VLM-Guided Noisy Label Detection for Structured Network Traffic in Low-Resource IDS

Accurate Intrusion Detection Systems (IDS) rely on high-quality labeled network traffic data, yet real-world deployments suffer from scarce annotations and label noise introduced during automated or crowdsourced labeling pipelines. We present VLM-IDs, a multimodal noisy label detection pipeline combining CoTeaching-based filtering, Adaptive Cluster Density(ACD) sub-clustering, and a fine-tuned Vision Language Model (VLM). Our approach converts per-feature flow statistics into three-channel Shannon Entropy density maps enabling a Qwen2-VL-2B model to localize high-risk feature bin regions and guide selective augmentation and density-aware feature injection into a Random Forest classifier. Experiments on DoHBrw2020 and Gotham2025 under symmetric noise rates of 20-45\% with N=250-1000 show consistent improvements over a raw RF baseline and the prior method RAPIER, with up to 13.4 percentage-point F1 improvement on DoHBrw2020 at p=0.40.