v1.0.0 — Graph Intelligence Engine

P5 complete. Memgraph graph database, VGAE autoencoder, GNN scoring pipeline, signature distillation, full intelligence loop.

v1.0.0 — Graph Intelligence Engine

Released April 14, 2026. P5 GNN Tier 2 complete — the intelligence loop is closed.

What’s New

Full Intelligence Loop

The platform now has a complete feedback loop from detection to fleet-wide protection:

Proxy (tool call intercepted)
  → NATS
    → BI Service Stage 1: Rule scoring
      → Stage 2: Baseline computation
        → Stage 3: Calibration (false neg/pos detection)
          → Stage 4: GraphIngester → Memgraph (action graph)
            → Stage 5: GNNScorer → VGAE inference → anomaly score
              → SignatureDistiller → FlowMatrix ThreatSignature
                → NATS → ALL proxies learn the new pattern (~30s)

An attack pattern detected at one proxy is automatically distilled into a structural signature and pushed to every proxy in the fleet.

Memgraph Graph Database

Agent actions are now materialized as a property graph in Memgraph, enabling structural pattern detection that the proxy’s FlowMatrix signatures cannot express.

Node types:

• Action — one MCP tool call with capability, risk score, deviation, confidence band
• Session — groups actions into a single agent invocation
• Agent — persistent identity across sessions
• Resource — files, APIs, databases accessed by actions

Edge types:

• NEXT — temporal ordering between consecutive actions (with capability transition labels)
• BELONGS_TO — action → session membership
• STARTED_BY — session → agent ownership

Performance: 6,577 events/sec ingestion, cross-batch NEXT edge continuity, tenant-scoped MERGE keys.

VGAE Autoencoder

Variational Graph Autoencoder for unsupervised anomaly detection. Learns to reconstruct normal session graphs — high reconstruction error = anomalous.

• Encoder: GraphSAGE (input → 128 → 64, mean aggregation)
• Decoder: Inner product (edge reconstruction) + MLP (feature reconstruction)
• Loss: Edge reconstruction + feature reconstruction + beta * KL divergence
• Anomaly score: tanh-normalized reconstruction error in [0, 1] with NaN guard
• Negative sampling: Excludes positive edges to prevent training corruption

Signature Distillation

When the GNN flags a session as anomalous:

1. Extracts the session’s capability transition matrix from Memgraph
2. Normalizes to a [12x12] probability distribution
3. Computes a JSD threshold (tighter for higher-confidence detections)
4. Packages as a proxy-compatible ThreatSignature JSON
5. Publishes to NATS quint.signatures.{org_id}
6. Every proxy in the fleet receives and adds it to their ThreatSignatureRegistry

Signature format:

{
  "id": "QT-GNN-A1B2C3D4",
  "name": "GNN-learned: high anomaly",
  "flow_shape": [[0.0, 0.3, ...], ...],
  "max_jsd": 0.25,
  "severity": "high",
  "weight": 0.85,
  "agent_types": [],
  "min_depth": 0
}

Feature Enrichment (Phase 2)

Node features extended from 15-dim (Phase 1) to 21-dim (Phase 2):

Feature	Dim	Source
Capability one-hot	12	From event
Risk score	1	Proxy scoring
Deviation score	1	Proxy behavioral
Confidence band	1	Proxy gates
Hour of day (cyclical)	2	From timestamp
Inter-action gap	1	From NEXT edge
Depth	1	Agent nesting
In-degree / out-degree	2	From Memgraph

Phase 3 (143-dim) will add 90 GraphReasoner rule bits and graph centrality features.

Deployment Architecture

Memgraph is core at team tier and above — not enterprise-only:

Tier	Memgraph	Models
Local	No graph — proxy fingerprints only	N/A
Team	Shared Memgraph instance	Quint’s pre-trained models
Enterprise	Dedicated per-tenant instance	Custom-trained on tenant data
Global	Federated (anonymized embeddings)	Universal threat signatures

What Changed from v0.9.0

Component	v0.9.0	v1.0.0
BI Service stages	3 (score, baseline, calibrate)	5 (+graph ingest, +GNN scoring)
Detection method	FlowMatrix signatures only	FlowMatrix + graph structural analysis
Signature learning	5 hand-crafted	5 hand-crafted + GNN-learned
Attack propagation	None (local only)	Fleet-wide via NATS (~30s)
Graph database	None	Memgraph (28K+ actions, 600+ sessions)
Feature dimensions	N/A	21-dim (Phase 2)
Test count	513	700+ (191 BI Service + 500+ proxy)

