the post-hoc methods produce less sparse explanations whose highest-ranked features have a smaller effect when removed. 5.6

Computational Efficiency

We evaluate the cost of the complete detection pipeline as the number of analyzed flows increases, including both the transformation of incoming traffic into model-ready representations and prediction by an already trained detector. We compare D EEP W EAVE with the ML baselines in § 5.1, Kitsune [39], and KnowML+KitNET [20]. Figure 6 reports (a) the effective per-flow cost at the complete workload and (b) total runtime for increasing workloads. Processing covers 15

DeepWeave

(a) Effective cost per flow.

A P REPRINT

(b) Processing and inference time.

Figure 6: Computational efficiency of D EEP W EAVE and the baselines: effective per-flow processing and inference cost at the complete workload (left), and total runtime by workload (right).

the operations required to construct a valid detector representation from packets or flow records, whereas inference covers the operations required to produce a class or anomaly prediction from that representation. Packet-to-flow assembly dominates processing for all flow-input systems. Before assembly, D EEP W EAVE requires approximately 1.34 µs per flow for feature scaling, symbolic-atom evaluation, quantile lookup, and fact grounding, about 5× the 0.27 µs required by the conventional ML baselines. After adding the shared 331.75 µs assembly cost, however, D EEP W EAVE’s total processing time is only 0.32% higher. Thus, the similar processing times do not imply that symbolic representation is free, but rather that common packet ingestion and flow assembly dominate modelspecific preparation. Inference shows a larger difference. HGB processes the complete 565,525-flow workload in 13.21 seconds, or 23.35 µs per flow, whereas D EEP W EAVE requires 157.47 seconds, or 278.45 µs per flow. Despite being slower than the flowbased ML classifiers, D EEP W EAVE remains substantially faster than the evaluated packet-native systems in their current implementations. Kitsune requires 418.8 µs per packet for AfterImage processing and 377.4 µs for inference through its 19-autoencoder KitNET ensemble. KnowML processes features faster than Kitsune – approximately 3.08 versus 6.81 ms per resulting flow – but its 148-autoencoder KitNET ensemble requires approximately 43.82 ms of inference per flow, compared with 6.14 ms for Kitsune. Consequently, Kitsune’s estimated complete-workload runtime is approximately 21× D EEP W EAVE’s measured runtime, while KnowML+KitNET is approximately 77× slower. Packet- and flow-level timings are not directly interchangeable, but they contextualize probabilistic-reasoning cost relative to complete NIDS pipelines. For deployment planning, the total-runtime curves are the most informative comparison because they include batching, vectorization, query construction, and framework overhead. The isolated inference bars should therefore be interpreted as workload-specific effective costs rather than workload-independent constants. § C.5 separately examines how symbolic-program structure affects cost under a fixed workload.

6

Discussion and Limitations

Value and limits of symbolic knowledge. Reusable rules provide structured evidence when labels or traffic context are scarce, reducing what the neural component must learn and helping control false alarms [35, 56]. However, rules may capture environment-specific or collection-specific correlations and therefore require provenance tracking, recalibration, and periodic validation under deployment shift [51, 9]. Our label-efficiency results consequently assume limited current labels supplemented by historical symbolic knowledge, rather than equal information budgets for rule discovery and neural training. DeepWeave’s probabilities should likewise be interpreted as structured classification evidence, not a complete generative model of network traffic. Coupling is an operational policy. Coupling is an operational policy. It determines the authority assigned to neural and symbolic evidence, so no policy is universally optimal: precision-oriented deployments may prefer strict corroboration, whereas noisy or adversarial environments may require greater evidential independence. DeepWeave makes this precision–robustness trade-off explicit rather than embedding it within an opaque fusion layer. Faithful proofs do not guarantee analyst utility. DeepWeave’s explanations are intrinsic because the reported predicates and clauses belong to proofs contributing to the prediction, avoiding the semantic gap of post-hoc explanations [57]. Our results establish proof coverage, clause reliability, and stability, but do not show that proofs improve

16

DeepWeave

A P REPRINT

analyst decisions or reduce investigation effort. Operational studies indicate that explanations are useful only when they fit analyst workflows and support appropriate reliance [40, 46, 27]. Analyst studies are therefore needed to measure comprehension, triage time, decision quality, and automation bias. Computational and external validity. DeepWeave is slower than optimized ML classifiers because inference includes grounding, predicate evaluation, symbolic solving, and answer decoding. Batching makes this overhead practical for the evaluated workloads, although line-rate packet deployment may require parallelization or lightweight screening, as explored by in-network detection systems [6, 14, 38]. Scalability also depends on rule interactions, since dense logical dependencies may increase compiled-circuit size. Finally, public benchmarks do not capture long-term drift, sensor failures, evolving applications, or analyst feedback. Our results therefore establish DeepWeave’s behavior in the evaluated environments, not universal superiority in operational networks.

7

Related Work

ML-based NIDS. Learning-based NIDSs reduce dependence on manually maintained signatures by learning from packet, flow, or contextual observations. Kitsune models benign traffic online with an autoencoder ensemble [39], while HorusEye combines in-switch anomaly screening with deeper flow analysis [14]. ARGUS models contextual IoT-device behavior [45], and 5G-SPECTOR applies protocol-aware analysis to cellular attacks [58]. These systems demonstrate flexible or context-aware detection, but their attack knowledge is either implicit in learned models or specialized to one protocol environment; learned detectors can also degrade across network distributions [51, 9]. Deployment-oriented systems instead optimize data collection and inference: FlowLens constructs compact flow markers for programmable switches [6], and ISDC distributes flow selection and aggregation across the network [38]. D EEP W EAVE complements this work by integrating packet-, flow-, and hybrid-level learning with explicit probabilistic reasoning and proof-based explanations. Explainable and Robust ML-based Intrusion Detection. xNIDS produces post-hoc explanations that account for temporal context and feature dependencies and can generate defense rules [57]. However, its explanations are produced after prediction, whereas D EEP W EAVE uses symbolic clauses directly in inference and reports contributing proofs. Robustness work emphasizes that adversarial network inputs must remain realizable and preserve malicious functionality. PANTS combines adversarial search with SMT constraints to generate valid network inputs and robustify a target classifier [26]. PANTS uses symbolic reasoning externally for adversarial generation; D EEP W EAVE embeds symbolic attack conditions within the detector and evaluates explicit neural–symbolic coupling under shift, corruption, and constrained evasion. Neuro-Symbolic NIDS. Bizzarri et al. guide neural training with logical constraints over benign and malicious traffic [7], while other recent pipelines combine neural representations with clustering, tree-based prediction, uncertainty, or transfer learning [55]. These studies establish the promise of symbolic supervision, but do not reason through a shared probabilistic logic program whose proofs determine predictions. In D EEP W EAVE, neural outputs instantiate probabilistic predicates and symbolic rules contribute directly to training, inference, and explanation. The system additionally addresses how rules are constructed and validated, how multiple uncertain rules are aggregated, and how conflicts between neural and symbolic evidence are resolved through explicit coupling policies.

8

Conclusions

This paper presents D EEP W EAVE, a probabilistic neuro-symbolic NIDS that combines learned traffic patterns with validated symbolic rules through explicit coupling policies. Across packet-, flow-, and hybrid-views, D EEP W EAVE improves low-data detection and false-positive control, transfers useful knowledge across networks, and produces more stable explanations than post-hoc neural attributions. Despite the additional reasoning overhead, batching enables D EEP W EAVE to process the complete flow workload at 278.45 µs per flow, remaining substantially faster than the evaluated packet-native pipelines. Nevertheless, accuracy and robustness depend on the chosen coupling policy as symbolic reasoning cannot recover absent information. Overall, D EEP W EAVE demonstrates that explicit integration of logic into ML-based NIDS provide data-efficient, adaptable, and inspectable detection at practical computational cost.

References [1] Andrea Agiollo, Enkeleda Bardhi, Mauro Conti, Riccardo Lazzeretti, Eleonora Losiouk, and Andrea Omicini. Gnn4ifa: Interest flooding attack detection with graph neural networks. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 615–630. IEEE, 2023. 17

