one flow.
one request.
one verdict.

the request

Jev IDS runs on a new kind of AI, the System One Model (SOM). Instead of generating text, a SOM takes a state and standardized questions about it and answers each one with a probability. Jev IDS hands it one monitored network flow and gets back one verdict, attack or normal, with the probability behind it.

1. input

   one flow

   The monitoring record of a single connection: duration, protocol, service, bytes in and out.

2. jev

   one request

   State: the instructions, a few labeled examples and the flow. Questions: is_attack and category.

3. output

   one verdict

   attack · p_attack 0.82
   dos · confidence 0.84

Everything Jev is told lives in one versioned file, prompts/nsl-kdd/jev.json. Python adds only the flow and the examples, and the file's sha256 rides with every prediction, so any verdict traces back to the exact prompt. Examples are labeled by category only; attack names never reach a model. Both questions are answered in parallel over the same state, in one round trip.

Three baselines follow the same protocol: an LLM agent with a JSON output schema, a scikit-learn Random Forest trained on the same examples, and an Isolation Forest fitted on benign traffic alone. Same frozen split, same examples, same seeds.

evidence

Paper split of NSL-KDD: 2,000 flows, 1,126 of them attacks and 300 of those zero-day, of a kind absent from the example pool. Three seeds of examples, so 6,000 predictions per detector and k. Means over the three seeds, from the runs of 2026-09-22; the full tables and figures are in docs/results.md.

Jev against Gemini over all 6,000 paired verdicts at k = 1: 508 differ, Jev is right in 195 and Gemini in 313 (McNemar p < 0.001); Gemini leads at every k. On the 900 zero-day attacks at k = 1: 118 differ, Jev is right in 74 and Gemini in 44 (p = 0.007); Jev also leads at k = 2, and the two are indistinguishable at k = 4 and 8. Jev against the Random Forest over all flows at k = 1: 2,909 differ, Jev is right in 2,161 (p < 0.001). A forest trained on five rows calls almost everything an attack, which is why its recall is perfect and its precision is not: on the 874 benign flows it raised 764 false alarms, Jev 43.

limits worth knowing

• Cost is tokens times list price, not what was billed: $0.042 per million input tokens for Jev, output free; $0.75 input and $3.75 output for Gemini through 2026-12-31, doubling on 2027-01-01, with thinking tokens billed as output.
• Gemini's latency was measured with five processes in parallel on a congested day (transient 429, 500 and 504 answers, all repaired), so it is a real-day figure, not a floor. Jev's is the wall clock of one direct call to TypeSafe's API.
• Gemini 3.x cannot switch thinking off; it ran at the lowest level, about 200 reasoning tokens per flow.
• Every number is NSL-KDD's. NF-UQ-NIDS-v2 has a card and a preparation script and no run yet.
• Jev's noul answer carries no confidence; only the choice answer does.

try it

git clone https://github.com/jev-sec/jev-ids.git
cd jev-ids
uv sync
.env: TYPESAFE_API_KEY for Jev. Gemini: gcloud auth application-default login,
      GOOGLE_GENAI_USE_VERTEXAI=true, GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_LOCATION=global.

Download NSL-KDD into data/raw/nsl-kdd/ and prepare it once.

uv run python -m scripts.prepare_nsl_kdd
uv run jev-ids run --dataset data/nsl-kdd/dataset.json --detector jev --split smoke --k 0,1

The smoke split is five flows. The run writes results/<timestamp>-nsl-kdd-jev-smoke/ with config.json, one JSON row per flow in predictions.jsonl and the raw answers in responses.jsonl.

bring your own flows

Jev IDS is an independent research prototype, not a product. Its numbers come from one benchmark, NSL-KDD. It can still sit inside a commercial solution, and this is how.

where jev fits

A commercial IDS already has sensors, a flow exporter and a signature engine feeding a SIEM. Jev IDS replaces none of them. It sits beside the pipeline, off the packet path, and judges one flow record at a time.

• Second opinion on alerts. Send Jev the flow behind each alert the signature engine raised. p_attack ranks the queue, and the SOC reads the top first. On the paper split at k = 1, Jev raised 43 false alarms on 874 benign flows where a Random Forest raised 764.
• A net behind the signatures. Signatures miss what they have never seen. Sample the flows the engine passed as clean, or every flow to a critical asset, and let Jev judge them: it caught 75% of the zero-day attacks at k = 1, where the LLM caught 71%.
• A category for the playbook. The choice answer names the category with a confidence, so the SIEM routes dos, probe, r2l and u2r, or your own taxonomy, to different runbooks with no parser in between.
• Coverage from day one. A new site or tenant has no training set. Jev needs one labeled flow per category, so it covers the segment while a classical model is still collecting data.

Half a second per verdict and a rate-limited gateway make this an asynchronous side channel, fed from the exporter (NetFlow, IPFIX, Zeek conn.log) through a queue, never an inline filter.

six steps

1. Get a key. Jev is served by TypeSafe; set TYPESAFE_API_KEY in .env. Pricing and terms are TypeSafe's.
2. Describe your flows. Write a dataset card like data/nsl-kdd/dataset.json: the columns your flow exporter emits, in order, which of them are symbolic, your categories and which one is benign.
3. Write the request. Copy prompts/nsl-kdd/jev.json, replace columns and the category descriptions with yours, and keep the two questions.
4. Pick examples. One labeled flow per category from your own network is enough to start; k = 1 is where the benchmark's F1 reaches its plateau.
5. Call the detector. JevDetector(load_prompt(path)).predict(flow, examples) returns p_attack, category_pred and confidence for one flow in about half a second. Route p_attack to your alerting with the cut your alarm budget allows; 0.5 was the benchmark's choice, not a rule.
6. Measure before you trust. Run jev-ids run and jev-ids metrics on a labeled split of your own flows. The numbers above are NSL-KDD's, not yours.

Only flow features leave your network, never payloads, but they do leave it: every request goes to the gateway.

the team

• Paulo Severo @paulosevero
• Silvio Quincozes @sequincozes
• Amanda Dias @amandadiasdev