2D-AEF: Low-latency sparse expert routing for network intrusion detection

Network intrusion detection systems must operate under strict latency constraints while maintaining reliable detection performance across heterogeneous traffic patterns. Traditional ensemble methods often improve predictive performance but require multiple model evaluations during inference, increasing computational costs. This paper presents 2D-AEF, a two-stage adaptive framework for network intrusion detection based on sparse conditional computation. A shallow decision-tree gatekeeper routes each traffic sample to a class-specialized expert selected through an offline search over model–feature subset pairs. Unlike conventional ensembles, only one expert is activated during inference, reducing computational overhead. The proposed framework was evaluated on UNSW-NB15 binary, UNSW-NB15 multi-class, and leakage-controlled CIC-IDS2018 robust scenarios. Experimental comparisons included strong standalone baselines and ensemble methods based on hard voting, soft voting, and stacking. Across ten random seeds, 2D-AEF achieved macro-F1 scores of 0.890, 0.461, and 0.871 on the three scenarios, respectively. While not consistently outperforming the strongest classifiers in predictive performance, the proposed framework reduced median inference latency by factors ranging from 6.5x to 12.5x compared with stacking. The results demonstrate that class-conditioned sparse routing provides an effective strategy for balancing detection performance and inference efficiency in network intrusion detection systems.