AIRSS
AI Relational Security Systems
Artificial Intelligence Relational Security Systems
Core AI Engine: US Patent 12,572,504 B2 (Data Organizer Optimizing Reconciliation Systems) — Issued March 10, 2026 — Priority: May 2023
📋 Read Technical Abstract | Part of the DOORS Patent Family
The AI-Native Security Layer
The core insight underpinning AIRSS is that almost every security threat reveals itself through a mismatch: content whose internal characteristics don't align with its external presentation. A file masquerading as something it isn't. An executable hiding behind a document extension. A behavioural pattern that deviates from every prior interaction. AIRSS is built to systematically find these mismatches — and to do so at every point where digital content enters, resides in, or leaves a system.
Patent Abstract: "An artificial intelligence relational security system examines digital content through combined intrinsic and extrinsic attribute analysis and identifies security threats with potentially greater efficacy than purely signature-based methods... while the inference capability may detect novel zero-day threats without any matching signature. The system may operate as a persistent low-resource sentinel, scanning inbound and outbound data flows and local content, and may be deployed as a containerized package for emergency recovery of compromised systems. Bidirectional sharing of newly discovered threat patterns with external repositories potentially strengthens collective defense."
AIRSS is part of the DOORS patent family — a unified architecture for AI-native intelligence spanning data organisation, AI management, and now comprehensive security.
The Intrinsic and Extrinsic Attribute Analyzer Engine at the heart of AIRSS is protected by issued US Patent 12,572,504 B2 — the DOORS patent, issued March 10, 2026, with priority dating to the provisional application of May 2023. This is the engine that enables AI inference from attribute relationships, mismatch detection, and zero-day threat identification without signatures. No security vendor in the United States can legally replicate this capability without a licence from Systems Design Innovation LLC. That is not a competitive claim — it is a legal fact grounded in an issued patent. Every other security product on the market is working without the engine that makes AIRSS possible.
The Market Opportunity
Cybersecurity is one of the largest and fastest-growing technology markets on earth. Multiple major analyst firms (Grand View Research, Precedence Research, Fortune Business Insights) place the global market at approximately $300 billion in 2025–2026, with consistent projections to over $660 billion by 2033 at compound annual growth rates of 11–12%. The United States alone represents approximately $80 billion — roughly 37% of global spend — and is growing faster than the global average.
Within this market, the AI-specific threat category that AIRSS addresses has zero existing coverage in mainstream security products. Every organisation running AI systems — which by 2026 means essentially every significant enterprise — is completely unprotected from prompt injection, adversarial inputs, data poisoning, and model extraction. That is an uncaptured segment within a $300 billion market.
The Problem: Four Critical Gaps in Conventional Security
🔏 Zero-Day Threats Are Invisible Until After the Attack
Traditional antivirus and endpoint protection rely entirely on signature databases. A zero-day threat — using techniques or code the security vendor has never catalogued — is completely invisible until after an attack has succeeded and the signature is retrospectively added. Every new threat type opens a window of unlimited exposure for every organisation running that tool.
📤 Supply Chain Attacks and Exfiltration Go Undetected
Conventional tools watch what enters a system and scan what resides on it. Almost none monitor what leaves. Supply chain attacks — where compromised outputs are distributed to downstream customers — and data exfiltration staging bypass security entirely because no gate exists on the outbound vector. The threat walks out the door.
🤖 An Entire Attack Surface With No Coverage
Every organisation now runs AI systems — large language models, image classifiers, recommendation engines, automated decision systems. These systems have entirely new attack surfaces: prompt injection, adversarial inputs, data poisoning, model extraction, backdoor triggers. Conventional security tools were designed for a pre-AI world and have no category, no signature, and no detection capability for any of these threats.
📚 Always Behind the Threat Curve
When a new threat is encountered, traditional tools require a human analyst at the security vendor to process and classify it before any protection is available. There is no mechanism for the system itself to reason from first principles about whether an unknown data object is dangerous. Every organisation perpetually lags the threat curve by however long it takes the vendor to react.
