VERITY Network Intelligence
Unsupervised flow-metadata anomaly detection · Patent Pending
Measures whether network traffic behaves consistently with a calibrated benign baseline — across multiple independent dimensions. No attack signatures. No attack labels for calibration. CPU-only, air-gapped deployment. One operator parameter: sensitivity α.
14/15
Detection mode classes ≥0.93 recall · CICIDS-2017
0.963
Friday F1 · Precision mode · α=0.05
560 KB
Engine · <70 MB footprint · ~1 ms/flow
0
Attack labels · GPU · cloud · telemetry
What it solves
- Zero-day and novel behavior without signature updates
- Alert fatigue — operator-chosen α and full operating curve
- Actionable decomposition (which dimensions deviated, not opaque scores)
- Air-gapped / HIPAA / OT sites that cannot use cloud NDR
Out of scope
- Payload inspection (SQLi in HTTP body, XSS content)
- Inline blocking — detection layer; enforcement stays in your stack
- Replacement for DPI or EDR where policy requires them
Two modes
| Precision | Detection | |
|---|---|---|
| FPR @ α=0.05 | 3.8% | ~+2.5% vs Precision |
| Recall target | 11/15 ≥0.93 | 14/15 ≥0.93 |
| Calibration | <30 s | Minutes |
| Latency | ~1 ms/flow | ~4 ms/flow |
Deployment
NetFlow / Zeek / SPAN → CICFlowMeter features
→ Calibrate on 50K benign flows (integrity guard)
→ VERITY scores → CEF/syslog → SIEM
Batch CSV pilot · on-prem appliance · API embed
Hospital / healthcare pilot (HIPAA-aware)
- No PHI — flow metadata only (timing, bytes, ports, flags); hash/truncate IPs as required
- Start non-clinical — admin or guest VLAN, then IoMT after privacy sign-off
- Week-one CSV tranche — offline scoring under NDA; compare to existing SIEM/NDR
- Phase 2 — on-prem sensor + CEF into Splunk, Sentinel, or QRadar
Verdicts
- COMMIT — consistent with baseline
- CAUTION — borderline dimension
- ESCALATE — multiple perspectives deviate
- REFUSE — calibration compromised; no output
Evaluation paths
- A — Demo at veritynetwork.credasis.ai (PIN on request)
- B — De-identified CSV tranche (lowest risk)
- C — On-prem side-by-side 30–90 days
Documented limits: SQL Injection recall 0.077 (payload-level). FTP-Patator Precision R=0.603 (Detection R=0.995). Throughput/latency observed on M2 Mac Mini — production pipeline depends on feature extraction I/O.