VX-One delivers decisions for real-time perimeter triage at approximately 0.7–1.7 milliseconds p50 latency on CPU, but its benchmark results separate detection gains from calibration failures. In a study submitted on October 21, 2026, author Juan Salas reports that the network beats competing models on some detection tests while losing to XGBoost on multi-class attack attribution.
Typed decisions for real-time perimeter triage
VX-One is a multi-head network with 100K–10M parameters that produces three structured outputs: a calibrated gate, a selection from a fixed candidate set containing an explicit unknown option, and an ordinal score. The model uses multi-task training and temperature calibration for each head.
The study addresses a trade-off between speed and output structure. Signature engines provide fast, format-safe results but miss unseen attacks; generative models offer semantic capabilities but run slowly and produce outputs that cannot be parsed. VX-One’s measured 0.7–1.7 ms p50 CPU latency accompanies its typed decision outputs.
Detection gains do not extend to attribution
VX-One leads detection on UNSW-NB15 and on CIC-IDS2017 under temporal drift, while XGBoost wins multi-class attribution across all three evaluated benchmarks. The evaluation covers UNSW-NB15, CIC-IDS2017 and EMBER2024, comparing VX-One with calibrated XGBoost, Random-Forest, MLP and Kitsune.
On CIC-IDS2017 under drift, the reported detection AUROC comparison is 0.711 versus 0.637 in VX-One’s favor. The study also assesses detection through false-positive rates at a 95% true-positive rate.
Unknown-family detection varies by dataset. A leave-one-family-out gate detects previously unseen families in 9/9 UNSW folds, yet performs below chance on the CIC reconnaissance family. Abstention thresholds also transfer poorly between benchmarks.
Calibration deteriorates under temporal drift
Every method studied suffers a calibration collapse under temporal drift, with ECE rising from 0.04 to 0.40. Ranking ability partially survives even as calibration deteriorates.
The evaluation therefore reports two distinct outcomes: VX-One retains a detection advantage in the drift test, but calibration worsens across all tested methods.
A signature-first cascade recovers gray-zone traffic
A two-phase system pairing Suricata with VX-One achieves combined recall of at least 0.978. Salas tests this approach to real-time perimeter triage over five days of CIC-IDS2017, using 52,674 Emerging-Threats rules in the signature stage before VX-One processes the second phase.
On payload-less reconstructions, signature engines resolve approximately 0.1% of flows, leaving roughly 99.9% of traffic in a gray zone. The second phase recovers nearly all relevant traffic from that unresolved group.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.