How AIRSS Works: Scan → Infer → Respond
SCAN — Dual Attribute Analysis
Every data object is examined for two complementary attribute sets. Intrinsic attributes are characteristics internal to the object: code structures, function calls, system hooks, programmatic levers, and embedded content patterns. Extrinsic attributes are external: file extension, storage location, context of receipt, startup positioning, and links and associations with other objects and resources. Scanning occurs at three gates: inbound, local, and outbound.
INFER — AI Relational Analysis
A Synthetic Electronic Neural Network (SENN) infers the relationship between the intrinsic and extrinsic attributes of the scanned object. Critically, mismatches between attribute sets — where external presentation doesn't align with internal content — are primary threat signals. The AI can identify threats in the complete absence of any matching signature in the repository, making zero-day detection a core capability, not an exception. Specialist SENNs for specific threat domains can be called on demand.
RESPOND — Learn, Record, Share
Confirmed threats trigger one or more response actions: quarantine (isolate, prevent execution, preserve for analysis), remove or block (delete/prevent with source blocking), or alert and learn (notify user/admin, record the new threat pattern as structured ground truth in the repository). Newly discovered patterns can be shared bidirectionally with external repositories, strengthening collective defence across all deployments.
Zero Blind Spots: Three Scanning Gates
Conventional security covers one or two vectors. AIRSS covers all three. Data entering the system is checked before it reaches any user process. Data already resident is continuously monitored. And data leaving the system — the vector most commonly left unguarded — is verified before it reaches any external destination. Together, these three gates eliminate the blind spots that supply chain attacks and exfiltration campaigns depend on.
Key Capabilities
🎯 Zero-Day Detection Without Signatures (Claim 10)
AIRSS can determine that a data object exhibits threat characteristics even in the complete absence of a matching signature in the threat detection repository. AI inference from attribute relationships and mismatches identifies novel threats from first principles — not just from what has been seen before. This is a core capability, not an edge case.
🔍 Intrinsic/Extrinsic Mismatch Detection (Claim 12)
A file presenting as a document that contains executable system hooks. An image encoding steganographic payloads. A startup item disguised as a library. All share a common signature: mismatch between intrinsic and extrinsic attributes. AIRSS evaluates these mismatches systematically as primary threat indicators, detecting disguised or compromised content that signature matching cannot see.
🛡️ Full Three-Vector Coverage (Claim 2)
Scanning at the inbound gate (before content reaches user processes), local storage (resident files and systems), and the outbound gate (before distribution to external parties) provides comprehensive threat coverage across all data movement vectors — the architecture that conventional inbound-only solutions cannot match.
🤖 AI-Specific Threat Coverage (Claim 14)
AIRSS includes a dedicated threat category for AI systems: prompt injection patterns, adversarial input patterns, data poisoning markers, model extraction attempts, and backdoor trigger patterns. As AI becomes pervasive infrastructure, this coverage addresses the most rapidly growing attack surface in computing — one absent from virtually all existing tools.
🔬 Semantic Threat Repository (Claim 8)
The threat detection repository is searchable by vector index, semantic search, word and non-word simile and synonym groupings, signature match query, and keyword query. Semantic similarity matching finds novel threats by their relationship to known patterns — extending the reach of the knowledge base far beyond exact signature matches.
💡 Specialist SENN Security Modules (Claim 11)
Callable specialist Synthetic Electronic Neural Networks — trained for specific threat domains including phishing detection, malware classification, anomaly detection, and AI-threat analysis — are instantiated on demand for expert analysis of suspected objects. The right specialist handles each threat type. Resources concentrate only where needed.
🛰️ Sentinel Mode: Always Watchful, Never Wasteful (Claim 16)
A baseline SENN operates persistently at minimal resource consumption — quantized, low-power, always watching. When the baseline identifies a potential threat, it instantiates the appropriate specialist security modules for investigation, then deallocates them and returns to baseline. Systems run fast. Security never sleeps.
