VERITY Network Intelligence
Unsupervised flow-metadata anomaly detection
Operational context
What network teams actually struggle with.
Common pain points
- Alert fatigue — high FPR tools flood the SOC; median investigation ~25 min per alert.
- Zero-days — signature and supervised models miss attacks absent from training data.
- Label scarcity — labeled attack corpora are stale, expensive, and environment-specific.
- Data residency — healthcare, OT, and classified networks cannot send flows to cloud ML.
- Opaque scores — "anomaly 0.87" tells analysts little about what deviated or why.
What you need instead
- Detection that adapts to your normal traffic without attack labels.
- Actionable output: which behavioral dimensions deviated and whether independent checks agree.
- Operator-controlled tradeoff between recall and false-positive rate — not a black-box threshold.
- On-prem, CPU-only deployment with no telemetry or cloud dependency.
Product definition
A behavioral fidelity engine — not another classifier.
VERITY Network Intelligence measures whether each flow's metadata matches a calibrated benign baseline across independent behavioral dimensions. Deviation is the detection.
0
Attack labels for calibration or detection
1
Operator parameter — sensitivity α (+ mode)
560 KB
Engine · <70 MB · CPU only
No signature matching — fidelity to normal. Attack detection emerges when fidelity breaks, including for novel behavior.
Model card v3.1.1 · credasis.ai/network-modelcard
Scope
What it measures — and what it cannot.
In scope
- Flow-level metadata: timing, duration, bytes, packets, flags, ports, protocol fields.
- CICFlowMeter-compatible feature vectors (NetFlow/IPFIX/Zeek → extraction pipeline).
- DoS/DDoS, port scans, brute force, botnet C2 patterns, infiltration, many web attacks at flow level.
- Enterprise, IoT, encrypted-traffic environments (session/window aggregation for Tor/VPN/DoH).
- Air-gapped, classified, and resource-constrained sites.
Out of scope
- Payload inspection — SQL injection via HTTP body, XSS in JavaScript content.
- Application-layer content analysis, DLP, or malware sandboxing.
- Inline blocking (VERITY is a detection/measurement layer; enforcement stays with your stack).
- Replacement for full packet capture or deep packet inspection where required by policy.
SQL Injection on CICIDS-2017: recall 0.077 (n=13) — reported openly. Payload attacks sit below flow-metadata resolution.
Operating modes
Two modes from one codebase — choose your FPR budget.
| Precision mode | Detection mode | |
|---|---|---|
| Best for | Low-FPR environments, tier-1 alert volume control | Higher recall on clustered / mimicry attacks (e.g. FTP-Patator) |
| CICIDS-2017 (α=0.05) | 11/15 classes ≥0.93 recall · FPR 3.8% · F1 0.963 (Friday) | 14/15 classes ≥0.93 recall · ~+2.5% FPR vs Precision |
| Calibration | <30 seconds | Minutes (adds geometric rescue path) |
| Per-flow latency | ~1 ms | ~4 ms |
| Throughput (batch, M2 Mini) | ~1M flows/s | ~250K flows/s |
| Engine size | ~500 KB | ~560 KB |
FTP-Patator: Precision R=0.603 → Detection R=0.995. Detection mode adds analyst load — assess SOC capacity before enabling.
Detection logic
Multi-perspective measurement, composed by union.
Each flow is scored from independent behavioral perspectives. No single score is averaged away — the operator sees which dimensions deviated and which detection path fired.
Typicality (S0)
Per-dimension deviation from calibrated benign baseline. Catches extreme void-space attacks (DDoS, high-volume anomalies).
Peer consensus (S1)
Neighborhood agreement among similar flows. Catches clustered attacks (SSH brute force, coordinated scans).
Geometric rescue (S2)
Detection mode only. Successive hurdles for flows that mimic benign traffic per-flow but fail geometric consistency (FTP-Patator).
Evasion test: feature jitter can defeat the rescue path but final recall stays high via complementary S0/S1 coverage — paths are structurally complementary.
