Imagine you're a notary public who also happens to be a locksmith. You can pick any lock in town, but the moment you do it for a court case, every tool you touched, every door you opened, and every scratch on the cylinder has to be logged, photographed, and sealed in an evidence bag. That's the gap between a lab IDS and a forensic one — the lock-picking skill is table stakes; the chain-of-custody paperwork is the actual product. MODEXRE is a dual-mode pipeline built around a previously validated XGBoost classifier trained on synthetic data. Laboratory mode trains and certifies models on public and synthetic datasets. Formal mode freezes the certified model, hash-verifies it with SHA-256 before every inference run, and logs each prediction alongside SHAP explanations into a chain-of-custody record. The ingestion layer normalizes Suricata alerts, CEF firewall logs, and packet captures into the OCSF schema — a non-trivial engineering choice that makes the system evidence-format-agnostic. The genuinely interesting part of this paper is not the final numbers — it's the four documented failures that drove architectural decisions. A timestamp feature leaked temporal ordering into training, inflating Kitsune's F1-macro to 0.984; after correction it fell to 0.662. A 78-feature reference model failed to classify a real SSH brute-force alert because the feature set didn't cover firewall-log fields. Causal temporal flow aggregation (computing features only from past context) rescued Kitsune multiclass F1-macro from 0.394 to 0.932. And a certification defect — exposed only when a real PCAP hit the pipeline — revealed the system had silently trained a binary classifier instead of the intended multiclass one. After correction, one capture went from 100% malicious flags to 87% Normal with the scanning host correctly tagged as Reconnaissance. The default four-class certified model reaches F1-macro 0.9538 on CICIDS2017-derived evidence. When expanded to the full 18-category task — a far harder problem — F1-macro drops to 0.6214. The authors report this honestly rather than burying it, which is the right move: multiclass network intrusion detection at 18 categories is a genuinely difficult open problem, and 0.62 is a real number for a real task. Architecturally, this is gradient-boosted trees (XGBoost) plus post-hoc SHAP explanations, not a neural approach. The forensic wrapper — hash chaining, model certification, OCSF normalization — is the novel systems contribution. The ML component itself is deliberately conservative: XGBoost is well-understood, auditable, and fast, which matters when a court needs to understand why the model said what it said. The integrity story is mixed. Validation is on CICIDS2017, a widely used but aging benchmark (2017 vintage, known label-noise issues). The real-PCAP test is the strongest validation signal — it's where three of the four failures were caught — but it's a single capture from the authors' own environment. No independent replication exists, no code release is mentioned, and there's no pre-registration. The honesty about failures partially compensates: you trust authors more when they show you where they were wrong. The practical gap is deployment at scale with diverse evidence sources and adversarial traffic. The 18-class F1 of 0.6214 is the honest measure of where the system stands for real forensic casework — usable for triage, not yet reliable enough to be the sole basis for prosecution. The next milestone is clear: push multiclass F1 above 0.80 on a modern benchmark with adversarial evasion samples, and get an independent forensic lab to replicate the chain-of-custody workflow end-to-end.