DeepWeave

A P REPRINT

[2] Arwa Aldweesh, Abdelouahid Derhab, and Ahmed Z. Emam. Deep learning approaches for anomaly-based intrusion detection systems: A survey, taxonomy, and open issues. Knowledge-Based Systems, 189:105124, 2020. [3] Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. Dos and don’ts of machine learning in computer security. In 31st USENIX Security Symposium (USENIX Security 22), pages 3971–3988, 2022. [4] Tao Ban, Samuel Ndichu, Takeshi Takahashi, and Daisuke Inoue. Combat security alert fatigue with ai-assisted techniques. In Cyber Security Experimentation and Test Workshop, CSET ’21, pages 9–16. Association for Computing Machinery, 2021. [5] Enkeleda Bardhi, Chenxing Ji, Ali Imran, Muhammad Shahbaz, Riccardo Lazzeretti, Mauro Conti, and Fernando Kuipers. O’mine: A novel collaborative ddos detection mechanism for programmable data-planes. In 2025 IEEE 10th European Symposium on Security and Privacy (EuroS&P), pages 771–788. IEEE, 2025. [6] Diogo Barradas, Nuno Santos, Luı́s Rodrigues, Salvatore Signorello, Fernando MV Ramos, and André Madeira. Flowlens: Enabling efficient flow classification for ml-based network security applications. In NDSS, 2021. [7] Alice Bizzarri, Brian Jalaian, Fabrizio Riguzzi, and Nathaniel D. Bastian. A neuro-symbolic artificial intelligence network intrusion detection system. In 2024 33rd International Conference on Computer Communications and Networks (ICCCN), pages 1–9, 2024. [8] Alice Bizzarri, Chung-En Yu, Brian Jalaian, Fabrizio Riguzzi, and Nathaniel D. Bastian. A synergistic approach in network intrusion detection by neurosymbolic AI. arXiv preprint arXiv:2406.00938, 2024. [9] Marco Cantone, Claudio Marrocco, and Alessandro Bria. Machine learning in network intrusion detection: A cross-dataset generalization study. IEEE Access, 12:144489–144508, 2024. [10] Benoit Claise. Cisco systems netflow services export version 9. Technical report, 2004. [11] Norman Cliff. Dominance statistics: Ordinal analyses to answer ordinal questions. Psychological Bulletin, 114(3):494–509, 1993. [12] Luc De Raedt, Angelika Kimmig, and Hannu Toivonen. ProbLog: A probabilistic prolog and its application in link discovery. In Proceedings of the 20th International Joint Conference on Artificial Intelligence, pages 2462–2467, Hyderabad, India, 2007. [13] Lorenzo Di Filippo, Enkeleda Bardhi, Andrea Agiollo, Alessandro Palma, Silvia Bonomi, and Fernando Kuipers. Beyond the syntax: Do security experts trust llms for nids rule engineering? arXiv preprint arXiv:2607.05916, 2026. [14] Yutao Dong, Qing Li, Kaidong Wu, Ruoyu Li, Dan Zhao, Gareth Tyson, Junkun Peng, Yong Jiang, Shutao Xia, and Mingwei Xu. HorusEye: A realtime IoT malicious traffic detection framework using programmable switches. In 32nd USENIX Security Symposium (USENIX Security 23), pages 571–588, Anaheim, CA, 2023. USENIX Association. [15] Mohamed El-Sherif, Ahmed Khattab, and Magdy El-Soudani. Intrusion detection using TCP/IP single packet header binary image for IoT networks. Cybersecurity, 8(1):104, 2025. [16] Gints Engelen, Vera Rimmer, and Wouter Joosen. Troubleshooting an intrusion detection dataset: the cicids2017 case study. In 2021 IEEE Security and Privacy Workshops (SPW), pages 7–12. IEEE, 2021. [17] Tom Fawcett. An introduction to ROC analysis. Pattern Recognition Letters, 27(8):861–874, 2006. [18] Wandemberg Gibaut, Leonardo Pereira, Fabio Grassiotto, Alexandre Osorio, Eder Gadioli, Amparo Munoz, Sildolfo Gomes, and Claudio Filipi Goncalves dos Santos. Neurosymbolic AI and its taxonomy: A survey. arXiv preprint arXiv:2305.08876, 2023. [19] Alison L. Gibbs and Francis Edward Su. On choosing and bounding probability metrics. International Statistical Review, 70(3):419–435, 2002. [20] Xin Fan Guo, Xinran Zheng, Albert Merono Penuela, Lorenzo Cavallaro, Sergio Maffeis, and Fabio Pierazzi. KnowML: Improving generalization of ML-NIDS with attack knowledge graphs. In IEEE European Symposium on Security and Privacy (EuroS&P), 2026. [21] Mohammad Mehedi Hassan, Abdu Gumaei, Ahmed Alsanad, Majed Alrubaian, and Giancarlo Fortino. A hybrid deep learning model for efficient intrusion detection in big data environment. Information Sciences, 513:386– 396, 2020. [22] Ke He, Dan Dongseong Kim, and Muhammad Rizwan Asghar. Adversarial machine learning for network intrusion detection systems: A comprehensive survey. IEEE Communications Surveys & Tutorials, 25(1):538–566, 2023. 18

DeepWeave

A P REPRINT

[23] J. L. Hodges. The significance probability of the smirnov two-sample test. Arkiv för Matematik, 3(5):469–486, 1958. [24] Jordan Holland, Paul Schmitt, Nick Feamster, and Prateek Mittal. New directions in automated traffic analysis. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS ’21, pages 3366–3383, New York, NY, USA, 2021. Association for Computing Machinery. [25] Neminath Hubballi and Vinoth Suryanarayanan. False alarm minimization techniques in signature-based intrusion detection systems: A survey. Computer Communications, 49:1–17, 2014. [26] Minhao Jin and Maria Apostolaki. Robustifying {ML-powered} network classifiers with {PANTS}. In 34th USENIX Security Symposium (USENIX Security 25), pages 7291–7310, 2025. [27] Leon Kersten, Kim Beelen, Emmanuele Zambon, Chris Snijders, and Luca Allodi. A field study to uncover and a tool to support the alert investigation process of tier-1 analysts. In Proceedings of the Symposium on Usable Security and Privacy (USEC). Internet Society, 2025. [28] Ansam Khraisat, Iqbal Gondal, Peter Vamplew, and Joarder Kamruzzaman. Survey of intrusion detection systems: Techniques, datasets and challenges. Cybersecurity, 2(1):1–22, 2019. [29] Vinod Kumar and Om Prakash Sangwan. Signature based intrusion detection system using SNORT. International Journal of Computer Applications and Information Technology, 1(3), November 2012. [30] Max Landauer, Florian Skopik, and Markus Wurzenberger. Introducing a new alert data set for multi-step attack analysis. In Proceedings of the 17th Cyber Security Experimentation and Test Workshop, CSET ’24, pages 41–53, New York, NY, USA, 2024. Association for Computing Machinery. [31] Hung-Jen Liao, Chun-Hung Richard Lin, Ying-Chih Lin, and Kuang-Yuan Tung. Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications, 36(1):16–24, 2013. [32] Majed Luay, Siamak Layeghy, Mohanad Sarhan, Sayedehfaezeh Hoseininoorbin, Nour Moustafa, and Marius Portmann. NF-ToN-IoT-v3. Dataset, 2025. NetFlow-based network intrusion detection dataset. [33] Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. In Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. [34] Robin Manhaeve, Sebastijan Dumančić, Angelika Kimmig, Thomas Demeester, and Luc De Raedt. DeepProbLog: Neural probabilistic logic programming. In Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018. [35] Robin Manhaeve, Sebastijan Dumančić, Angelika Kimmig, Thomas Demeester, and Luc De Raedt. Neural probabilistic logic programming in deepproblog. Artificial Intelligence, 298:103504, 2021. [36] Giuseppe Marra, Sebastijan Dumančić, Robin Manhaeve, and Luc De Raedt. From statistical relational to neurosymbolic artificial intelligence: A survey. Artificial Intelligence, 328:104062, 2024. [37] Giuseppe Marra, Francesco Giannini, Michelangelo Diligenti, and Marco Gori. LYRICS: A general interface layer to integrate logic inference and deep learning. In Machine Learning and Knowledge Discovery in Databases, volume 11907 of Lecture Notes in Computer Science, pages 283–298. Springer, 2019. [38] Seyed Mohammad Mehdi Mirnajafizadeh, Ashwin Raam Sethuram, David Mohaisen, DaeHun Nyang, and Rhongho Jang. Enhancing network attack detection with distributed and In-Network data collection system. In 33rd USENIX Security Symposium (USENIX Security 24), pages 5161–5178, Philadelphia, PA, 2024. USENIX Association. [39] Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. Kitsune: An ensemble of autoencoders for online network intrusion detection. In Proceedings of the Network and Distributed System Security Symposium (NDSS), 2018. [40] Megan Nyre-Yu, Elizabeth S. Morris, Blake Moss, Charles Smutz, and Michael R. Smith. Explainable AI in cybersecurity operations: Lessons learned from xAI tool deployment. In Proceedings of the Symposium on Usable Security and Privacy (USEC). Internet Society, 2022. [41] Open Information Security Foundation. Suricata: Open source ids, ips, and network security monitoring engine. Software repository, accessed August 10, 2026. [42] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. PyTorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.

19

DeepWeave

A P REPRINT

[43] Weicheng Qiu, Yinghua Ma, Xiuzhen Chen, Haiyang Yu, and Lixing Chen. Hybrid intrusion detection system based on dempster-shafer evidence theory. Computers & Security, 117:102709, 2022. [44] Ryan Riegel, Alexander Gray, François Luus, Naweed Khan, Ndivhuwo Makondo, Ismail Yunus Akhalwaya, Haifeng Qian, Ronald Fagin, Francisco Barahona, Udit Sharma, Shajith Ikbal, Hima Karanam, Sumit Neelam, Ankita Likhyani, and Santosh Srivastava. Logical neural networks. arXiv preprint arXiv:2006.13155, 2020. [45] Phillip Rieger, Marco Chilese, Reham Mohamed, Markus Miettinen, Hossein Fereidooni, and Ahmad-Reza Sadeghi. {ARGUS}:{Context-Based} detection of stealthy {IoT} infiltration attacks. In 32nd USENIX Security Symposium (USENIX Security 23), pages 4301–4318, 2023. [46] Neele Roch, Hannah Sievers, Lorin Schöni, and Verena Zimmermann. Navigating autonomy: Unveiling security experts’ perspectives on augmented intelligence in cybersecurity. In Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), pages 41–60, Philadelphia, PA, August 2024. USENIX Association. [47] Martin Roesch. Snort: Lightweight intrusion detection for networks. In Proceedings of the 13th USENIX Conference on System Administration, LISA ’99, pages 229–238, Seattle, Washington, USA, 1999. USENIX Association. [48] Desiree Sacher. Fingerpointing false positives: How to better integrate continuous improvement into security monitoring. Digital Threats: Research and Practice, 1(1), 2020. [49] Mohanad Sarhan, Siamak Layeghy, Nour Moustafa, and Marius Portmann. Netflow datasets for machine learning-based network intrusion detection systems. In International Conference on Big Data Technologies and Applications, pages 117–135. Springer, 2020. [50] Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani. Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), pages 108–116, 2018. [51] Robin Sommer and Vern Paxson. Outside the closed world: On using machine learning for network intrusion detection. In 2010 IEEE Symposium on Security and Privacy, pages 305–316. IEEE, 2010. [52] Omer Subasi, Johnathan Cree, Joseph Manzano, and Elena Peterson. A critical assessment of interpretable and explainable machine learning for intrusion detection. arXiv preprint arXiv:2407.04009, 2024. [53] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In Doina Precup and Yee Whye Teh, editors, Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pages 3319–3328. PMLR, 2017. [54] Shahroz Tariq, Mohan Baruwal Chhetri, Surya Nepal, and Cécile Paris. Alert fatigue in security operations centres: Research challenges and opportunities. ACM Computing Surveys, 57(9), 2025. [55] Huynh TT Tran, Jacob Sander, Achraf Cohen, Brian Jalaian, and Nathaniel D Bastian. Neurosymbolic ai transfer learning improves network intrusion detection. In MILCOM 2025-2025 IEEE Military Communications Conference (MILCOM), pages 496–501. IEEE, 2025. [56] Lingzhi Wang, Xiangmin Shen, Weijian Li, Zhenyuan Li, R. Sekar, Han Liu, and Yan Chen. Incorporating gradients to rules: Towards lightweight, adaptive provenance-based intrusion detection. In Proceedings of the Network and Distributed System Security Symposium (NDSS). Internet Society, 2025. [57] Feng Wei, Hongda Li, Ziming Zhao, and Hongxin Hu. {xNIDS}: Explaining deep learning-based network intrusion detection systems for active intrusion responses. In 32nd USENIX Security Symposium (USENIX Security 23), pages 4337–4354, 2023. [58] Haohuang Wen, Phillip Porras, Vinod Yegneswaran, Ashish Gehani, and Zhiqiang Lin. 5G-SPECTOR: An ORAN compliant layer-3 cellular attack detection service. In Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, 2024. Internet Society. [59] Thomas Winters, Giuseppe Marra, Robin Manhaeve, and Luc De Raedt. DeepStochLog: Neural stochastic logic programming. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 10090–10100, 2022. [60] Jingyi Xu, Zilu Zhang, Tal Friedman, Yitao Liang, and Guy Van den Broeck. A semantic loss function for deep learning with symbolic knowledge. In Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 5502–5511. PMLR, 2018. [61] Renjie Xu, Guangwei Wu, Weiping Wang, Xing Gao, An He, and Zhengpeng Zhang. Applying self-supervised learning to network intrusion detection for network flows with graph neural network. Computer Networks, 248:110495, 2024.