📦 Emergency Recovery Deployment (Claim 18)
The AI engine, threat detection repository, and pre-trained SENN modules can be packaged as a self-contained containerised unit. This unit deploys on a damaged or compromised system to bootstrap AIRSS to full operational capability immediately — emergency security recovery without requiring an intact installation environment.
🌐 Bidirectional Threat Sharing (Claim 15)
Newly discovered threat patterns are recorded to the repository as structured ground truths and can be shared with external threat repositories via network. AIRSS can also receive updated patterns from external sources. Every deployment contributes to and benefits from collective defence — intelligence compounds across the entire ecosystem.
📊 Structured Ground Truth Repository (Claim 4)
All threat patterns are organised as structured ground truths within a relational database — the same knowledge representation architecture used throughout the DOORS patent family. This formal structure enables precise querying, relationship tracking between threat families, and reliable AI inference grounded in verified factual knowledge.
Six Threat Categories (Patent Claim 5)
🦠 Malware Signatures
Virus, worm, trojan, ransomware, rootkit, spyware, keylogger, cryptominer, polymorphic malware, and zero-day variants. Classical threat patterns matched against the structured ground truth repository — the foundation of signature-based detection, fully integrated into AIRSS's multi-method analysis.
📄 File Integrity Threats
Embedded macros, steganographic payloads, polyglot files (valid in multiple formats), archive bombs, corrupted headers, hidden executables, metadata exfiltration, and supply chain tampering. Detected primarily through intrinsic/extrinsic mismatch analysis — AIRSS's most distinctive detection capability.
📧 Email & Social Engineering
Phishing URLs, spear phishing, business email compromise (BEC), malicious attachments, spoofed senders, urgency manipulation, impersonation, deepfake content markers, social engineering patterns, and credential harvesting indicators. Scanned at the inbound gate before any content reaches user processes.
🌐 Network & Intrusion
Port scanning, brute force, SQL injection, cross-site scripting (XSS), man-in-the-middle (MITM), DNS spoofing, DDoS signatures, privilege escalation, lateral movement, and command-and-control (C&C) beaconing. Behavioural patterns analysed against established baselines to identify active intrusions.
🤖 AI-Specific Threats
Prompt injection patterns, jailbreak attempts, adversarial inputs, data poisoning markers, model extraction attempts, backdoor trigger patterns, evasion attacks, membership inference probes, training data extraction attempts, and gradient leakage indicators. A threat category absent from virtually all existing security tools — built into AIRSS from the ground up.
📈 Behavioral Anomaly
Unusual access time patterns, abnormal data volume transfers, access to unrelated resources, privilege use inconsistencies, rapid sequential data access, geographic login anomalies, device fingerprint changes, session hijack indicators, exfiltration staging patterns, and dormant account activation. Detects intruders who have already bypassed all other defences.
Three Detection Methods (Patent Claim 7)
Signature Matching
Compares the identified intrinsic and extrinsic attributes of a data object against known threat patterns stored in the structured ground truth repository. Fast, deterministic, and highly reliable for threats that have been previously characterised. The backbone of established threat detection — fully preserved within AIRSS's wider architecture.
Heuristic Analysis
Identifies suspicious characteristics that resemble known threat categories even when an exact signature match is absent. Catches variants and novel mutations of known threat families. Bridges the gap between the library of known threats and the unknown variants that attackers continuously generate to evade signature matching.
Behavioral Analysis
Detects deviations from established baseline behaviour patterns recorded in the database. Identifies threats that have already bypassed other defences by observing how entities in the system behave over time — not what they claim to be. Catches adversaries who have established legitimate access but are operating outside normal patterns.
Technical Architecture (Patent Claims 1–29)
Dual Attribute Extraction at Every Gate
The scanning layer presents every data object to the analysis engine at one of three gates (inbound, local, outbound). It extracts two complementary attribute sets: intrinsic (code structures, function calls, system hooks, programmatic levers, content patterns, embedded structures) and extrinsic (file extension, storage location, context of receipt, startup positioning, links and associations). Mismatches between these sets are flagged as primary threat signals before AI inference even begins.
