IDSForge: Self-Explaining Network Intrusion Detection Through Neural Behavioral Rule Learning

Abstract

Anomaly-based network intrusion detection systems (NIDS) can detect previously unseen attacks by identifying deviations from benign traffic. However, deep learning-based anomaly detectors typically rely on implicit decision boundaries, and post-hoc explanations may not faithfully reflect the detection logic. This makes alerts difficult to interpret and audit. To address this issue, we present IDSForge, an anomaly-based NIDS that directly learns explicit, executable behavioral rules from benign traffic, making its detection logic interpretable by design. IDSForge uses the same rule set for detection and explanation, ensuring explanation fidelity by construction. It uses an explicit distributional autoencoder trained only on benign samples to learn axis-aligned regions of benign traffic. A high-speed rule compiler then consolidates these instance-specific regions into a compact set of feature-level interval constraints. These rules can be executed directly by popular NIDS engines, supporting high-throughput inspection with low overhead. To adapt to changes in traffic, a self-distillation co-evolver updates the model and rule set incrementally when the false-positive rate on analyst-verified traffic exceeds a target threshold. Our evaluation shows that IDSForge reduces F1 error by $5.7\times$ to $47\times$ relative to state-of-the-art anomaly-based baselines. Deployed in Suricata, IDSForge sustains a throughput of 7.8 Gbps with a median per-packet latency overhead of 3.1 $μ\text{s}$.