20

DeepWeave

A P REPRINT

[62] Zhun Yang, Adam Ishay, and Joohyung Lee. NeurASP: Embracing neural networks into answer set programming. In Christian Bessiere, editor, Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence, pages 1755–1762. International Joint Conferences on Artificial Intelligence Organization, 2020.

21

DeepWeave

A

A P REPRINT

Use of Generative AI

Generative AI tools – mainly GPT 5.6 – were used to improve the English language, clarity, and readability of the manuscript. Their use was limited primarily to grammar correction, sentence restructuring, and stylistic refinement. The authors developed the research methodology, implemented the system, conducted and interpreted the experiments, and wrote the substantive content of the manuscript. All AI-assisted text was reviewed, revised, and approved by the authors, who take full responsibility for the final content.

B

Additional D EEP W EAVE Details

B.1

Detailed list of used features

Table 5: Packet-level feature set of the standardized CSE-CIC-IDS2018 view (22 per-packet header fields). Identifier and label columns (ip.src, ip.dst, frame.time epoch, Attack) are excluded from the model input. Features marked (c) are treated as categorical. Feature

Description

Feature

Description

ip.proto (c) ip.ttl ip.dsfield (c)

IP protocol number (6 TCP, 17 UDP, . . . ) IP time-to-live value IP differentiated-services field (DSCP/ECN) Total captured frame length in bytes Transport-layer source port Transport-layer destination port TCP flags byte of the segment Advertised TCP receive window (unscaled) TCP header length in bytes UDP datagram length (header + payload) Inter-arrival time since previous packet

ip.len tcp.seq tcp.ack

IP total length field TCP sequence number (relative) TCP acknowledgement number (relative)

tcp.len icmp.type (c) icmp.code (c) dns.id dns.qry.type (c)

TCP payload length in bytes ICMP message type ICMP message code DNS transaction identifier DNS query type (A, AAAA, MX, . . . )

dns.resp.ttl ftp.response.code (c) frame.protocols (c)

TTL of the DNS answer record FTP server response code Protocol stack string (e.g. eth:ip:tcp:http)

frame.len srcport dstport (c) tcp.flags (c) tcp.window size value tcp.hdr len udp.length frame.time delta

B.1.0.1 Packet view. As shown in Table 5, the packet view is restricted to 22 header fields readable at parsing time, with no payload inspection, so the detector remains applicable to encrypted traffic and can emit a verdict per packet without waiting for flow termination; address and timestamp columns are excluded from the model input to prevent identity and temporal leakage. Furthermore, using the standardized NetFlow-v3 version of the CSE-CIC-IDS2018 allows for a complete construction of the flow features proposed by the NetFlow-v3 through these 22 packet header features.

B.1.0.2 Flow view. As shown in table 6, the flow view uses all 79 CICFlowMeter features proposed in the CICIDS2017 dataset: volumetric counts, packet-size and inter-arrival-time statistics per direction, TCP flag counts, and activity/idle timing. No manual feature selection is applied, resulting in a fair comparison with the machine-learning baselines (every model sees the same input) as well as SOTA models, and because the rule-mining stage performs its own feature selection, extracting a small interpretable subset as symbolic predicates while the neural branch consumes the full vector.

B.1.0.3 Hybrid View. As shown in Table 7, the hybrid view follows the 49 features of the NetFlow-v3 schema of the standardized datasets but are computed incrementally from the packet stream itself, per bidirectional 5-tuple. This gives the hybrid model the aggregate context that single packets lack (directional volumes, durations, retransmission and inter-arrival statistics) while preserving streaming semantics. B.2

Algorithm for automatic rule construction

Algorithm 1 gives the full offline rule-mining pipeline, with the concrete thresholds used in the experiments. The four stages – scoring, calibration, program assembly, and soft rewrite – run entirely on the scoring reference pool. Candidate-generation configuration. In our experiments, atomic predicates are ranked by validation performance, and the search is restricted to the 40 highest-ranked candidates for each attack class. Predicates with fewer than 10 validation true positives are excluded. The pipeline evaluates non-redundant conjunctions of up to three predicates and applies the same minimum-support requirement to each conjunction. To bound construction cost, it emits at most 22

DeepWeave

A P REPRINT

Table 6: Flow-level feature set of the CIC-IDS2017 view (79 CICFlowMeter features). Durations and inter-arrival times (IAT) are in microseconds; Fwd denotes the direction of the flow’s first packet, Bwd the reverse. Features marked (c) are treated as categorical. Feature

Description

Feature

Description

Source Port (c) Destination Port (c) Protocol (c) Flow Duration Total Fwd Packets Total Backward Packets Total Length of Fwd Packets Total Length of Bwd Packets Fwd Packet Length Max Fwd Packet Length Min Fwd Packet Length Mean Fwd Packet Length Std Bwd Packet Length Max Bwd Packet Length Min Bwd Packet Length Mean Bwd Packet Length Std Flow Bytes/s Flow Packets/s Flow IAT Mean

Bwd IAT Total Bwd IAT Mean Bwd IAT Std Bwd IAT Max Bwd IAT Min Fwd PSH Flags (c) Bwd PSH Flags Fwd URG Flags (c) Bwd URG Flags Fwd Header Length Bwd Header Length Fwd Packets/s Bwd Packets/s Min Packet Length Max Packet Length Packet Length Mean Packet Length Std Packet Length Variance FIN Flag Count (c)

Sum of IATs between backward packets Mean backward IAT Std. deviation of backward IAT Maximum backward IAT Minimum backward IAT Forward packets with TCP PSH set Backward packets with TCP PSH set Forward packets with TCP URG set Backward packets with TCP URG set Total header bytes, forward Total header bytes, backward Forward packet rate Backward packet rate Smallest packet, both directions Largest packet, both directions Mean packet size, whole flow Std. deviation of packet size, whole flow Variance of packet size, whole flow Packets with FIN set

Flow IAT Std Flow IAT Max Flow IAT Min Fwd IAT Total Fwd IAT Mean Fwd IAT Std Fwd IAT Max Fwd IAT Min Average Packet Size Avg Fwd Segment Size Avg Bwd Segment Size Fwd Avg Bytes/Bulk

Transport-layer source port Transport-layer destination port IP protocol number (6 TCP, 17 UDP, . . . ) Time between first and last packet Packet count, forward direction Packet count, backward direction Sum of payload sizes, forward Sum of payload sizes, backward Largest packet size, forward Smallest packet size, forward Mean packet size, forward Std. deviation of packet size, forward Largest packet size, backward Smallest packet size, backward Mean packet size, backward Std. deviation of packet size, backward Flow byte rate, both directions Flow packet rate, both directions Mean IAT between consecutive flow packets Std. deviation of flow IAT Maximum flow IAT Minimum flow IAT Sum of IATs between forward packets Mean forward IAT Std. deviation of forward IAT Maximum forward IAT Minimum forward IAT Mean size over all packets Mean payload (segment) size, forward Mean payload (segment) size, backward Mean bytes per bulk burst, forward

SYN Flag Count (c) RST Flag Count (c) PSH Flag Count (c) ACK Flag Count (c) URG Flag Count (c) CWE Flag Count (c) ECE Flag Count (c) Down/Up Ratio Subflow Bwd Bytes Init Win bytes forward Init Win bytes backward act data pkt fwd

Fwd Avg Packets/Bulk Fwd Avg Bulk Rate Bwd Avg Bytes/Bulk Bwd Avg Packets/Bulk Bwd Avg Bulk Rate Subflow Fwd Packets Subflow Fwd Bytes Subflow Bwd Packets

Mean packets per bulk burst, forward Mean bulk transfer rate, forward Mean bytes per bulk burst, backward Mean packets per bulk burst, backward Mean bulk transfer rate, backward Mean packet count per forward subflow Mean byte count per forward subflow Mean packet count per backward subflow

min seg size forward Active Mean Active Std Active Max Active Min Idle Mean Idle Std Idle Max

Packets with SYN set Packets with RST set Packets with PSH set Packets with ACK set Packets with URG set Packets with CWR set Packets with ECE set Download-to-upload packet ratio Mean byte count per backward subflow TCP initial window announced forward TCP initial window announced backward Forward packets with ≥1 byte of TCP payload Minimum segment (header) size, forward Mean active time before going idle Std. deviation of active time Maximum active time Minimum active time Mean idle time before becoming active Std. deviation of idle time Maximum idle time

