Jev-IDS uses typed probabilities to detect network attacks

Jev-IDS is an open-source intrusion-detection prototype that returns structured probabilities for each network flow. Its fixed output schema avoids the token generation, parsing, and validation required by free-form large language model responses. An accompanying arXiv paper reports lower latency and cost, along with stronger recall on attack families excluded from the model’s examples.

Those results make Jev-IDS a candidate for early-stage traffic triage, where false alarms, per-flow cost, and response time determine how much telemetry a system can process. The current evidence comes from a small benchmark on an established but dated dataset, so it does not establish production or line-rate performance.

Why typed output changes the pipeline

Conventional network intrusion detection systems often use supervised classifiers trained on labeled flows. Their performance can deteriorate when traffic differs from the training data, while collecting and labeling representative attacks requires substantial work. General-purpose LLMs can classify flows from a few examples, but each response incurs generation latency and may contain text that downstream software must parse and validate.

TypeSafe AI describes Jev as the first System One Model, or SOM, in a family built for typed probabilistic decisions. The caller defines each question and its valid answer shape in advance. Jev then returns probabilities and predefined values without generating an explanation.

One flow in, two typed answers out

Every Jev-IDS request places a single serialized network flow into the model state with its column names, instructions, five traffic-category descriptions, and labeled examples. The number of examples per category is controlled by