arXiv preprint ·
VX-One: Typed, Calibrated Decision Heads for Real-Time Perimeter Triage
- Published
- Source
- arXiv preprint, posted before peer review
- Original
- Read it at arXiv
- Topics
Abstract
Perimeter triage faces a latency/semantics trade-off: signature engines are fast and format-safe but blind to unseen attacks, while generative models are semantic but slow and unparseable. We present VX-One, a small multi-head network (100K--10M parameters) with calibrated typed outputs: a binary gate, a closed-set choice with an explicit unknown option where the benchmark supports it (and abstention elsewhere), and an ordinal score. Heads are temperature-calibrated, with 0.7--1.7 ms single-event CPU p50 latency. We evaluate UNSW-NB15, CIC-IDS2017, and EMBER2024 against calibrated XGBoost, Random Forest, MLP, and Kitsune baselines, and measure a Suricata-to-VX-One cascade over five days of CIC-IDS2017. Results are deliberately double-sided: on UNSW the gate ties the best baseline (0.9837+/-0.0002 versus MLP 0.9835+/-0.0013 across three seeds), while VX-One wins temporal CIC detection (0.734+/-0.022 versus 0.639+/-0.027) but loses multi-class attribution to XGBoost. Under leave-one-family-out, the gate detects all nine UNSW families but drops below chance on CIC recon; CIC trees transfer better. Suricata resolves only about 0.1% of attacks on flow reconstructions and 0.2--2.2% on payload-bearing PCAPs; the strictly by-day Phase 2 recovers only the in-scope DoS/DDoS share on the wave day (recall 0.34, precision 0.97). Calibration collapses under temporal drift (ECE 0.04->0.40) for every method while ranking partly survives. We contribute a measured account of where typed calibrated decisions help perimeter triage, and where they fail.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Cryptography & Security
SAKURA: Serving Attention Key-Value State Under Rate Adaptation for Private Image Editing on Phones
AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things
Every Alarm Has a Cause: An Open Generator of Telecom Alarm Storms with Exact Root Causes, Bound to NORIA-O, RFC 8632 and TMF642
Adaptive Deadline- and Energy-Aware Caching Algorithms in Dynamic Multi-UAV Edge Networks
Low-Latency MoE Inference in Space Data Centers: A Wireless-Power-Transfer Perspective
Get the few papers worth your time in Cryptography & Security every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.