5,000 candidate conjunctions and terminates the search after 120 seconds. The predicate budget, rule length, support threshold, candidate limit, and time limit are configurable parameters rather than fixed properties of D EEP W EAVE. Table 8 features the criteria used for assigning a role for each candidate rule. A candidate that failed its role gate, stability requirement, schema check, or provenance check is rejected. For an accepted rule, the rule strength (i.e. its initial learnable probability weight) is set to its validation precision, clipped to the interval [0.05, 0.99]. Hyperparameter settings for rule construction. The rule miner ranks features separately for each attack-versusbenign comparison and retains the 12 highest-ranked stable features. A feature is stable when its validation score is at least 0.50, its construction-to-validation score gap is below 0.20, and its rank shifts by at most five positions. The ranking combines the Kolmogorov-Smirnov statistic, Cliff’s delta, Hellinger distance, AUC, Cramér’s V , and total variation distance with weights 0.30, 0.20, 0.20, 0.20, 0.05, and 0.05, respectively; weights are renormalized when a statistic does not apply. Numeric predicates use lower-tail quantiles QL = {0.001, 0.003, 0.005, 0.03, 0.10, 0.30} and upper-tail quantiles QU = {0.80, 0.90, 0.97, 0.995, 0.997, 0.999}, including intervals between adjacent quantiles. A categorical value is retained when it occurs in the target class and its non-target occurrence rate is below 0.02. B.3

Optimization Hyperparameters

Table 9 reports the parameters used in the experiments. We selected them through a two-stage search on the CICIDS2017 validation split. The first stage fixed training at five epochs and evaluated the 24 combinations b ∈ {8, 16, 32},

ηNN , ηDPL , ηpred ∈ {10−3 , 3 × 10−3 },

23

DeepWeave

A P REPRINT

Table 7: Flow-level feature set of the hybrid view on the standardized CSE-CIC-IDS2018 data (49 NetFlow-v3-schema features, computed online from the packet stream per bidirectional 5-tuple). In denotes the client-to-server direction, out the reverse; durations and inter-arrival times (IAT) are in milliseconds. Feature

Description

Feature

Description

L4 SRC PORT

Source port of the flow’s first packet Destination port of the flow’s first packet IP protocol number of the flow

SRC TO DST AVG THROUGHPUT

NUM PKTS 128 TO 256 BYTES

IN BYTES

Application protocol code (from protocol stack, well-known-port fallback) Total bytes, client to server

Average throughput in, bits per second Average throughput out, bits per second Packets with frame length ≤128 bytes Packets with frame length 129–256 bytes

IN PKTS

Total packets, client to server

NUM PKTS 512 TO 1024 BYTES

OUT BYTES

Total bytes, server to client

NUM PKTS 1024 TO 1514 BYTES

OUT PKTS

Total packets, server to client

TCP WIN MAX IN

TCP FLAGS

TCP WIN MAX OUT

CLIENT TCP FLAGS

Cumulative OR of TCP flags, whole flow Cumulative OR of TCP flags, in

ICMP TYPE

SERVER TCP FLAGS FLOW DURATION MILLISECONDS DURATION IN DURATION OUT MIN TTL

Cumulative OR of TCP flags, out Time between first and last packet Duration of the in packet stream Duration of the out packet stream Minimum IP TTL in the flow

ICMP IPV4 TYPE DNS QUERY ID DNS QUERY TYPE DNS TTL ANSWER FTP COMMAND RET CODE

MAX TTL LONGEST FLOW PKT SHORTEST FLOW PKT MIN IP PKT LEN MAX IP PKT LEN SRC TO DST SECOND BYTES

Maximum IP TTL in the flow Largest frame length in the flow Smallest frame length in the flow Smallest IP total length in the flow Largest IP total length in the flow Byte rate in, over in-stream duration Byte rate out Retransmitted bytes, in (repeated TCP sequence numbers) Retransmitted packets, in Retransmitted bytes, out Retransmitted packets, out

SRC TO DST IAT MIN SRC TO DST IAT MAX SRC TO DST IAT AVG SRC TO DST IAT STDDEV DST TO SRC IAT MIN DST TO SRC IAT MAX

Packets with frame length 257–512 bytes Packets with frame length 513– 1024 bytes Packets with frame length 1025– 1514 bytes Maximum TCP window advertised in Maximum TCP window advertised out ICMP type and code (type × 256 + code) ICMP type alone DNS transaction identifier DNS query type TTL of the DNS answer record FTP server response code in the flow Minimum packet IAT, in Maximum packet IAT, in Mean packet IAT, in Std. deviation of packet IAT, in Minimum packet IAT, out Maximum packet IAT, out

DST TO SRC IAT AVG DST TO SRC IAT STDDEV

Mean packet IAT, out Std. deviation of packet IAT, out

L4 DST PORT PROTOCOL L7 PROTO

DST TO SRC SECOND BYTES RETRANSMITTED IN BYTES RETRANSMITTED IN PKTS RETRANSMITTED OUT BYTES RETRANSMITTED OUT PKTS

DST TO SRC AVG THROUGHPUT NUM PKTS UP TO 128 BYTES

NUM PKTS 256 TO 512 BYTES

Table 8: Shared validation gates for assigning roles to generated rules. Proposed Role Sufficient Helper Disqualifier

Acceptance criteria on validation set Precision ≥ 0.90 and FPR ≤ 0.015 Recall ≥ 0.35 and FPR ≤ 0.050 Precision ≥ 0.90 and FPR ≤ 0.020

where b is the batch size and the three learning rates control the neural network, probabilistic logic parameters, and soft-predicate networks. We ranked each configuration by S = F1,macro − 0.5 FPRattack − 0.25 σ(F1,macro ). The selected configuration, b = 8, ηNN = ηDPL = 3 × 10−3 , and ηpred = 10−3 , obtained 0.835 macro-F1, 0.030 attack FPR, and a selection score of 0.820. The second stage fixed this configuration and compared E ∈ {5, 10, 25, 50} epochs over five replicates. The corresponding macro-F1 scores were 0.906 ± 0.004, 0.895 ± 0.025, 0.904 ± 0.018, and 0.891 ± 0.028. None differed significantly from the ten-epoch configuration, which we retained as a conservative balance between convergence and cost.

24

DeepWeave

A P REPRINT

Algorithm 1 Offline symbolic-rule mining Require: training/scoring pool S, validation split V , attack classes A, top count K = 12, statistic weights w Ensure: DeepProbLog program Π 1: R ← ∅ 2: for all attack a ∈ A do 3: for all candidate feature f eligible for the symbolic vocabulary do 4: compute KS, Cliff’s δ, Hellinger, folded AUC (numeric) or Cramer’s V, TVD, categorical AUC (categorical) on S for a versus benign 5: score(f, a) ← weighted mean of the per-attack min-max normalised statistics, using w 6: end for 7: Fa ← top-K features of a by score(·, a), each carrying its predicate hint (quantile tier or category) 8: Ca ← candidate rule bodies: each top feature alone, plus short conjunctions of their hint predicates 9: for all candidate body c ∈ Ca do 10: measure precision p, recall r, benign FPR ϕ of c on V ; measure ptr , ϕtr on S 11: stable ← (ptr − p ≤ 0.20) ∧ (ϕtr − ϕ ≤ 0.05) {drop rules selective only on mining data} 12: if stable ∧ p ≥ 0.90 ∧ ϕ ≤ 0.015 then 13: role(c) ← S UFFICIENT {may support a on its own} 14: else if stable ∧ r ≥ 0.35 ∧ ϕ ≤ 0.050 then 15: role(c) ← H ELPER {fires only behind the neural prediction} 16: else if stable ∧ p ≥ 0.90 ∧ ϕ ≤ 0.020 on a rival class then 17: role(c) ← DISQUALIFIER 18: else 19: discard c 20: end if 21: R ← R ∪ {c} 22: end for 23: end for 24: group each class’s sufficient and helper rules into per-class pockets; wrap pockets in learnable predicates t(p) :: symbolic a suf f icient(X) whose initial p is the calibrated confidence 25: attach the query head classif y/2 for the configured coupling; emit hard externals 26: rewrite each hard external to its soft module and split multi-threshold bodies into single-external helpers 27: return Π Table 9: Fixed D EEP W EAVE implementation parameters.

B.4

Component

Configuration

Neural model Activation and dropout Optimizer Neural learning rate Rule-weight learning rate Predicate learning rate Training batch size Inference batch size Initial predicate steepness Temperature schedule

MLP: 256–128–64 ReLU, 0.3 Adam 3 × 10−3 3 × 10−3 1 × 10−3 8 8192 50 1.0 → 0.5

Effect of vectorized inference on D EEP W EAVE

The initial evaluator invoked the DeepProbLog solving path for each flow, repeating symbolic traversal and framework overhead even though all queries shared an arithmetic circuit. The optimized evaluator instead stacks the neural-leaf values of multiple queries and evaluates the shared circuit once per batch. The diagnostic measured query construction, neural-predicate evaluation, symbolic solving, and answer decoding on 1,000 held-out CIC-IDS2017 flows. Three matched executions used a batch size of one for the original evaluator and 1,024 for the optimized evaluator. Training, backpropagation, feature preprocessing, and packet-to-flow assembly were excluded.

25

DeepWeave

A P REPRINT

Table 10: Matched-checkpoint comparison of the original per-flow D EEP W EAVE evaluator and the optimized vectorized evaluator on 1,000 held-out CIC-IDS2017 flows. Evaluator

Batch size

Time (s) [IQR]

µs/flow

Flows/s

Speedup

Agreement

1 1,024

11.781 [11.646, 11.797] 0.440 [0.405, 0.443]

11,781.0 439.6

84.9 2,274.9

1.0× 26.8×

100% 100%

Original D EEP W EAVE Optimized D EEP W EAVE

Table 10 reports a reduction in median runtime from 11.781 to 0.440 seconds. The effective cost falls from 11,781.0 to 439.6 µs per flow, while throughput increases from 84.9 to 2,274.9 flows per second. This corresponds to a 26.8× evaluator speedup and a 96.27% runtime reduction for the tested workload. The same checkpoint produced identical predictions for all 1,000 flows. Vectorization therefore changes execution without changing the classifier output.