Analyst output
Verdicts your SOC can act on — not probabilities.
COMMITconsistent with baseline
CAUTIONborderline on ≥1 dimension
ESCALATEmultiple perspectives deviate
REFUSEcalibration compromised — no output
Example decomposition (vs. conventional alert):
- Conventional: "Anomaly score 0.87 — investigate."
- VERITY: "Timing ↑ · port behavior ↑ · 4/6 dimensions agree · path: peer consensus · α=0.05"
Investigation starts at the right behavioral dimension instead of from zero.
Audit & provenance
- Cryptographic provenance on verdicts (AES-256-GCM at rest).
- Deterministic replay: same input → same output.
- Exportable JSON/CEF for SIEM correlation and compliance records.
Validated performance
CICIDS-2017 corrected (Engelen et al., IEEE SPW 2021)
5-fold StratifiedKFold · shuffle=True · random_state=42 · zero attack labels for calibration/detection · α=0.05
| Attack class | n | Precision R | Detection R |
|---|---|---|---|
| DoS Hulk / DDoS / Botnet | 254K+ | 1.000 | 1.000 |
| Infiltration / Portscan | 71K+ | 0.947–0.993 | 0.952–0.998 |
| SSH-Patator / Web BF / XSS | 73–3K | 0.988–1.000 | 0.995–1.000 |
| FTP-Patator | 3,972 | 0.603 | 0.995 |
| SQL Injection | 13 | 0.067 | 0.077 |
14/15
Detection ≥0.93 recall
11/15
Precision ≥0.93 recall
0.963
Friday F1 · Precision · α=0.05
3.8%
FPR · Precision mode
Full per-class tables · operating curves · cross-dataset results in model card v3.1.1
Operator control
One knob: sensitivity α — full operating curve, not a hidden threshold.
Thresholds emerge from your calibrated benign population. You choose the recall/FPR tradeoff. No retraining when you move α.
| Friday · Precision mode | ||||
|---|---|---|---|---|
| α | P | R | FPR | F1 |
| 0.01 | 0.984 | 0.650 | 0.8% | 0.784 |
| 0.03 | 0.964 | 0.944 | 2.3% | 0.954 |
| 0.05 | 0.959 | 0.968 | 3.8% | 0.963 |
| 0.10 | 0.927 | 0.993 | 7.1% | 0.959 |
Cross-dataset (no retuning)
- CSE-CIC-IDS2018: same engine, same α — 12 classes validated.
- BCCC-IoT-2024: F1 0.887 at α=0.10.
- CIC-DoH: F1 0.716 at α=0.10 (malicious DoH under investigation).
Start conservative (low α), measure alert volume for your traffic, then tune — same instrument, no model retrain.
Architecture
Signal flow — from tap to SIEM.
[ SPAN / TAP / NetFlow / IPFIX / Zeek ]
│
▼
[ Feature extraction — CICFlowMeter-compatible pipeline ]
│
▼
[ Calibration store — 50K benign flows from YOUR environment ]
│ ▲
│ Integrity guard (refuses poisoned calibration)
▼
[ VERITY engine — Precision or Detection mode · α setting ]
│
├── Per-flow verdict (COMMIT / CAUTION / ESCALATE)
├── Per-dimension fidelity decomposition
└── Detection path + provenance signature
│
▼
[ Output ] ──→ JSON API / batch CSV / CEF syslog ──→ SIEM (Splunk, Sentinel, QRadar, Elastic)
│
└── Optional: analyst review UI · offline forensic replay
No cloud control plane. No runtime internet. Feature extraction is your existing or bundled pipeline — VERITY scores the vectors.
Deployment options
Three common integration patterns.
1 · Batch / forensic
Export flow CSVs (day/week tranche). Score offline on a jump host or SOC workstation. Lowest friction for pilot evaluation. Matches public demo workflow.
Use case: hospital VLAN assessment, incident retrospective, vendor bake-off.
