VX-One study tests typed decision heads for perimeter triage
Original title: VX-One: Typed, Calibrated Decision Heads for Real-Time Perimeter Triage - An empirical study of unknown-attack honesty, cascade gray zones, and calibration under drift
A 100K–10M-parameter model is measured against XGBoost and a Suricata cascade on public IDS sets.
The paper presents VX-One, a small multi-head network that emits a calibrated gate, a closed-set choice including unknown, and an ordinal score, reporting about 0.7–1.7 ms p50 on CPU. On UNSW-NB15, CIC-IDS2017, and EMBER2024 it beats listed baselines on some detection metrics, including 0.711 versus 0.637 under temporal drift on CIC-IDS2017, while XGBoost wins multi-class attribution. A Suricata cascade with 52,674 Emerging-Threats rules leaves a gray zone of about 99.9% of payload-less flows; calibration ECE rises from 0.04 to 0.40 under drift for every method tested.
Unconfirmed: Results are the authors' measurements; commercial "System One" APIs are described without independent confirmation.
- Leave-one-family-out detection holds on 9 of 9 UNSW folds but fails on a CIC recon family.
- Combined cascade recall is reported at or above 0.978.
- Abstention thresholds transfer poorly across benchmarks.
- The paper says ranking partly survives when calibration collapses.
- Vendors
- Microsoft
From the original article
1 min read at arxiv.orgPerimeter triage faces a latency/semantics trade-off: signature engines are fast and format-safe but blind to unseen attacks, while generative models are semantic but slow and produce unparseable output.
By Juan S. Santillana · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.