C

Packet, Flow and Hybrid Extensive Results

C.1

Detection Performance and Efficiency Extensive results

This section reports the training-size sweep for the packet, flow, and hybrid views. We compare multiclass macro-F1 (MF1), attack false-positive rate (FPR), and detection rate (DR), and measure data efficiency by the labelled budget k needed to reach a given MF1. C.1.1

Packet view

Table 11 shows the largest gains at small training sizes. At k = 50, Anchored, Deferred, and Guarded reach 0.977, 0.951, and 0.924 MF1, respectively, compared with 0.632 for the neural baseline, 0.811 for HGB, and 0.884 for the random forest. These three couplings already exceed the neural baseline’s best result of 0.869 at k = 10000. They therefore reach the same performance level with 50 rather than 10,000 labelled examples per attack class, corresponding to a 200× reduction in required training data. The gap narrows with more labels: the random forest reaches 0.995 MF1 at k = 5000, while Anchored and Deferred reach 0.985 and 0.974. The coupled models also maintain low FPR. Anchored records 0.001 at k = 50 and values that round to zero thereafter, while Deferred, Guarded, and Hard Gate remain at or below 0.008. Most methods already attain high DR, so differences in FPR and attack-family assignment account for most of the MF1 gap. Suricata illustrates this distinction: dataset-specific rules raise its DR from 0.184 to 0.868, but its FPR remains 0.280. Table 11: Packet-view comparison on CIC-IDS2018, across the per-class training-size k. F1 indicates the macro-F1 for multi-class classification models and binary-F1 for binary classification baselines (Suricata). Both F1 and FPR are reported as average ± standard deviation. Best F1 (highest) and FPR (lowest) for each k are shown in bold. Suricata is signature-based and training-sizeindependent, thus is not affected by k. k=50 System

F1 0.632±.044 0.725±.005 0.688±.035 0.542±.016 0.884±.052 0.811±.045

Neural baseline Symbolic baseline Decision tree Logistic regression Random forest HGB

k=100 FPR

k=250

k=500

Suricata (ET Open)† Suricata (ET Open + published)†

C.1.2

k=2500

FPR

F1

FPR

F1

FPR

F1

FPR

F1

0.075±.029 0.702±.029 0.046±.000 0.768±.064 0.064±.019 0.757±.060 0.318±.031 0.493±.027 0.017±.010 0.972±.007 0.021±.013 0.900±.044

0.063±.011 0.033±.016 0.103±.110 0.343±.021 0.004±.002 0.014±.014

0.774±.052 0.833±.016 0.778±.083 0.490±.047 0.960±.041 0.898±.052

0.033±.017 0.020±.013 0.094±.096 0.352±.028 0.003±.002 0.017±.014

0.776±.026 0.812±.016 0.801±.047 0.553±.023 0.902±.056 0.753±.099

0.031±.007 0.026±.016 0.081±.102 0.303±.007 0.020±.023 0.177±.201

0.843±.024 0.834±.013 0.776±.059 0.493±.016 0.924±.061 0.857±.128

0.020±.010 0.018±.013 0.082±.127 0.362±.017 0.012±.021 0.070±.123

0.856±.017 0.846±.005 0.834±.045 0.489±.024 0.966±.026 0.889±.082

D EEP W EAVE (Anchored) 0.977±.013 0.001±.001 0.972±.032 0.000±.000 0.972±.031 0.000±.000 D EEP W EAVE (Guarded) 0.924±.009 0.008±.002 0.906±.020 0.004±.002 0.930±.014 0.001±.000 D EEP W EAVE (Hard Gate) 0.823±.023 0.005±.002 0.862±.031 0.003±.001 0.922±.025 0.001±.000 D EEP W EAVE (Safety Net) 0.876±.018 0.030±.008 0.893±.025 0.021±.007 0.855±.037 0.040±.015 D EEP W EAVE (Same-Class Boost) 0.644±.030 0.071±.017 0.697±.044 0.061±.008 0.771±.021 0.037±.014 D EEP W EAVE (Deferred) 0.951±.019 0.007±.003 0.970±.006 0.003±.001 0.983±.007 0.001±.001 SPHBI [15] CNN-WDLSTM [21]

k=1000

F1

0.896±.019 0.742±.030

0.012±.004 0.034±.014

0.943±.014 0.773±.031

0.007±.001 0.026±.011

0.966±.018 0.817±.028

0.449 0.624

0.279 0.280

0.449 0.624

0.279 0.280

0.449 0.624

0.942±.028 0.000±.000 0.940±.011 0.002±.001 0.914±.020 0.001±.000 0.894±.025 0.008±.006 0.758±.034 0.035±.014 0.982±.004 0.001±.000

0.003±.002 0.985±.004 0.013±.008 0.818±.016 0.279 0.280

0.449 0.624

0.969±.023 0.000±.000 0.936±.026 0.001±.000 0.931±.012 0.001±.000 0.867±.045 0.018±.008 0.838±.017 0.021±.009 0.977±.003 0.001±.000

0.001±.000 0.992±.005 0.008±.001 0.845±.017 0.279 0.280

0.449 0.624

k=5000 FPR

F1

k=10000 FPR

F1

FPR

0.011±.004 0.863±.019 0.013±.006 0.869±.011 0.011±.000 0.857±.006 0.007±.000 0.842±.017 0.048±.043 0.881±.048 0.026±.017 0.928±.049 0.380±.011 0.499±.017 0.366±.023 0.500±.011 0.001±.000 0.995±.003 0.000±.000 0.992±.008 0.018±.032 0.943±.031 0.001±.001 0.949±.056

0.012±.004 0.007±.000 0.006±.009 0.378±.015 0.001±.001 0.006±.012

0.985±.007 0.000±.000 0.948±.012 0.001±.000 0.923±.016 0.000±.000 0.879±.038 0.015±.007 0.858±.010 0.010±.002 0.975±.002 0.001±.000

0.985±.007 0.000±.000 0.916±.084 0.001±.000 0.927±.012 0.000±.000 0.878±.046 0.012±.006 0.822±.094 0.016±.015 0.974±.002 0.000±.000

0.988±.006 0.946±.003 0.919±.031 0.846±.055 0.870±.022 0.987±.001

0.001±.000 0.990±.010 0.000±.000 0.008±.003 0.853±.026 0.012±.005

0.992±.010 0.000±.000 0.884±.016 0.007±.001

0.984±.023 0.000±.000 0.858±.019 0.011±.001

0.279 0.280

0.449 0.624

0.279 0.280

0.449 0.624

0.279 0.280

0.449 0.624

0.002±.001 0.001±.000 0.004±.002 0.024±.010 0.013±.008 0.003±.001

0.279 0.280

Flow view

The flow results in Table 12 strengthen this low-data pattern. At k = 50, Guarded, Anchored, and Hard Gate obtain MF1 scores of 0.849, 0.833, and 0.838, compared with 0.595 for the neural baseline and 0.574 for HGB. All three exceed the neural baseline’s best sweep result of approximately 0.79 at k = 10000, again reducing the equivalent labeled budget from 10,000 to 50 examples per attack class. Neither component produces this result alone, as the symbolic baseline remains between approximately 0.58 and 0.66, so neither branch alone explains the coupled result.

26

DeepWeave

A P REPRINT

Table 12: Flow-view comparison on CIC-IDS2017 across training sizes k. Macro-F1 for multi-class classification models and binary-F1 for anomaly-based baselines of Kitsune and KnowML are reported. Both F1 and FPR are reported as average ± standard deviation. Best F1 (highest) and FPR (lowest) for each k are shown in bold. k=50 System

k=100

k=250

k=500

k=1000

k=2500

BF1

FPR

MF1

BF1

FPR

MF1

BF1

FPR

MF1

BF1

FPR

MF1

BF1

FPR

BF1

FPR

MF1

BF1

0.595±.016 0.584±.060 0.452±.098 0.443±.014 0.679±.044 0.574±.077

0.902±.009 0.837±.000 0.774±.041 0.731±.016 0.925±.020 0.853±.055

0.071±.015 0.142±.000 0.174±.072 0.275±.026 0.049±.021 0.115±.074

0.617±.020 0.584±.060 0.514±.084 0.459±.013 0.741±.028 0.636±.130

0.906±.019 0.837±.000 0.827±.034 0.746±.009 0.947±.017 0.921±.065

0.071±.023 0.142±.000 0.102±.051 0.258±.011 0.034±.014 0.051±.066

0.670±.012 0.554±.073 0.594±.038 0.484±.012 0.759±.009 0.709±.059

0.946±.004 0.837±.000 0.896±.034 0.764±.004 0.954±.010 0.950±.025

0.039±.003 0.142±.000 0.064±.035 0.241±.004 0.032±.008 0.028±.020

0.709±.027 0.623±.005 0.662±.030 0.487±.015 0.768±.009 0.727±.043

0.957±.008 0.867±.015 0.873±.045 0.766±.008 0.958±.009 0.941±.028

0.033±.006 0.070±.037 0.088±.031 0.239±.009 0.031±.008 0.040±.017

0.762±.024 0.626±.002 0.673±.059 0.496±.009 0.782±.033 0.778±.058

0.972±.009 0.876±.000 0.878±.025 0.773±.011 0.959±.014 0.954±.022

0.021±.007 0.034±.000 0.096±.026 0.231±.013 0.032±.011 0.037±.019

0.774±.004 0.976±.007 0.617±.000 0.839±.000 0.730±.132 0.926±.050 0.502±.005 0.780±.009 0.800±.012 0.975±.013 0.887±.050 0.987±.014

0.018±.005 0.119±.000 0.062±.047 0.223±.011 0.019±.011 0.010±.011

0.789±.004 0.603±.055 0.726±.055 0.508±.004 0.771±.011 0.825±.059

0.983±.000 0.838±.001 0.936±.015 0.781±.007 0.963±.003 0.967±.021

D EEP W EAVE (Anchored) D EEP W EAVE (Same-Class Boost) D EEP W EAVE (Guarded) D EEP W EAVE (Hard Gate) D EEP W EAVE (Safety Net) D EEP W EAVE (Deferred)

