Property-driven training of robust NIDS

Network intrusion detection systems (NIDS) are essential for securing critical infrastructure, as cyberattacks often target industrial control system networks. AI techniques are increasingly used to detect malicious network traffic – but AI can also be exploited by attackers. To address this challenge, differentiable logics have been proposed to train AI models that are robust against adversarial AI attacks.

As part of an NFC project, we have developed a framework for training neural networks to satisfy logical constraints using  differentiable logics. This framework enabled a classifier that can detect malicious network traffic, is robust against adversarial attacks and includes human domain knowledge. We aim to reduce alert fatigue by ruling out clearly benign network traffic while capturing typical attacks like DoS.

The classifier generalizes across dataset, allowing NIDS to adapt to changing traffic patterns. In this workshop, we will demonstrate how differentiable logics enhance both prediction performance and explainability.