Bug Bounty Results

Two rounds of 4-agent bug bounty across the entire P5 codebase:

Round	Bugs Found	Fixed
Round 1	7 (3 critical, 4 high)	7
Round 2	4 (1 high, 3 medium)	4

Key fixes:

• Import crash on startup (dead SessionSnapshotEvent import)
• Sync torch blocking event loop → run_in_executor
• Anomaly score range [0.5, 1.0] → [0.0, 1.0] via tanh
• Negative sampling 9% collision rate → positive edge exclusion
• Memory leaks: bounded _last_action_by_session, _scored_sessions, _distilled_sessions
• Dedup race condition in signature distiller
• Null guard on Memgraph capability fields
• Session ID removed from signature description (info leak)

By the Numbers

Metric	Value
PRs merged (platform)	5 (#15, #16, #17, #18, #19)
PRs merged (proxy)	3 (#43, #44, #41)
New Python modules	10 (graph package)
BI Service tests	191 (all pass)
Stress tests	16 (6,577 events/sec, 0 cross-tenant edges)
VGAE model tests	14
Distiller tests	7
GNNScorer tests	6
Bug bounty bugs fixed	11
Memgraph nodes seeded	28,019
Intelligence loop latency	~30 seconds end-to-end

What’s Next

Version	Scope	Dependencies
v1.1.0	P6 — Compliance (SOC2, NIST, ISO mapping, audit export)	Schema design
v1.2.0	P7 — Adaptive (federated intelligence, dynamic thresholds)	Production data
-	Feature enrichment to 143-dim (90 rule bits + centrality)	GraphReasoner wiring
-	Proxy signature receiver (NATS subscriber for learned sigs)	NATS infrastructure
-	Model training on real captured data	200+ real sessions

---

v1.0.1 — Accuracy Hardening (April 15, 2026)

Multi-Level Detection Stack

Replaced the single VGAE autoencoder with a 4-level ensemble detector:

Level	Method	What it catches	Weight
1	Per-node VGAE reconstruction	Suspicious individual actions	8.3%
2	Supervised GAT classifier	Known attack patterns (10 types)	47.7%
3	Mahalanobis distance	Novel/zero-day attacks (never trained)	30.5%
4	Node-max scoring	Sessions with any extreme action	13.5%

Weights are learned via logistic regression on validation data, not hand-tuned.

Accuracy Results

Metric	Before (v1.0.0)	After (v1.0.1)
AUROC	Not measured	1.000
FPR @0.65 threshold	71%	0.0%
Detection rate	30%	90%+
Separation	+0.117	+0.437

Key Fix: GAT Classifier Collapse

The supervised classifier was outputting identical predictions for every input (P(attack)=0.63 constant). Root cause: training data was not shuffled — all normals processed before all attacks. Fixed with:

• Epoch-level shuffling
• Gradient accumulation over 8 samples
• Gradient clipping at 1.0

Training Data at Scale

Property	v1.0.0	v1.0.1
Sessions	1,500	50,000
Archetypes	4	8
Attack types	5	10 (35 variants)
Topologies	Linear only	5 types
Stealth attacks	None	30% (normal features, attack structure)
Features	21-dim	38-dim (+ n-gram transitions)

N-gram Features (+3 dims)

• Bigram surprise: How rare is this capability transition? Novel transitions (read to upload) score high.
• Window entropy: Shannon entropy of capabilities in last 10 actions. Attack kernels have high diversity.
• Export density: Fraction of upload/send/download in last 20 actions. Catches slow-drip exfiltration.

Adversarial Robustness

7 evasion scenarios tested:

Attack	Detection	Key finding
Business-hours evasion	Per-level: 77-100%	Ensemble needs max-boost
Slow drip (5% malicious)	Per-level: 100%	N-gram export density catches it
Mimicry (normal + 5 uploads)	Node-max: 97%	Per-node scoring catches outliers
Novel zero-day	100%	Mahalanobis distance is the zero-day backstop
Capability-consistent	0%	Confirmed limit — needs resource sensitivity

Score Calibration

• Per-level percentile scoring against normal baseline distribution
• Alert tiers: Hard (any level > 0.9), Soft (2+ levels > 0.5), Standard
• Calibrator persisted alongside model for production deployment

GNN vs Baseline

Proved the graph structure adds value beyond flat features:

Model	AUROC	AUPRC	F1
GNN Ensemble	1.000	1.000	1.000
Feature Baseline	0.982	0.978	0.966

---

AWS Deployment Architecture

Team Tier (5-50 agents)

Shared ECS cluster. Each team gets a BI Service task with Memgraph sidecar (1-2GB). Data isolation via tenant_id on all graph queries. Shared NATS, Redis, and Postgres.

