VX-One study tests typed heads for real-time perimeter triage
Original title: VX-One: Typed, Calibrated Decision Heads for Real-Time Perimeter Triage - An empirical study of unknown-attack honesty, cascade gray zones, and calibration under drift
Under CIC-IDS2017 drift VX-One leads detection, but calibration error rises from 0.04 to 0.40 for every method.
VX-One is a 100K–10M-parameter multi-head network that emits a calibrated gate, a closed-set choice including an explicit unknown option, and an ordinal score, with about 0.7–1.7 ms p50 latency on CPU. The study compares it with calibrated XGBoost, Random Forest, MLP, and Kitsune on UNSW-NB15, CIC-IDS2017, and EMBER2024, and measures a Suricata-to-VX-One cascade over five days of CIC-IDS2017. VX-One wins detection on UNSW-NB15 and under temporal drift on CIC-IDS2017, while XGBoost wins multi-class attribution on all three benchmarks. Signature engines resolve about 0.1% of payload-less flows; Phase 2 recovers a gray zone of about 99.9%, and calibration collapses under drift for every method.
- Cascade uses Suricata with 52,674 Emerging-Threats rules, then VX-One.
- Drift result on CIC-IDS2017 is 0.711 versus 0.637.
- Leave-one-family-out detects unseen families on 9 of 9 UNSW folds.
- The gate falls below chance on the CIC reconnaissance family.
- Combined cascade recall is at least 0.978; ECE moves from 0.04 to 0.40.
- Vendors
- Microsoft
- AI models
- VX-OneMicrosoft-Decision-1
From the original article
1 min read at huggingface.co
Perimeter triage faces a latency/semantics trade-off: signature engines are fast and format-safe but blind to unseen attacks, while generative models are semantic but slow and produce unparseable output.
By Juan S. Santillana · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.