# Jev-IDS: System One Models for Network Intrusion Detection

arXiv: https://arxiv.org/abs/2610.01079 · HTML: https://mlsanity.com/paper/2610.01079/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 22 references that are in the map.
- First posted on arXiv 1 Oct 2026.

## Builds on (most cited first, 9 of 9)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [Finetuned Language Models Are Zero-Shot Learners](https://mlsanity.com/paper/2109.01652/) (2021)
- [From Language to Action: A Review of Large Language Models as Autonomous Agents and Tool Users](https://mlsanity.com/paper/2508.17281/) (2025)
- [Large Language Models in Wireless Application Design: In-Context Learning-enhanced Automatic Network Intrusion Detection](https://mlsanity.com/paper/2405.11002/) (2024)
- [Jev-Mem: System-One-Controlled Agentic Memory for Efficient AI Agents](https://mlsanity.com/paper/2609.23986/) (2026)
- [Calibrated Decisions at Scale: Converting Police Crash Narratives into Probabilistic Crash Variables with a System One Model (Jev)](https://mlsanity.com/paper/2609.24052/) (2026)
- [Think Fast: Real-Time IoT Intrusion Reasoning Using IDS and LLMs at the Edge Gateway](https://mlsanity.com/paper/2511.18230/) (2025)
- [From Flows to Words: Can Zero-/Few-Shot LLMs Detect Network Intrusions? A Grammar-Constrained, Calibrated Evaluation on UNSW-NB15](https://mlsanity.com/paper/2510.17883/) (2025)
- [Are We Shooting Flies with Cannons? Trade-off Analysis for AI-based 5G Intrusion Detection](https://mlsanity.com/paper/2608.26844/) (2026)

## Abstract (arXiv)

Machine-learning Network Intrusion Detection Systems (IDS) depend on substantial labeled datasets and task-specific training, whereas Large Language Models (LLMs) detection can analyze flow records directly but incurs higher inference cost and latency, with less constrained outputs. This paper presents JEV-IDS, an open experimental general NIDS based on the Jev System One Model (SOM) to detect zero day intrusions Under label scarcity. JEV-IDS serializes one flow per request and asks JEV two questions: a binary attack probability and a finite-choice traffic category. Our results show that, at k=1, JEV was 4.8 times faster and 3.8 times cheaper than GPT-5.6 Luna, with 1.5 times higher novel-attack recall; it also produced 15 times fewer false alarms than a low-data Random Forest. Across 5,400 decisions on a 300-flow NSL-KDD pilot split, JEV achieved F1-Score 0.859, precision 0.941, recall 0.790, and novel-attack recall 0.838. Increasing k to 2 reduced its F1-Score to 0.839.