1. A detection rules generation engine, comprising: an initial population creation subsystem configured to receive filtered network traffic instances from a network tap and to build an initial population of decision trees having nodes which are sorted based on an information gain of network features of the traffic instances; a parents selection subsystem configured to select two individuals from the population based on a selection probability; a depth selection subsystem configured to select a depth among the nodes of the decision trees; a parents crossover subsystem configured to apply a crossover operation on the selected individuals; a parents mutation subsystem configured to apply a mutation operation on the selected individuals; and a population replacement subsystem configured to generate a next population.