VERITY measures whether network traffic is consistent with calibrated normal behavior. When the observed behavior and the calibrated baseline diverge, the divergence is the detection. This works on traffic the system has never seen before, across encryption boundaries, and across network types — using the same instrument with no modification.

No attack signatures are learned. No labeled attack data is used for threshold derivation. No GPU is required. No internet connection is needed. The system calibrates from a benign observation window and measures deviation. A novel attack is not a special case — it is the default operating mode.

Label usage (full disclosure): In offline evaluation, benign rows are selected using ground-truth labels (oracle benign selection). In deployment, calibration uses an assumed-benign observation window with contamination checks. Scale contribution is calibration-emergent: each scale's weight is derived from its benign hold-out intensity — scales that produce high false-alarm rates on calibration data are automatically suppressed. No labels are used in scale weighting. Detection thresholds use only benign calibration data.

Four measurement scales operate independently on the same traffic. Each calibrates from benign only. Each captures anomalies invisible to the others:

• MICRO measures per-flow behavioral deviation across independent feature dimensions.
• MESO measures per-entity behavioral trajectory — how each source IP's behavior evolves within and across time windows.
• CAMPO measures behavioral coherence across entities — when unrelated hosts independently converge to the same behavioral signature, the coherence exceeds calibrated baseline.
• TRAJECTORY tracks per-entity temporal drift for persistent threat detection in streaming deployment.

Scale weighting emerges from calibration. Each scale is measured on a benign hold-out during calibration. Scales with low benign intensity (well-calibrated) receive high weight. Scales with high benign intensity (noisy) are automatically suppressed. The data's own geometry decides which perspectives to trust.

Mode discovery decomposes heterogeneous benign populations into behavioral modes using deterministic, silhouette-validated clustering. When geometric separation is present, modes are retained; otherwise global calibration is used.

┌──────────────────────────────────────────────────────────────────────┐
│                                                                      │
│  OPERATIONAL PROFILE                                                 │
│                                                                      │
│  Total footprint:        ~50 MB (engine + encoder + atlas)           │
│  Hardware requirement:   CPU only — no GPU required                  │
│  Encoding throughput:    70,000+ flows/sec (Apple Silicon)           │
│                          15,000+ flows/sec (CPU only)                │
│  Detection throughput:   1,300–2,100 flows/sec (full engine)         │
│  Cold-start calibration: 60 seconds on benign observation window     │
│  Recalibration:          Milliseconds (threshold re-derive)          │
│  Dependencies:           Python · numpy · scikit-learn · torch-cpu   │
│  Network requirement:    None — fully air-gapped operation           │
│  Operator parameters:    One — α (false positive budget)             │
│  Scale weighting:        Calibration-emergent (no labels)            │
│  Mode discovery:         Deterministic, silhouette-validated         │
│  Measurement scales:     4 (MICRO · MESO · CAMPO · TRAJECTORY)      │
│                                                                      │
└──────────────────────────────────────────────────────────────────────┘

All multi-scale results use calibration-emergent weighted composition. Flow-only results are unchanged.

Accuracy Profiles

All results: 5-fold cross-validated. Calibration on benign only. Default α=0.05.

CICIDS-2017 (Enterprise, weighted multi-scale)

Thursday: AUC 0.998 with 12 stable modes (silhouette 0.552). Per-mode calibration on infiltration traffic — measuring each flow against its own kind of benign.

CSE-CIC-IDS-2018 (Enterprise, 10 daily captures)

Random-sampled 500K flows (seed=42) from full daily captures (5.4M–7.4M rows each).

Three days at AUC 1.000 correspond to volumetric DoS/DDoS floods with degenerate feature profiles — AUC 1.000 is expected, not exceptional. Two days show F1 ≈ 0 because they contain fewer than 25 attacks in 500K flows — base rate, not instrument failure. Attack-weighted F1 across all 10 days: 0.876 (versus published supervised baselines: LightGBM F1 0.740, RandomForest F1 0.744).

MAWIFlow (Real Backbone, flow-level)

† Random sample of 500,000 flows (seed=42).

MAWI 2016/2021 reported at flow level. Multi-scale mode discovery finds strong structure (sil 0.95) but fragments per-mode calibration at 11–13 modes — deferred to v3.2.

MAWI 2011 (Real Backbone, weighted multi-scale)

76K flows. Multi-scale weighted composition stable across folds.

Other Domains (flow-level)

DoH: updated from 0.931 to 0.938 after a feature-mapping patch. Precision ≥ 0.989 at all α levels.

GPU Cluster Behavioral Fidelity (same measurement principles)

Comparison to Supervised Baselines

Cross-Temporal Resilience

Both approaches degrade under decade-scale concept drift. The operational difference is recovery cost.

FPR Consistency

At α=0.05, observed FPR ranges 2.3–5.3% across all evaluated datasets: legacy (1999), modern (2015), enterprise (2017–2018), IoT (2021–2024), real backbone (2011–2021), GPU clusters (2025–2026). FPR is controlled by α.

Documented Limitations

Calibration assumes a clean benign observation window. A contamination check warns on elevated anomaly rates in the calibration window; operator responsibility until automated integrity verification ships. Cross-temporal transfer degrades over a decade (AUC 0.53, comparable to supervised RF 0.61); recalibration recovers in minutes. Encoder coverage is strongest on enterprise/academic benign traffic — IoT and encrypted DNS feature mappings are weaker (DoH AUC 0.938 after feature-mapping patch). Adversarial evasion testing against adaptive mimicry has not been conducted. MAWI multi-scale produces fold instability at high mode counts — reported flow-only until adaptive mode granularity ships (v3.2).

All numbers from canonical validation logs. Weighted composition (calibration-emergent, no labels) as primary. The engine is the validation. Run it yourself.