Network
The attack does not need a name to be detected.

VERITY Network Intelligence v3.1.2 is zero-day anomaly detection by design. No signatures. No training on attack data. No cloud dependency. Calibrate on benign traffic only. Attack labels are not used for calibration or detection. The deviation is the detection.

0.9990
CICIDS Friday AUC
0.924
MAWI 2021 AUC
0.954
MAWI 2016 AUC
Zero
Attack Labels Used
Model card → Technical brief → One-pager → Download model card
What it is

Detection without prior knowledge.

"Signatures catch what has been seen. Behavioral measurement catches what has not. The attack that has never been catalogued is still a deviation from the baseline, and deviation is measurable."

Signature-based detection works by pattern matching. It is fast, precise, and structurally limited to attacks that have been seen before. Zero-day attacks pass through invisible. So do the long tail of attacks that were never important enough to receive their own signature. The industry response has been to wait for the breach, write the signature, and hope no one else gets hit first.

VERITY takes a different approach. It calibrates on the benign traffic in your environment. It learns the behavioral shape of normal flows: volume, timing, directionality, session structure. Every incoming flow is measured against that baseline. The attack does not need a name. It does not need a signature. It does not need to have been seen before. It only needs to be different from normal, and difference is measurable.

What it does

The deviation is the detection.

VERITY calibrates on your benign traffic in a single pass. Every flow is then measured across four independent measurement perspectives, each calibrated from benign only. Flows that deviate are flagged. Flows near the decision boundary are escalated. When the system is uncertain, it says so.

Signature-based detection
Flow detected. Signature database queried. No match. Classification: benign. Action: none.

The attack is novel. There is no signature for it yet. The detector cannot distinguish it from legitimate traffic. The flow passes through.
VERITY measures
Flow exhibits behavioral characteristics that deviate from calibrated baseline. Multiple independent measurements converge on the deviation. Forensic signature generated. Verdict: anomalous. Operator view: which perspectives deviate, and by how much.

The system has never seen this attack. It does not need to.
01
Calibrate on normal
Point VERITY at your benign traffic. In a single pass it learns the behavioral shape of your network: volume, timing, directionality, uniformity, session patterns. No attack data required. No labels. No training.
02
Measure every flow
Each incoming flow is measured against the calibrated baseline across four independent perspectives. The engine requires agreement across measurements before committing to a verdict. A single noisy signal cannot drive a false positive.
03
Explain every flag
Every flagged flow shows which measurement perspectives deviate and by how much. Not an opaque anomaly score. A specific, verifiable measurement. Every alert carries a 28-byte forensic signature for deduplication and review.
Validated

v3.1.2 locked results.
Enterprise, backbone, and cross-domain.

5-fold cross-validated. Calibration on benign only. CICIDS multi-scale results independently reproduced on second hardware. Full tables, operating points, and limitations are in the external model card. Methodology stays off the public surface.

DatasetSettingAUCF1 @ α=0.05Notes
CICIDS-2017 FridayMulti-scale0.99900.972F1 0.992 at α=0.005
CICIDS-2017 WednesdayMulti-scale0.99860.957F1 0.995 at α=0.005
CICIDS-2017 TuesdayMulti-scale0.99850.470Low prevalence; α recovers F1
CICIDS-2017 ThursdayMulti-scale0.99840.910F1 0.969 at α=0.005
MAWI 2016Flow-only0.9540.608Real backbone; peak F1 0.634
MAWI 2021Multi-scale0.9240.521Independently reproduced
MAWI 2021Flow-only0.8600.517Shown for method contrast
UNSW TestFlow-level0.9800.924Modern lab traffic

BCCC-IoT withheld pending end-to-end reproduction. Live test drive: veritynetwork.credasis.ai.

Full benchmark results → Download benchmark PDF Read model card Technical brief (deck) Download model card
How it compares
PropertyVERITYSignature-based IDSBehavioral ML platforms
Encrypted trafficMeasures behaviorCannot inspectVaries
Zero-day attacksDetected as deviationRequires signatureVaries
Training requiredNoneContinuous signature updatesDays to weeks
Independent benchmark validationPublished, reproduciblen/aGenerally not published
GPU requiredNoNoTypically yes
Air-gapped capableYesVariesGenerally no
Engine size500–560 KBHundreds of MBGB-scale infrastructure
Forensic signature per alert28 bytesLimitedVaries
Deployment specifications

500 KB. Air-gapped. Two operating modes.

Precision mode
500 KB engine
~1 ms per flow
11/15 classes ≥ 93% recall
3.8% FPR at α=0.05
Detection mode
560 KB engine
~4 ms per flow
14/15 classes ≥ 93% recall
Genesis S2 rescue for mimicry attacks
Deployment
Customer hardware · data never leaves
Air-gapped · no internet required
<30 sec / mins calibration by mode
No attack labels for calibration or detection
Operating envelope

From Raspberry Pi to enterprise server.

The same 500–560 KB engine runs everywhere Python 3.9+ runs. Throughput scales with hardware. Latency is ~1 ms per flow in Precision mode and ~4 ms in Detection mode on workstation-class machines.

Edge
~1,200 flows/sec
Raspberry Pi 5

Industrial sensors. Remote sites. Air-gapped enclaves.
Workstation
~4,800 flows/sec
Apple M2 / M4

SOC analyst workstations. Mid-tier deployments. Development environments.
Server
~15,000 flows/sec
32-core enterprise server

Production traffic monitoring. Enterprise-scale deployments.
Get started

See it on your traffic.

Reproduce the v2.1 benchmarks on corrected public datasets. Request a technical briefing. Evaluate VERITY on your own traffic, on your own hardware, with your team operating the engine throughout.