0.833±.016 0.672±.013 0.849±.016 0.838±.018 0.703±.029 0.593±.020

0.955±.014 0.894±.022 0.960±.005 0.944±.018 0.901±.006 0.902±.018

0.008±.001 0.045±.010 0.011±.005 0.010±.004 0.016±.007 0.074±.020

0.842±.011 0.677±.014 0.864±.013 0.838±.022 0.666±.046 0.606±.020

0.965±.003 0.009±.003 0.912±.011 0.039±.011 0.965±.008 0.007±.002 0.950±.011 0.014±.004 0.900±.003 0.019±.005 0.917±.004 0.062±.007

0.841±.024 0.969±.005 0.673±.030 0.913±.028 0.847±.008 0.967±.004 0.841±.017 0.951±.023 0.636±.032 0.871±.016 0.634±.024 0.934±.008

0.011±.002 0.043±.007 0.014±.006 0.010±.005 0.071±.037 0.050±.006

0.899±.018 0.977±.002 0.690±.027 0.947±.009 0.860±.033 0.975±.008 0.878±.030 0.974±.006 0.670±.026 0.866±.011 0.697±.021 0.949±.009

0.010±.002 0.038±.007 0.013±.005 0.014±.005 0.080±.028 0.039±.007

0.913±.005 0.980±.001 0.765±.021 0.964±.009 0.904±.009 0.982±.001 0.902±.022 0.978±.006 0.673±.022 0.877±.008 0.728±.008 0.958±.001

0.009±.001 0.026±.007 0.008±.000 0.010±.004 0.069±.010 0.032±.001

0.915±.003 0.788±.012 0.908±.004 0.912±.006 0.698±.029 0.759±.027

0.740±.005 0.028±.004 0.734 0.102 0.851±.036 0.175±.051

-

Kitsune [39] + Flow features Kitsune [39] + AfterImage (faithful)† KnowML [20] + KitNET (unsupervised)

- 0.754±.022 0.066±.017 0.734 0.102 - 0.883±.019 0.132±.025

- 0.747±.018 0.734 - 0.890±.010

0.057±.028 0.102 0.122±.014

-

0.741±.005 0.066±.040 0.734 0.102 0.889±.017 0.124±.022

-

0.746±.004 0.025±.005 0.734 0.102 0.874±.015 0.143±.020

-

MF1

k=5000

MF1

Neural baseline Symbolic baseline Decision tree Logistic regression Random forest HGB

k=10000 FPR

0.982±.000 0.009±.000 0.919±.006 0.983±.001 0.008±.001 0.968±.008 0.024±.006 0.810±.013 0.976±.009 0.018±.007 0.982±.001 0.008±.000 0.921±.002 0.985±.000 0.007±.000 0.981±.004 0.009±.003 0.916±.006 0.982±.005 0.009±.004 0.886±.003 0.073±.011 0.715±.042 0.890±.005 0.061±.018 0.966±.008 0.026±.006 0.789±.008 0.975±.009 0.020±.007 0.741±.010 0.734 0.793±.053

0.023±.010 0.102 0.260±.076

-

0.752±.004 0.734 0.792±.024

MF1

BF1

FPR

0.013±.000 0.786±.024 0.970±.010 0.022±.008 0.124±.009 0.664±.060 0.840±.000 0.117±.000 0.053±.014 0.853±.104 0.966±.043 0.029±.038 0.221±.007 0.500±.008 0.770±.010 0.234±.012 0.029±.003 0.891±.055 0.993±.004 0.005±.003 0.027±.018 0.936±.010 0.998±.000 0.002±.000

0.018±.006 0.102 0.260±.035

0.921±.006 0.818±.021 0.925±.003 0.925±.005 0.713±.040 0.783±.014

0.981±.002 0.966±.011 0.984±.002 0.981±.003 0.895±.011 0.966±.009

0.009±.001 0.027±.009 0.008±.002 0.010±.003 0.046±.015 0.027±.007

-

0.755±.003 0.734 0.829±.032

0.032±.031 0.102 0.207±.046

Table 13: Hybrid-view comparison on CIC-IDS2018 across per-class training sizes k. Results report F1 and FPR as average ± standard deviation. Best F1 (highest) and FPR (lowest) for each k are shown in bold. k=50 System Symbolic-only baseline Neural product (baseline) DST-IDS fusion [43]

k=100

k=250

k=500

k=1000

F1

FPR

F1

FPR

F1

FPR

F1

FPR

0.841±.023 0.782±.064 0.827±.065

0.006±.000 0.029±.015 0.024±.014

0.739±.021 0.888±.019 0.879±.040

0.099±.024 0.014±.004 0.012±.004

0.801±.072 0.936±.030 0.920±.027

0.077±.063 0.006±.003 0.010±.005

0.818±.082 0.955±.018 0.943±.018

0.060±.067 0.003±.002 0.006±.002

F1

k=2500

k=5000

F1

FPR

0.857±.014 0.086±.018 0.835±.024 0.950±.022 0.003±.001 0.967±.011 0.962±.014 0.003±.001 0.966±.005

0.093±.021 0.003±.000 0.004±.001

D EEP W EAVE (PoE) 0.867±.035 0.020±.016 0.925±.031 0.009±.004 0.978±.006 0.004±.003 0.974±.008 0.001±.001 0.961±.023 D EEP W EAVE (Guarded) 0.759±.036 0.008±.004 0.823±.077 0.023±.029 0.865±.024 0.008±.005 0.899±.024 0.005±.003 0.952±.015 D EEP W EAVE (Anchored) 0.805±.019 0.003±.002 0.753±.029 0.092±.029 0.843±.047 0.067±.040 0.815±.055 0.048±.058 0.818±.032 D EEP W EAVE (Same-Class Boost) 0.709±.040 0.049±.016 0.820±.084 0.051±.030 0.913±.039 0.012±.006 0.934±.004 0.006±.001 0.954±.007 D EEP W EAVE (Deferred) 0.870±.037 0.018±.016 0.760±.176 0.026±.035 0.894±.102 0.003±.003 0.974±.008 0.001±.001 0.961±.023 D EEP W EAVE (Hard Gate) 0.749±.041 0.016±.014 0.818±.068 0.027±.027 0.897±.023 0.008±.005 0.927±.045 0.011±.014 0.963±.014 D EEP W EAVE (Safety Net) 0.862±.043 0.017±.011 0.922±.019 0.011±.006 0.956±.011 0.008±.005 0.971±.008 0.004±.002 0.956±.038

FPR

F1

k=10000 FPR

0.849±.001 0.077±.007 0.970±.012 0.002±.001 0.970±.008 0.002±.001

F1

FPR

0.849±.001 0.077±.007 0.977±.010 0.001±.001 0.973±.010 0.002±.001

0.006±.005 0.967±.029 0.036±.048 0.985±.002 0.005±.004 0.952±.028 0.004±.004 0.962±.019 0.002±.001 0.971±.015 0.002±.001 0.970±.013 0.091±.024 0.867±.019 0.071±.000 0.828±.044 0.096±.035 0.840±.022 0.005±.004 0.957±.003 0.004±.001 0.960±.011 0.003±.000 0.968±.007 0.006±.005 0.967±.028 0.036±.048 0.985±.002 0.005±.004 0.932±.039 0.004±.001 0.966±.012 0.004±.000 0.969±.010 0.003±.000 0.974±.009 0.020±.020 0.944±.048 0.045±.055 0.982±.006 0.008±.002 0.983±.004

0.012±.003 0.003±.001 0.079±.010 0.003±.000 0.031±.031 0.002±.001 0.007±.003

At the largest budget, however, HGB reaches 0.936 MF1 and exceeds the gated variants, which lie between 0.921 and 0.925. The gated policies keep FPR at or below 0.014 while maintaining DR near 0.90 to 1.00. Logistic regression also detects many attacks, but its FPR remains between approximately 0.22 and 0.28. Safety Net is the main exception among the coupled models: its permissive rescue path raises FPR to roughly 0.02 to 0.08. The flow-view advantage therefore comes from combining high detection with low FPR and correct family assignment. C.1.3

Hybrid view

Table 13 combines packet and flow neural evidence with predicates from both views. A D EEP W EAVE policy leads at every training size, although the best policy varies with k. Deferred leads at k = 50 and k = 500, Product of Experts (PoE) at k = 100, 250, 2500, and 5000, Hard Gate at k = 1000, and Safety Net at k = 10000. At k = 50, Deferred reaches 0.870 MF1, compared with 0.782 for the neural product and 0.827 for calibrated DST-IDS fusion. PoE reaches 0.978 at k = 250 and 0.985 at k = 5000. By k = 10000, Safety Net reaches 0.983, only 0.006 above the neural product and 0.010 above DST-IDS. Policy choice has a larger effect on hybrid FPR. Anchored reaches 0.003 at k = 50, but rises to 0.048 to 0.096 at several larger budgets when evidence from either view can trigger an alert. PoE, Guarded, Same-Class Boost, and Hard Gate are generally better controlled. At k = 10000, Safety Net combines 0.983 MF1 and 0.998 DR with an FPR of 0.007, compared with 0.001 for the neural product. Its small MF1 gain therefore carries a small false-alert cost. C.1.4

Cross-view assessment

The packet and flow sweeps show that symbolic predicates provide useful class structure before the neural models have seen enough examples to learn the same distinctions. The 200× comparison concerns performance-equivalent label budgets, not training time or uniform improvement at every operating point. The effect is smaller in the hybrid view because its neural baseline already combines complementary packet and flow representations. The benefit also depends on the policy and the quality of the predicates. Strict policies control FPR but may suppress correct neural predictions when symbolic support is incomplete, whereas permissive policies preserve detection at the cost of more false alarms. At large budgets, HGB leads in the flow view, the packet random forest matches or exceeds the strongest couplings, and the hybrid baselines close most of the gap. The results therefore support a bounded conclusion: D EEP W EAVE is most useful when labels are scarce, while its high-data benefit depends on how the coupling handles incomplete or inaccurate symbolic evidence. C.2

Threshold-free Detection Performance

The preceding results use a fixed operating threshold. To separate ranking quality from threshold selection, we compare D EEP W EAVE with two unsupervised detectors in a one-versus-benign setting. ROC-AUC measures rank separation independently of prevalence, whereas the PR-AUC baseline depends on attack-family prevalence and is more 27