Enterprise Tier (100-10K agents)

Dedicated per-tenant infrastructure. Memgraph on memory-optimized EC2 (r6g.xlarge, 32GB). BI Service auto-scales horizontally. Can deploy in customer’s own AWS account for data residency.

Global Tier (Federated Intelligence)

Anonymized embeddings only cross tenant boundaries:

• FlowMatrix [12x12] capability transitions (no tool names)
• Latent embeddings [64-dim] (compressed, non-invertible)
• Capability distributions [12] (percentages only)

Never shared: tool names, resource paths, agent IDs, arguments, customer identity.

Attack detected at Tenant A becomes a universal threat signature pushed to all tenants within ~5 minutes.

Tenant A detects anomaly → anonymize → Global BI
  → cluster with Tenant B, C detections
    → universal ThreatSignature
      → push to ALL tenants → ALL proxies

---

v1.0.2 — Rule Engine + 143-dim Features (April 15, 2026)

GraphReasoner Rule Engine

90 inference rules across 7 categories, mapped to 11 compliance frameworks. Replaces the fallback scorer (deviation_score * 100) with domain-knowledge-based scoring.

Rule Categories:

Category	Rules	Examples
Capability risk	20	Exec after reads, exfiltration indicators, C2 patterns
Tool risk	15	Shell execution, sudo, netcat, Docker, SSH
Temporal	10	Off-hours, burst patterns, session duration
Sequence	15	Read→upload exfil, credential relay, payload staging
Resource	12	Credential files, private keys, path traversal
Behavioral	11	Novel tools, deviation spikes, multi-signal corroboration
Compliance	7	Unencrypted exports, missing MFA, human oversight

Compliance Frameworks: SOC2, NIST 800-53, ISO 27001, OWASP LLM Top 10, MITRE ATT&CK, GDPR, EU AI Act, NIST AI RMF, PCI DSS, HIPAA, CCPA

Baseline-Aware Scoring

Rules are no longer blind to agent behavior. Each rule’s score is modulated by how surprising the action is for this specific agent:

effective_score = rule.score_delta × baseline_surprise(capability)

• DevOps agent runs exec (normal for them) → surprise = 0.0 → score = 0
• Coding assistant runs exec (never does this) → surprise = 1.0 → score = full
• Cold start agent (unknown) → surprise = 0.5 → score = half

This eliminates ~60% of false positives from baseline-blind rules.

Capability-Based Tool Detection

Tool risk rules use the 12-capability classification system instead of regex pattern matching on tool names. Renaming bash to custom_executor doesn’t evade detection — the capability is still exec.

143-dim GNN Features

Rule firing bits are now wired into the GNN feature pipeline as node features:

Feature Block	Dims	Source
Phase 1 (capability + scores)	15	Proxy behavioral scoring
Phase 2 (temporal + degree)	6	Timestamps + Memgraph
Phase 3 (action type + novelty + n-grams)	14	Event metadata + sequence analysis
Phase 4 (rule bits + top-K scores)	108	RuleEngine evaluation
Total	143

The 90 binary rule bits encode domain knowledge directly as GNN features. The model learns which rules correlate with attacks and how they interact — something hand-tuned score deltas cannot express.

How to Enable

# Proxy policy
behavioral:
  enabled: true
  shadow_mode: true

# BI Service environment
BI_GRAPH_REASONER_ENABLED=true   # 90-rule engine
BI_MEMGRAPH_ENABLED=true         # graph database
BI_GNN_ENABLED=true              # multi-level detector

Performance

Component	Latency
Proxy Gates 1-3	<1us per action
Rule evaluation (90 rules)	0.133ms per event
Phase 4 encoding (143-dim)	8.1ms per 1000 nodes
GNN inference per session	0.44ms avg
Full pipeline (proxy → GNN → signature)	~30 seconds