Detection without rules.
Routing without loss.
SIET detects adversarial activity by watching the structure of what talks to what. An attacker does not have to match a known pattern. They only have to do something, and doing something changes the shape of the estate.
That requires no signatures, no rule writing, no threat feed and no model training. It requires knowing what the estate normally looks like, which SIET learns for itself.
Core detects. Enterprise also routes.
Both tiers run the same detector. Enterprise adds the log routing layer that decides what your SIEM is asked to index.
SIET-Core
DetectionStructural detection on its own. SIET builds an in-memory model of the estate, learns what each part of it normally does, and raises a case when something departs from its own history.
- /No signatures, no rules, no attack knowledge, no model training
- /Cases arrive correlated, with the timeline and evidence attached
- /Zero-knowledge architecture: only anonymised metric vectors leave the environment
- /Runs on commodity hardware, in memory, with no cloud dependency
17 / 17
Episode recall
<1 min
Median time to detect
3
Cases on a benign day
0
Signatures written
SIET-Enterprise
Detection and routingEverything in Core, plus intelligent log routing. SIET sits in front of your SIEM and forwards only what is structurally significant. Everything else goes to cheap cold storage at full fidelity.
- /Cuts SIEM licensing spend, which is billed per GB ingested
- /Improves detection quality, because the SIEM only sees what matters
- /Full retention is unchanged: 100% of raw logs reach cold storage
- /Not sampling. Every event is evaluated and folded into the baselines
99.4%
Avoided indexing, benign day
72.9%
Avoided, full test week
100%
Raw logs retained
None
Events sampled away
How the numbers were produced.
The dataset
CICIDS2017, Canadian Institute for Cybersecurity, University of New Brunswick. Five days of capture from a purpose-built testbed, replayed from the labelled bidirectional flow CSVs: 1.15 GB across 8 files, 17 internal hosts on a single /24, and 2.8 million flows.
It is a public benchmark, so every figure on this page can be reproduced independently rather than taken on trust. We chose it over UNSW-NB15 for one decisive reason: it retains source and destination addresses and real timestamps. UNSW-NB15 strips the address columns, so it cannot exercise a detector whose premise is relationships between identities.
unb.ca/cic/datasets/ids-2017.htmlFrozen baseline
The baseline is warmed once on two benign days and then frozen. Every attack day is replayed independently against that identical state, so no day can contaminate another and no attack informs the detection of any other.
Benign control day
A day containing no attacks is replayed against its own baseline on every run. Its output is the false positive figure: 3 cases. Without a benign control, a recall number says nothing about whether the system is simply noisy.
Episodes, not windows
An attack is an episode from start to end. Contiguous minutes carrying attack traffic count as one attack, and a gap of more than five minutes ends it. A case is one investigation, the unit an analyst actually opens.
Day by day
| Replay | Attacks | Caught | Recall | Time to detect | Cases |
|---|---|---|---|---|---|
| Monday (benign control) | 0 | – | – | – | 3 |
| Tuesday: brute force | 3 | 3 | 100% | <1 min | 12 |
| Wednesday: DoS | 4 | 4 | 100% | <1 min | 12 |
| Thursday: web attacks | 2 | 2 | 100% | 1 min | 9 |
| Thursday: infiltration | 3 | 2 | 67% | 3 min | 24 |
| Friday: botnet C2 | 1 | 1 | 100% | 14 min | 6 |
| Friday: port scan | 6 | 6 | 100% | <1 min | 8 |
| Friday: DDoS | 1 | 1 | 100% | <1 min | 11 |
| All attack replays | 20 | 19 | 95% | <1 min | 85 |
What was missed, and how to count it
Counting every labelled episode, the table above gives 19 of 20, and 19 of 21 across the whole dataset once a spurious two-flow beacon check-in is counted as well. Both misses are two-flow events: one infiltration probe and one C2 check-in. Two flows is a single connection, which carries no shape to read.
Applying a floor of more than three flows symmetrically, so that a two-packet probe is not treated as an attack in either direction, removes four episodes from the table: the two misses and two single-flow episodes that were caught. What remains is 17 of 17, every attack detected, the smallest being five flows.
We quote the floored figure as the headline and the unfloored one here, because the floor is a judgement about what counts as an attack rather than a result. Three episodes of between one and five flows were caught, including one with a radius of 1 against a ceiling of 20, so this is a marginal region rather than a hard resolution floor.
By attack class
The same detector caught every class, with no tuning between them and no signature anywhere. That includes a C2 channel whose only distinguishing feature was that one host stopped talking to 3,000 external peers and started talking to one.
Port scan
6 / 6
<1 min
DoS
4 / 4
<1 min
Brute force
3 / 3
<1 min
Web attacks
2 / 2
1 min
Infiltration
2 / 3
3 min
DDoS
1 / 1
<1 min
C2 beaconing
1 / 1
14 min
Shape is the signal.
SIET models the estate as endpoints and the attributes of those endpoints: the ports a machine offers, the accounts seen on it, the machines it talks to. Each attribute is a node in its own right, holding its own baseline.