2 · On-prem appliance
Small Linux VM or container on span-fed collector. Continuous batch or micro-batch scoring. Alerts to local SIEM via syslog/CEF. Fully air-gapped.
Use case: OT plant, classified enclave, MSSP managed sensor.
3 · API integration
Embed scoring library or REST endpoint in your flow pipeline (Zeek script → POST batches → verdicts). Sub-ms to low-ms per flow depending on mode.
Use case: SOAR automation, custom NDR stack, OEM embedding.
| Resource | Precision | Detection |
|---|---|---|
| RAM | ~200 MB | ~250 MB |
| Hardware | Any modern x64/ARM CPU — no GPU · observed on Apple M2 Mac Mini, 16 GB | |
| Total footprint | ~50 MB | <70 MB |
Calibration & integrity
Calibrate on normal. Refuse if calibration is poisoned.
1
Collect ~50,000 benign flows from the target segment (maintenance window or known-good period). No attack labels. No GPU.
2
Integrity guard verifies calibration data before deployment. At 1% attack contamination, F1 collapses without guard; with guard, system REFUSES to deploy.
3
Thresholds emerge from held-out benign rows at your chosen α. Re-calibrate when traffic profile shifts materially (new VLAN, major app rollout).
4
Re-calibration cadence — not daily retraining. Minutes of benign observation, not months of labeled attack corpora.
Plan calibration during a known-clean window or use a dedicated benign slice. Multi-day guard validation is ongoing — single-day E2E guard tests passed.
Day-to-day operations
Run, monitor, and tune — typical SOC workflow.
▸
Day 0: Install engine + feature extractor. Bind to span, NetFlow exporter, or Zeek log path.
▸
Day 1: Run calibration on benign slice. Confirm guard passes. Set initial α conservatively (e.g. 0.01–0.03).
▸
Week 1: Measure alert volume vs. existing IDS/NDR. Review decomposition fields — which dimensions drive noise?
▸
Ongoing: Tune α using operating curve. Enable Detection mode only if FPR budget allows. Re-calibrate on network change.
What to monitor
- Alerts per million benign flows (FPR proxy).
- Verdict distribution: COMMIT vs CAUTION vs ESCALATE.
- Top deviating dimensions (timing, port behavior, volume, etc.).
- Calibration guard status — any REFUSE events.
- Scoring latency and queue depth (batch deployments).
- SIEM ticket quality: time-to-triage vs. legacy rules.
Comparison
Where VERITY fits in your stack.
| Capability | Signature IDS/IPS | Supervised ML NIDS | Cloud NDR | VERITY |
|---|---|---|---|---|
| Zero-day / novel behavior | Weak | Limited | Varies | Core design |
| Attack labels for detection | N/A (rules) | Required | Required | None |
| Air-gapped / on-prem | Yes | Often GPU+cloud | Cloud-dependent | Native |
| Actionable alert detail | Rule name | Opaque score | Varies | Decomposition |
| Operator FPR control | Rule tuning | Retrain | Vendor UI | α + operating curve |
| Calibration integrity check | No | No | Varies | Guard + REFUSE |
| Payload / app-layer attacks | With DPI | With features | Often | Flow metadata only |
VERITY complements firewalls, EDR, and DPI — it adds label-free behavioral detection where signatures and supervised models struggle. Not a replacement for full-stack inspection.
Use cases
Environments where teams evaluate VERITY first.
Healthcare / HIPAA
Flow metadata only — no PHI required. See dedicated hospital slide for IoMT segments, pilot path, and compliance workflow.
OT / critical infra
Air-gapped span tap. CPU-only sensor on plant floor. Detects scans, lateral movement, protocol anomalies without cloud exfiltration.
Enterprise SOC
Side-by-side with existing NDR for a week. Compare alert lists and triage time. CEF into Splunk, Sentinel, or QRadar.
Encrypted traffic
Tor: per-flow recall low, per-session (W=50) recall 0.910 — temporal aggregation exposes intent encryption cannot hide. DoH/VPN: session-level measurement paths validated; per-flow limits documented.
