SAGE-IDS — Intelligent Network Threat Detection 

SAGE-IDS treats a network as what it is — a graph of relationships — rather than a stream of isolated flows. It was developed as founder-led research in collaboration with the National Informatics Centre (MeitY) and published at IEEE CONECCT 2026.

Flow-level detectors miss attacks that only look suspicious in context, and most give a score without saying how much to trust it. On constrained edge devices across the Internet of Everything (IoX), both problems get worse.

1. 01Model hosts and flows as a communication graph and measure structural surprise — how unexpected a new interaction is given the graph so far.
2. 02Fuse structural signals with conventional flow features in a lightweight detector.
3. 03Apply split-conformal calibration so each alert carries a statistically grounded uncertainty estimate.

1. Layer 1

   Ingest

   Network flows aggregated into a rolling interaction graph.

2. Layer 2

   Represent

   Structural-surprise scores combined with flow statistics.

3. Layer 3

   Detect

   Lightweight classifier suited to edge deployment.

4. Layer 4

   Calibrate

   Split-conformal risk sets for dependable decisions.

• Peer-reviewed publication at IEEE CONECCT 2026.
• Alerts accompanied by calibrated confidence rather than raw scores.
• Design informed by constraints of edge devices in connected systems.