DeepWeave：为基于机器学习的网络入侵检测系统编织神经与符号证据
DeepWeave: Weaving Neural and Symbolic Evidence for ML-Based Network Intrusion Detection System
Raoul Saad · Enkeleda Bardhi · Andrea Agiollo · Fernando Kuipers
中文摘要
基于机器学习的网络入侵检测系统能识别复杂流量模式，但通常需要大量标注攻击数据，在部署偏移下性能下降，且为分析人员提供的证据有限。DeepWeave 是一种概率神经符号网络入侵检测系统（NIDS），将逻辑作为检测的组成部分。它自动构建并验证可解释规则，将神经预测表示为概率谓词，并通过在包级、流级和混合视图上的显式耦合策略协调两类证据来源。由此产生的证明为规则支持的告警提供内在解释。在多个数据集上，DeepWeave 提升了低数据检测、误报控制、可迁移性和鲁棒性。每类攻击仅用 50 个标注包观测时，相比匹配的神经基线，宏 F1 从 0.632 提升至 0.924，攻击误报率从 0.075 降至 0.008。其证明也比事后神经归因更稳定，而批处理推理使概率推理保持实用。这些结果展示了标签高效、可适应且可检查的神经符号入侵检测。
关键要点
- 01问题：ML 入侵检测依赖大量标注数据、部署偏移下退化且证据有限
- 02方法：自动构建可解释规则，将神经预测转为概率谓词，用耦合策略协调多视图证据
- 03结果：每类仅 50 个标注包时宏 F1 从 0.632 升至 0.924，攻击误报率从 0.075 降至 0.008
- 04结果：证明比事后神经归因更稳定，批处理推理使概率推理实用
- 05局限：摘要未提及具体局限
解读
尚无解读。
原始英文摘要
arXiv:2610.41541v1 Announce Type: cross Abstract: Machine learning-based network intrusion detection systems can recognize complex traffic patterns, but often require substantial labelled attack data, degrade under deployment shift, and provide limited evidence for analysts. We present DeepWeave, a probabilistic neuro-symbolic Network Intrusion Detection System (NIDS) that makes logic an integral part of detection. DeepWeave automatically constructs and validates interpretable rules, represents neural predictions as probabilistic predicates, and reconciles both evidence sources through explicit coupling policies over packet-, flow-, and hybrid-views. The resulting proofs provide intrinsic explanations for rule-supported alerts. Across multiple datasets, DeepWeave improves low-data detection, false-positive control, transferability, and robustness. With only 50 labelled packet observations per attack class, it improves macro-F1 from 0.632 to 0.924 and reduces the attack false-positive rate from 0.075 to 0.008 over the matched neural baseline. Its proofs are also more stable than post-hoc neural attributions, while batched inference keeps probabilistic reasoning practical. These results demonstrate label-efficient, adaptable, and inspectable neuro-symbolic intrusion detection.