DeepWeave

A P REPRINT

demanding for rare families. D EEP W EAVE uses P (family) as its score; the unsupervised systems use their native anomaly scores. The systems retain their native test bases: D EEP W EAVE and KnowML+KitNET use a held-out 20% split of 565,525 flows, while faithful Kitsune uses the streamed Tuesday–Friday original captures. The comparison therefore concerns family-level separation rather than identical test instances. Per-class Detection Performance. Figure 7 shows that D EEP W EAVE separates all five families, with ROC-AUC between 0.997 and 1.000. PR-AUC remains 0.818 for web attacks and 0.674 for bot traffic despite their low prevalence, indicating that the lower precision-recall scores mainly reflect class imbalance. The unsupervised detectors have complementary blind spots. Faithful Kitsune performs well on DoS and PortScan but is near or below chance on web attacks, bot traffic, and brute force. FTP-Patator is its clearest failure (ROC-AUC 0.045), as the anomaly score ranks attacks below benign traffic. KnowML+KitNET separates DoS, web attacks, and brute force, but fails on PortScan (0.210) and is only slightly above chance on bot traffic (0.594). Since both baselines use KitNET, their different failures point to the feature representation. Neither covers all five families. Overall Discrimination. Figure 8 pools all attacks against benign traffic. D EEP W EAVE reaches 0.996 ROC-AUC, compared with 0.962 for KnowML+KitNET and 0.890 for faithful Kitsune. Abundant volumetric attacks narrow the pooled gap and conceal some family-level failures. ROC-AUC provides the safer cross-system comparison because attack prevalence differs across the evaluations (0.20, 0.28, and 0.40); PR-AUC should be interpreted within each system.

(a) Per family ROC-AUC

(b) Per family PR-AUC

Figure 7: Per-family threshold-free detection quality on CIC-IDS2017 flow: ROC-AUC (left) and PR-AUC (right), each attack family scored one-versus-benign. The dashed line marks chance (ROC-AUC = 0.5); bars below it are anti-correlated with the attack.

(a) Overall ROC-AUC curve

(b) Overall PR-AUC curve

Figure 8: Overall pooled attack-versus-benign ROC (left) and precision–recall (right) curves, one per system. Prevalence differs per system and is annotated on the precision–recall panel.

C.3

Additional Adversarial Robustness Results

Table 14 provides a detailed view of the Attack success rate (ASR) per attack class.

28

DeepWeave

A P REPRINT

Table 14: Attack success rate (ASR) by attack class under the PANTS [26]-inspired proportional per-flow feature-space attack. Parentheses in the column headings give each class’s share of the 111,301 attack flows in the natural-prior test split. Weighted ASR is flow-weighted by these frequencies; class mean is the unweighted mean across attack classes. Lower is better. System

DoS (68.2%)

PortScan (28.5%)

BruteForce (2.5%)

WebAttack (0.4%)

Bot (0.4%)

Weighted ASR

Class mean

Symbolic baseline Neural baseline

32.2% 13.3%

3.6% 72.5%

0.0% 44.7%

9.9% 33.8%

4.1% 72.4%

23.1% 31.3%

10.0% 47.3%

D EEP W EAVE (Safety Net) D EEP W EAVE (Guarded) D EEP W EAVE (Anchored) D EEP W EAVE (Hard Gate)

26.2% 31.2% 28.5% 31.2%

48.8% 50.3% 61.5% 75.8%

49.6% 38.0% 55.3% 36.5%

13.0% 2.5% 2.0% 7.5%

59.7% 4.4% 44.0% 32.0%

33.3% 36.6% 38.5% 44.0%

39.5% 25.3% 38.3% 36.6%

C.4

Additional Explainability Results

Additional Explanation Visualization.

(a) D EEP W EAVE global explanation for detection of bot attacks.

(b) D EEP W EAVE global explanation for detection of port scan attacks.

(c) D EEP W EAVE local explanation given for the detection of a brute force attack.

(d) D EEP W EAVE local explanation given for the detection of a DoS attack.

Figure 9: D EEP W EAVE’s explanations visualization.

Proof-path coverage. Coverage measures the fraction of attack alerts whose decision can be attributed to at least one named symbolic clause. We evaluate coverage on CIC-IDS2017 flow traffic and NF-CSE-CIC-IDS2018-v3 packet traffic. The packet setting is particularly informative because its coupling retains an open neural path, allowing the model in principle to raise an attack alert without using a symbolic rule. Figure 10a separates alerts decided by standalone sufficient rules, neural helper rules, and the neural path alone. Guarded coupling attributes every attack alert to a rule by construction. Under Anchored coupling, approximately three quarters of alerts are supported by standalone sufficient rules, while the remainder use neural-supported clauses. More importantly, the packet model produces no attack alerts through its open neural path alone, even though the architecture permits that outcome. Every observed alert is therefore associated with a named rule across the evaluated datasets and traffic views. The composition of the explanations changes with the labelled-data budget. As shown in Figure 10b, sufficient rules account for 84.5% of attack alerts at k = 5, compared with 46.3% at k = 500. As the neural model receives more 29

DeepWeave

A P REPRINT

Table 15: Clause fidelity for Guarded coupling on CIC-IDS2017 flow traffic at k = 50. Clause

Role

Alerts Precision Recall

Benign gate

Disqualifier 15,625

0.990

0.987

Bot sufficient Bot helper

Sufficient Helper

82 27

0.902 0.593

0.796

Brute-force helper

Helper

245

0.784

0.985

DoS sufficient DoS helper

Sufficient Helper

2,440 287

0.993 0.693

0.964

PortScan sufficient PortScan helper

Sufficient Helper

605 588

0.997 0.968

0.981

Web Attack sufficient Sufficient

101

0.990

0.877

labelled examples, the model increasingly uses helper clauses that combine neural evidence with broader symbolic conditions. High-precision sufficient rules therefore dominate in the low-data setting, while neural-supported proofs become more prominent as the classifier improves.

(a) Composition of attack-alert proof paths across coupling architectures and views.

(b) Attack-alert proof composition across training sizes for CICIDS2017 flow traffic.

Figure 10: D EEP W EAVE’s Attack-alert proof paths.

Clause fidelity. Coverage alone does not establish whether the deciding clause is reliable. We therefore measure each clause’s precision on held-out test traffic and the recall of the attack class it supports. Clause precision measures how often an alert attributed to the clause is correct, while class recall indicates whether high precision is obtained only by abstaining on most attacks. Table 15 shows that sufficient rules are highly selective, with test precision between 0.90 and 1.00. Helper clauses are intentionally broader and have precision between 0.59 and 0.97, which explains why their authority is conditioned on compatible neural evidence. Class recall remains between 0.80 and 0.99, indicating that the rule base does not obtain high precision simply by explaining a negligible fraction of attacks. The observed results therefore support both the role assignment and the decision to prevent lower-precision helper clauses from raising alerts independently. Analyst-facing interpretation. We next examine whether the generated explanations can be expressed using traffic properties and attack behaviors familiar to an analyst. Table 16 translates representative clauses into plain-language descriptions and relates them to MITRE ATT&CK techniques. The mapping is an analyst interpretation of the recovered traffic conditions, not an automatically inferred ATT&CK classification. The recovered conditions align with recognizable behaviors, including web-based command and control, credential guessing, denial-of-service floods, service discovery, and exploitation of public-facing applications. These clauses are generated from feature statistics and validation behavior rather than manually authored attack descriptions. Their correspondence with documented behavior suggests that the construction pipeline can recover analyst-meaningful conditions. This interpretation has two limitations. First, helper clauses are broader and less reliable than sufficient clauses by design. Second, some conditions, particularly port values, reflect the evaluated captures and may not generalize to different deployments. Timing, flag, size, and directional relationships often describe the attack shape more generally, but the mining procedure does not guarantee that every retained rule will correspond cleanly to a documented tech30

DeepWeave

A P REPRINT

Table 16: Representative CIC-IDS2017 clauses and their analyst-assigned MITRE ATT&CK interpretations. Clause

Analyst reading

MITRE ATT&CK interpre- Precision tation

Bot sufficient Bot helper

Destination port 8080 and forward-window tier Low source port and small-payload tiers

Brute-force helper DoS sufficient

Destination port 21 or 22 and minimum-segment tier Destination port 80 and backward-length variance

DoS sufficient

Destination port 80 and FIN flag

DoS sufficient

Destination port 80, ACK-only traffic, and very short inter-arrival time High backward-packet rate and default forwardwindow tier Small packets and near-zero flow duration

T1071.001 Web Protocols T1071 Application Layer Protocol / T1573 Encrypted Channel T1110.001 Password Guessing T1499 Endpoint Denial of Service T1499.002 Service Exhaustion Flood T1499 Endpoint Denial of Service T1046 Network Service Discovery T1046 Network Service Discovery T1190 Exploit Public-Facing Application

PortScan sufficient PortScan helper

Web Attack suffi- Regular forward inter-arrival time and minimal paycient load

0.90 0.59 0.78 0.99 0.99 0.99 1.00 0.97 0.99

nique. The results should therefore be interpreted as evidence of structural interpretability rather than a substitute for analyst validation. Stability across training replicates. A useful explanation should remain stable when the model is retrained on different samples from the same distribution. We train five replicates using a fixed test set and measure how often they produce the same explanation for each observation. For D EEP W EAVE, agreement means selecting the same winning clause. For the neural baseline, agreement means selecting the same highest-ranked feature using Integrated Gradients or SHAP. Figure 11a shows that the symbolic winning clause agrees across replicates for 96.4% of observations. When all replicates also agree on the predicted label, clause agreement rises to approximately 99.9%. Integrated Gradients selects the same top feature for 24.3% of observations, while SHAP does so for 18.8%. Even top-three agreement reaches only 62% and 52%, respectively. Thus, the symbolic explanations are substantially less sensitive to training variation than post-hoc feature rankings. This stability varies by attack family. Web Attack, benign traffic, and PortScan obtain agreement of 1.00, 0.99, and 0.98, respectively. Bot obtains only 0.54, consistent with its smaller test support and the presence of competing sufficient and helper proofs. Classes with selective, high-precision sufficient rules therefore also produce the most stable explanations.

