Benchmarking
Our numbers, on public data, with the method attached.
Every result here is on a dataset anyone can download, produced by the same binaries a customer installs, measured against a pass mark fixed before the run. Each one has a datasheet you can take to your security team.
Results
Two public datasets, measured end to end.
The engine learns normal behaviour and nothing else. No dataset below supplied a labelled attack for training, and no threshold was moved after a result was seen.
| Dataset | Product | Result | Conditions | Datasheet |
|---|---|---|---|---|
| CSIC 2010 61,000 HTTP requests, one application |
Shield | 91.69% of attacking sources blocked by their third request, 0 of 6,000 genuine sources wrongly blocked. Single-request ranking AUC 0.9221. | 73.38% by two requests, 99.68% by five, 100% by ten. The block level is set on normal traffic alone. About 0.1 ms per request on one core. | |
| ADFA-LD Linux system-call traces, UNSW Canberra |
Discern | Session-level AUC 0.9246 over 60 attack sessions against 364 normal blocks. Held-out half, scored once: 0.9478. | Across all attack families. Induced on normal traces only. 5,118 recordings learned and scored in 7.8 s on one core, 13 MB, nothing pre-trained. |
Each is an engine-level run on a public corpus, in the shape the threat actually takes: a source making requests, and a session of processes. Every condition is printed beside the figure it belongs to, and the harness and the exact dataset revision are yours for the asking, so your own team can reproduce the number rather than take it from us.
Take it with you
A datasheet for every result.
One page each, no form. The dataset, the unit measured, the pass mark fixed before the run, the results, the conditions and the limits.
CSIC 2010
ShieldInline web protection: 91.69% of attacking sources blocked by their third request, with no genuine source wrongly blocked in the test half.
Download PDFADFA-LD
DiscernHost intrusion detection: session-level AUC 0.9246 across all attack families, 0.9478 on the held-out half.
Download PDFReproduce it
Run it yourself.
Ask us for the harness and the exact dataset revision, and run it on your own hardware. Better still, run it on your own traffic in observe mode and count how many of your real customers it would have blocked. That number is the one that decides anything.