Abstract
Network intrusion detection focuses on the accurate and reliable identification of malicious activity in network traffic and is therefore a fundamental component of modern cyber defense. However, despite impressive reported results, many current intrusion detection methods remain susceptible to traffic shifts, limiting their reliability beyond controlled benchmark conditions. To overcome this, we propose CEAFE (Causal Effect-Aware Feature Encoding), which frames categorical encoding as a causal inference problem. Through Pearl’s backdoor adjustment combined with Bayesian smoothing, CEAFE produces three complementary feature views: observational, causal, and confounding which help to separate invariant predictors from environment-driven noise. Building on CEAFE, we present BB-NF (BanditBoost NeuroForest), a customized differentiable soft decision forest
that integrates multi-armed bandit-based hyperparameter optimization with SharedGates for learnable feature selection, while retaining interpretability through gate-based importance and Accumulated Local Effects (ALE) analysis. We validate the method with leakage-free nested cross validation (CV) and
sanity check is performed with 70-30, 80-20 and 90-10 train-test splits. Results are reported on the 80-20 split because it gives the lowest overall error. We also perform external validation on a larger flow-based dataset to better reflect operational conditions and avoid overly optimistic conclusions from benchmark-only evaluation. Under a leakage-free evaluation protocol, BB-NF outperforms several baseline methods, achieving 99.02% accuracy and 99.73% ROC-AUC on held-out test data. Nested CV achieves 99.45% ROC-AUC, and the small CV test gap of
0.28% supports stable generalization with no evidence of data leakage.