(a) Explanation agreement of explainability methods across five CIC-IDS2017 training replicates

(b) Per-class agreement of symbolic winning clauses across replicates

Figure 11: Explanation stability of D EEP W EAVE

Contrast with neural attribution. Table 17 illustrates the aggregate findings using representative observations. The comparison places the winning D EEP W EAVE clause beside Integrated Gradients and SHAP attributions for the neural baseline on the same traffic sample. 31

DeepWeave

A P REPRINT

Table 17: Intrinsic symbolic explanations and post-hoc neural attributions on representative CIC-IDS2017 flow observations. True class

DeepWeave

Bot

Destination port 8080 and forward initial-window tier

Brute Force DoS PortScan

Integrated Gradients

SHAP

Destination Port; neural prediction: benign Destination port 21 and minimum-segment-size tier Forward PSH Flags; neural prediction: benign Destination port 80 and backward-packet-length vari- Packet Length Variance; neural preance diction: DoS Backward packets/s and forward initial-window tier Destination Port; neural prediction: PortScan

Source Port Forward PSH Flags Packet Length Variance Total Backward Packets

The symbolic explanation identifies the concrete conditions and thresholds that participated in the decision. The attribution methods instead produce feature rankings whose leading feature often changes across replicates. For Bot and Brute Force, the neural baseline predicts benign, so its attribution explains a missed detection rather than the correct attack label. D EEP W EAVE’s proof explains the attack decision that the model actually made. The DoS case demonstrates that the two explanation types can agree when the neural decision is stable. Both neural attribution methods emphasize packet-length variance, while the symbolic proof contains the corresponding packetlength condition. The largest contrast therefore occurs on uncertain observations, where the neural baseline and its post-hoc explanations are least stable and where explicit proof evidence is most valuable. Summary. D EEP W EAVE provides named proof paths for all observed attack alerts in the evaluated settings. Highprecision sufficient clauses yield reliable and stable explanations, while broader helper clauses contribute only with neural agreement. Many recovered clauses correspond to recognizable attack behaviors, although dataset-specific conditions still require analyst scrutiny. Compared with neural feature attribution, the symbolic explanations are more stable across retraining and describe the computation supporting the predicted class rather than approximating it after the decision. C.5

Additional Computational Efficiency Results

Table 18 reports inference, memory, and training costs under the vectorized evaluator for six programs, from the rulefree L0 classifier to the Anchored-tiered (i.e. multiple quantiles per feature) L5 model. Each configuration is executed five times on CIC-IDS2017 flow data at k = 500, with the test set, hardware, and evaluation batch size of 1,024 fixed. Table 18: System cost across six symbolic-program configurations on CIC-IDS2017 flow data at k = 500. Peak RSS covers the complete evaluation process. Program L0 neural-only L1 single Anchored L2 gated L3 gated + numeric L4 tiered L5 Anchored-tiered

Neural leaves

SDD edges

Throughput (flows/s)

Latency (ms/flow)

Eval. RSS (MB)

Train (s/epoch)

1 3 8 10 10 15

267 333 538 484 484 461

53,964 20,317 6,993 5,948 5,749 3,919

0.0194 0.0493 0.1431 0.1696 0.1819 0.2707

2,283.1 2,200.3 1,408.8 1,493.9 583.6 929.2

1.42 2.56 5.95 8.09 13.32 32.85

Figure 12a relates inference throughput to neural-leaf count: from L0 to L5, throughput falls from 53,964 to 3,919 flows per second and latency rises from 0.0194 to 0.2707 ms per flow. In contrast, Figure 12b shows the increase in training cost. L3 and L4 share ten neural leaves and 484 SDD edges, so their throughput differs by only 3.5%, yet training rises from 8.09 to 13.32seconds per epoch. Tiered predicates (i.e. multiple quantiles per numerical feature) therefore affect training more than inference. Figure 13 shows that compiled size peaks at 538 SDD edges at L2 before falling to 461 at L5. RSS is not a circuit-size proxy because it covers the complete process. Leaf count, circuit size, and tiered predicates therefore remain distinct costs; their absolute values are specific to the Apple M3 system used here.

32

DeepWeave

(a) Inference throughput against neural-leaf count.

A P REPRINT

(b) Training time per epoch against rule-clause count.

Figure 12: D EEP W EAVE inference throughput (left) and training time (right) with increasing complexity.

Figure 13: Compiled SDD size across the six program rungs.

D

Automatic Rule Generation

D.1

Rule Generation Approaches

The pipeline supports three sources of candidate rules. Scenario A derives rules from labelled traffic. For each attack class, it ranks features by their separation from benign or non-target traffic, instantiates numeric and categorical predicates, and forms short conjunctions. Identifiers, timestampderived attributes, constant features, and other disallowed variables are removed before candidates enter the common Rule IR. Scenario B converts expert knowledge into dataset-compatible rules. MITRE ATT&CK techniques are expressed as network-observable behaviours and mapped to available features. Thresholds and categorical values are instantiated from the construction reference, and each mapping records whether the behaviour is fully, partially, or not observable. Claims that require unavailable temporal, payload, or cross-flow information are retained as documentation but not converted into predicates. Scenario C asks an LLM to propose candidates from a fixed catalogue. The provider-neutral request supplies feature and rule schemas, class descriptions, complete feature rankings with directionality, construction and reference statistics, class-local literal catalogues, and the MITRE ATT&CK evidence used in Scenario B. The model may combine listed predicates but cannot introduce features, operators, or thresholds. It returns Rule IR JSON, and the pipeline rejects malformed or unsupported proposals before evaluation. All three scenarios use the same validation and selection procedure. Candidates are rejected or assigned sufficient, helper, or disqualifier roles according to their precision, recall, FPR, and construction-to-validation stability. Pareto and firing-set filters remove dominated or near-duplicate rules, while per-class and per-role limits bound the shortlist. The coupling screen selects the final Rule IR, which is compiled deterministically into Prolog. Generation pipeline hyperparameters. Shared parameters define the role gates, permitted stability gaps, redundancy threshold, shortlist limits, validation FAR budgets, screening depth, and final rule budget. These settings govern validation and selection rather than candidate generation. Scenario-specific parameters only bound how each candidate pool is constructed. Scenario A configures feature ranking, quantile grids, categorical-value filters, conjunction length, support requirements, and search limits. Scenario B 33

DeepWeave

A P REPRINT

Table 19: CIC-IDS2017 fully automated rule generation results at k = 500, one replicate, using Guarded coupling. Rule source

Macro-F1

Accuracy

Detection

FAR (%)

Scenario A: data-driven Scenario B: expert/MITRE Scenario C: Codex Scenario C: Claude

0.4300 0.4399 0.7671 0.7033

0.9045 0.9396 0.9481 0.9198

0.5171 0.7016 0.7691 0.6177

0.0627 0.2080 0.7820 0.6032

Existing Rules (Guarded)†

0.8408

0.9836

0.9648

1.1640

Note: Macro-F1 covers benign and five attack classes. † The existing Guarded system is a historical baseline, not a fourth generation arm. Generated-arm results use one replicate.

selects the expert profile, ATT&CK-to-feature mappings, template expansion rules, and proposal limits. Scenario C records the provider, model, structured request, supplied evidence, literal catalogue, output limits, and supported decoding settings. In every case, candidates must satisfy the same role and stability gates before they can enter the final program. D.2

Scenario Performance

Experiment hyperparameters. All scenarios emit the same Rule IR and use shared validation gates. Each arm starts from the same neural checkpoint and independently optimizes its neural and differentiable rule parameters under Guarded coupling with soft predicates. Shared gates require sufficient-rule precision/FPR of 0.90/0.015, helper recall/FPR of 0.35/0.05, and disqualifier precision/FPR of 0.90/0.02. Construction-to-validation precision and FPR gaps are limited to 0.20 and 0.05. Rules contain at most three literals. The shortlist retains 32 candidates per class and role, removes firing sets with Jaccard similarity above 0.98, and passes at most 12 rules to the coupling screen. Validation macro-F1 selects checkpoints under an active 1% FAR budget. Scenario A retains the 12 highest-ranked stable features per attack-versus-benign contrast. Its ranking combines the Kolmogorov-Smirnov statistic, Cliff’s delta, Hellinger distance, AUC, Cramér’s V , and total variation distance with weights 0.30, 0.20, 0.20, 0.20, 0.05, and 0.05. Numeric predicates use lower quantiles {0.001, 0.003, 0.005, 0.03, 0.10, 0.30} and upper quantiles {0.80, 0.90, 0.97, 0.995, 0.997, 0.999}. Conjunctions draw from the 40 highest-ranked predicates and are limited to 5,000 candidates, 120 seconds, and 10 validation true positives. The process generated 19,326 candidates and retained 12. Scenario B uses the semantic-v4 expert profile and numeric quantiles {0.05, 0.25, 0.50, 0.75, 0.95}. Its 15 templates contain at most three literals and emit at most 4,096 candidates, with categorical search limited to 31 subsets. Scenario C uses a structured request containing complete feature rankings, construction and reference statistics, classlocal literal catalogues, and Scenario B’s MITRE ATT&CK evidence. Claude proposed 20 candidates and validation retained 10 helpers; Codex proposed seven and retained all seven. The corrected matcher equates integral integer and floating-point categorical values, allowing numeric port literals to match the dataset. Automated Generation Results. Table XVIII reports the results after independent end-to-end optimization from the common checkpoint. Codex leads the automatic arms with 0.7671 macro-F1 and 0.7691 detection at 0.7820% FAR. Claude reaches 0.7033 macro-F1 and 0.6177 detection at 0.6032% FAR. Scenarios A and B reach 0.4300 and 0.4399 macro-F1, while the historical rules remain strongest at 0.8408.

34

Related documents

• A deep generative adversarial framework with rat-optimized feature selection for efficient intrusion detection in large-scale cloud network traffic environments#1241723
• Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey#199396
• End - to - End Deep Learning for Detecting Web Attacks#87798
• A comprehensive survey on intrusion detection systems with advances in machine learning, deep learning and emerging cybersecurity challenges#339534
• Deep Learning Approaches for Intelligent Intrusion Detection Systems: Bridging Computer Science and Cybersecurity#199466