IoT / medical devices
BCCC-IoT-2024: F1 0.887 across 10 attack classes, 11 device types. Behavioral baseline adapts to device-heavy VLANs without attack signatures.
Healthcare & hospital IT
Evaluation path for hospitals — HIPAA-aware, on-prem first.
Why hospitals evaluate VERITY
- Ransomware & lateral movement — east-west scans and C2 often visible in flow metadata before payload tools trigger.
- Medical IoT / IoMT — device-heavy VLANs with weak signatures; behavioral baseline adapts without attack labels (BCCC-IoT F1 0.887).
- Cloud NDR blocked — flow metadata stays on-prem; no telemetry, no GPU farm, no exfiltration to vendor cloud.
- Segment complexity — clinical, admin, guest Wi‑Fi, vendor VPN, imaging — each can calibrate independently.
No PHI required: we score timing, bytes, ports, flags — not URLs, hostnames with patient IDs, or packet payloads.
Recommended pilot (lowest risk)
1
NDA + scope doc — one-page pilot: segment, duration, de-identification rules, no cloud egress.
2
Start non-clinical — admin or guest VLAN first; expand to IoMT after privacy/security sign-off.
3
CSV tranche — one week of NetFlow/IPFIX/Zeek exports; hash or truncate IPs; strip hostnames if policy requires.
4
Offline scoring — on your jump host or ours under NDA; compare alert list to SIEM/NDR for same window.
5
Optional phase 2 — on-prem appliance + CEF into Splunk/Sentinel/QRadar after change control.
| What we need from hospital IT | What you get back |
|---|---|
| Flow export format (NetFlow, Zeek, CICFlowMeter CSV) | Per-flow verdicts + dimension decomposition |
| Segment/VLAN scope + known-good calibration window | Operating curve at your chosen α |
| Privacy officer / security approval path | Side-by-side alert comparison + FPR estimate |
| Existing stack context (SIEM, NDR, MSSP) | Pilot summary — no IP or algorithm internals exposed |
Complements firewalls, EDR, and DPI — does not replace HIPAA-required controls or payload inspection
Adversarial validation
Tested failure modes — not just benchmark wins.
| Test | Result |
|---|---|
| Temporal split (60/40, no shuffle) | Detection holds across time-shifted traffic |
| Calibration poisoning 1% / 3% / 5% | Guard detects and REFUSES deployment |
| Feature jitter σ≥1.0 | Rescue path degraded; union recall remains 1.000 |
| Cross-dataset 2017 → 2018 | No retuning required |
| Dimension ablation | port_behavior most critical (ΔF1 −0.239) |
Untested: protocol-aware mimicry, adaptive long-horizon manipulation — disclose in pilot scope. Independent red-team review completed (formal findings closed with artifacts).
Evaluation path
How to run a pilot on your traffic.
A
Self-serve demo — Upload corrected CICIDS CSVs at veritynetwork.credasis.ai (PIN on request). Validates protocol and UI; not a substitute for your traffic.
B
CSV tranche pilot — One week of de-identified flow exports from your environment. We score offline under NDA; you compare alerts to existing tools. Lowest risk for healthcare/OT.
C
On-prem side-by-side — Engine on your collector; continuous scoring for 30–90 days. CEF/syslog into your SIEM. Requires change-control approval.
Success criteria we recommend: alert volume at chosen α, triage time, catch of known incidents in retrospective tranche, and analyst rating of decomposition usefulness.
Next steps
Resources & contact
One-pager — credasis.ai/network-deck/one-pager (print / PDF)
Model card v3.1.1 — credasis.ai/network-modelcard
Live demo — veritynetwork.credasis.ai (PIN by request)
Benchmark PDF — available on network page
Deployment package — under NDA on request
Marty Oelrich — Co-Founder & Chief Scientist
marty@credasis.ai
Tony Mangnall — Co-Founder & CEO
tony@credasis.ai
Credasis AI Inc. · Delaware C-Corporation · Patent Pending · © 2026