Signature-based intrusion detection has one hard limit: it can only catch what it already has a rule for. New attack pattern, zero-day variant, slightly reworded payload — walks right past it. That's not a tuning problem, it's architectural.

The other extreme, pure ML-based detection, has the opposite problem: it flags anomalies without telling you why, so you get alert fatigue and analysts who stop trusting the model.

The combination that actually holds up: signatures for the known stuff (fast, cheap, zero false positives on textbook attacks), plus a trained model that scores the traffic your rules didn't recognize — with an explanation for every flag, not just a confidence score.

That's the architecture behind ml_ids: 264 signature rules across 15 attack categories, layered with an XGBoost model trained on a 39-feature traffic pipeline, LIME explanations so you can see exactly why something fired, sub-30ms detection, and a full dashboard with real-time alerts. Full Python source, self-hosted — you can read every line of what's flagging your traffic instead of trusting a black box.

If you're a student, researcher, or running a homelab and want to actually study how hybrid detection works instead of just deploying an enterprise appliance, this is built for that. Happy to answer questions on the detection pipeline or the signature set if anyone's digging into IDS design.

Most IDS tools are a black box. Packetwatch is not.

ml_ids is a self-hosted hybrid intrusion detection system: a custom-trained XGBoost model plus 264 signature rules across 15 attack categories. It catches known threats and the ones nobody has named yet.

What it actually does

• Hybrid detection — machine learning + rules, not one or the other

• Trained on UNSW-NB15 (99.50% accuracy), validated on CICIDS2017

• Sub-30ms latency, Flask app, LIME explanations, 8-page dashboard, WebSocket alerts

• 39-feature pipeline you can inspect, retrain, and extend

What you get (lifetime access)

• Python source

• Pretrained model

• Signature rules

• Feature pipeline

• Sample datasets

• Docs

Built for cybersecurity students, researchers, and homelab operators who want a transparent IDS they can actually run and understand.

Launch price: $10 one-time. Lifetime.

First 10 people: use code FIRST10 at checkout for 30% off. Ten uses. Then it's gone.

Checkout: https://whop.com/checkout/plan_Pbg51lkEWj22t

If you are running a lab, writing a paper, or learning detection engineering — this is the stack. Grab one of the first ten spots and get in.

Most people pick a side and pretend the other doesn't exist.

Signature engines are precise until the payload is new. Then they're blind. Pure ML will flag the weird traffic — and then shrug when you ask which field made it weird. In a lab that's annoying. On a network you actually care about, it's why the tool gets turned off.

The hybrid setup I run is boring on purpose:

• 264 handcrafted rules across 15 attack categories for the stuff we already understand

• XGBoost on 39 flow features (UNSW-NB15, checked on CICIDS2017) for the stuff we don't

• Both fire on the same request. You get attack type + severity from rules, malicious/benign + confidence from the model

• LIME on every prediction so TTL, port, protocol, whatever actually moved the score is visible

The interesting cases are the disagreements. Rule says clean, model says 0.91 malicious — that's where you learn something. Rule says exploit, model says benign — that's where your signatures are rotting.

I built this as a Flask app you run locally. Sub-30ms. Dashboard, WebSocket alerts, export to JSON/CSV/PDF. It's for students, researchers, and homelab people who want to see the guts, not rent a SIEM.

If you're implementing hybrid detection or teaching it, steal the architecture. The comparison layer is the whole point.