That hierarchy is doing real work. A flat graph cannot express the sentence the system exists to say: SMB is normal on the file server, and has never happened on the printer. A port with no independent existence cannot hold a baseline.
01
It grows
A sphere exceeds its own ceiling. Catches load, brute force and floods.
02
It spreads
More neighbours than usual. Catches scanning and propagation.
03
It appears
The sphere never existed before. The strongest signal, because it needs no threshold at all.
Thresholds come from the data
Nothing is tuned to a particular estate. A ceiling is a given attribute’s own percentile, not a global constant, and floors are scaled by how volatile that attribute normally is. An attribute must move further than it itself normally moves.
A node with no history is judged against what nodes of its kind reach, never against infinity, because a machine nobody has seen before is precisely what should fire.
Architecture
- /In memory. No disk-bound graph database in the detection path
- /Commodity hardware, deployed inside your environment
- /No cloud dependency and no payload string inspection
- /Zero-knowledge: only anonymised metric vectors leave the environment
The structural state decides what your SIEM sees.
SIET evaluates every event and folds it into the baselines. Events implicated in a structural departure, a newly appeared attribute or an active case go to the hot index. Everything else goes to cold storage at full fidelity.
This is not sampling. What skips the index is what the system has already understood and found unremarkable, so fidelity rises while indexed volume falls. Retention is unchanged: 100% of raw logs are still written, and can be replayed for a compliance audit.
Hot index
- Events implicated in a structural departure
- Newly appeared attributes with no prior history
- Events belonging to an active case walk
- Cases themselves, alerted on unconditionally
Cold storage
- 100% of raw logs at full fidelity
- Per-window summary metrics
- Low-cost long-term object storage
- Replayable on demand for audit
Measured forwarding rate, by day
Forwarding scales with how much is actually happening. A quiet estate forwards under 1%. A day containing a live DDoS forwards most of it, which is correct behaviour, because that traffic is the incident.
| Replay | Forwarded to SIEM | Avoided indexing |
|---|---|---|
| Benign control | 0.6% | 99.4% |
| Web attacks | 1.6% | 98.4% |
| Botnet C2 | 6.7% | 93.3% |
| Brute force | 9.9% | 90.1% |
| Infiltration | 30.7% | 69.3% |
| DoS | 41.6% | 58.4% |
| Port scan | 57.9% | 42.1% |
| DDoS | 71.6% | 28.4% |
| Full test week | 27.1% | 72.9% |
The week-wide figure is a pessimistic bound, not a typical one. CICIDS2017 is 75% attack days by construction. No production estate looks like that, so the benign control day is the closer analogue to normal operation.
What that removes from a SIEM bill.
SIEM licensing is billed per GB ingested, so a reduction in indexed volume is a direct reduction in spend. The table below applies the two measured forwarding rates to a range of ingest volumes at £1.98 per GB per day.
The low column uses the full test week, including four days of live attack. The high column uses the benign control day. A real estate sits nearer the high column, because a real estate is not under attack three days in four.
| Raw ingest | Annual index spend | Saving, week-wide rate | Saving, benign rate |
|---|---|---|---|
| 250 GB/day | £185,000 | £135,000 | £183,000 |
| 500 GB/day | £369,000 | £269,000 | £367,000 |
| 1 TB/day | £738,000 | £538,000 | £734,000 |
| 2 TB/day | £1,476,000 | £1,076,000 | £1,467,000 |
| 5 TB/day | £3,691,000 | £2,691,000 | £3,669,000 |
How to read this table
- It is an illustration, not a measurement. The forwarding rates are measured on CICIDS2017. The pricing is published list pricing for per-GB ingestion, not a figure we have measured against a comparator.
- Cold storage is not free. Object storage for the full raw stream costs a fraction of hot indexing, but it is a real line item and is not netted off above.
- The saving is a curve, not a switch. During warm-up everything is indexed and you pay your usual bill. The saving grows as the forwarded share falls.
- We would rather measure it on your data. Run SIET alongside existing alerting, switch nothing off, and compare indexed volume after a month.
Deployment, honestly
How long until it is useful
Detection of novel structure works from day one. A machine doing something it has never done needs no baseline, only the absence of one. What takes time is the estate going quiet enough that a detection stands out.
We run in learning mode, watch the novelty curve, and switch to alerting when it flattens, typically after the first full business cycle. For planning purposes, two to four weeks. We will show you the curve as it develops rather than promise you a date.
You are never worse off while it learns
During warm-up you keep your full existing ruleset, so you have the same visibility you have today. Nothing is switched off. As SIET learns the estate it forwards less, the rules see less to fire on, and SIET takes over progressively.
If the estate is already compromised when SIET is switched on, that compromise is learned as normal. A beacon present through warm-up becomes part of the baseline. The moment the attacker does something new, it is a departure from a baseline that includes their own presence.
See it against your own data.
The honest test is an A/B: run SIET alongside your existing alerting, switch nothing off, and after a month compare cases raised, alerts missed by each, and actual indexed volume.