Inference, Zero-Day Detection & Specialist Modules
A Synthetic Electronic Neural Network infers relationships between the extracted attribute sets. The SENN compares against the structured ground truth repository using signature matching, heuristic analysis, and behavioural analysis simultaneously. Critically, it can detect zero-day threats in the complete absence of a matching signature. In sentinel mode, a quantized baseline SENN maintains persistent low-resource awareness and instantiates specialist security SENNs on demand when a potential threat is identified.
Quarantine, Record, and Strengthen Collective Defence
Confirmed threats trigger proportionate response: quarantine (isolation and preservation), removal or blocking, and structured alert generation. New threat patterns are recorded to the repository as structured ground truths — formalised factual knowledge that immediately strengthens future detection. The system can share discoveries with external repositories and receive updated patterns, ensuring intelligence compounds across every deployment. A containerised emergency package can bootstrap full AIRSS capability on a compromised system from scratch.
Key Concepts & Patent Definitions
Sentinel Mode & Emergency Recovery (Claims 16 & 18)
Sentinel Mode
A baseline SENN — quantized, integer-inference, persistently active — maintains
continuous low-resource awareness of the system. When the baseline detects a potential
threat, it instantiates the appropriate specialist security modules for investigation.
After analysis and response, specialist modules are released and the system returns
to baseline. Systems stay fast. Security never goes offline.
Contrast with conventional security: constant full-power scanning that consumes
resources regardless of actual threat activity, degrading system performance
and efficiency continuously.
Emergency Recovery Deployment
AIRSS can be packaged as a fully self-contained containerised unit: the AI engine,
the complete threat detection repository, and all pre-trained specialist SENN modules
in a single deployable package. This unit can be installed on a damaged or compromised
system and brought to full operational capability immediately — without requiring
an intact pre-existing installation.
Bootstrap security from scratch on any compromised system.
The containerised package is equally applicable for rapid deployment to new
environments, edge systems, and isolated networks.
AIRSS vs Traditional Security
| Capability | Traditional Signature AV | AIRSS |
|---|---|---|
| Detection Basis | ❌ Signatures Only | ✅ AI Inference + Signatures + Heuristics + Behaviour |
| Zero-Day Detection | ❌ Impossible Without Prior Signature | ✅ AI Inference from Attribute Relationships |
| Outbound Scanning | ❌ Not Available | ✅ Full Outbound Gate |
| Scanning Vectors | 🔶 Inbound / Resident Only | ✅ Inbound + Local + Outbound (3 of 3) |
| AI-Specific Threat Coverage | ❌ No Category | ✅ Dedicated AI Threat Category (Claim 14) |
| Attribute Mismatch Detection | ❌ Not Available | ✅ Core Detection Method (Claim 12) |
| Threat Repository Search | ❌ Keyword / Signature Only | ✅ Vector + Semantic + Synonym + Keyword (Claim 8) |
| Learning from New Threats | ❌ Vendor Update Required | ✅ Auto-Records as Structured Ground Truth |
| Specialist Module Architecture | ❌ Monolithic Scanner | ✅ On-Demand Specialist SENN Modules (Claim 11) |
| Operating Mode | ❌ Constant High-Resource Scanning | ✅ Low-Resource Sentinel + On-Demand Specialists (Claim 16) |
| Emergency Recovery | ❌ Not Available | ✅ Self-Contained Containerised Package (Claim 18) |
| Collective Defence | ❌ Siloed | ✅ Bidirectional External Threat Sharing (Claim 15) |
AIRSS Deployment Applications
AI-native security for every organisation that handles digital content — which is all of them.
🏢 Enterprise IT Security
Comprehensive three-vector protection for corporate networks, endpoints, and cloud infrastructure — with AI-specific coverage for enterprise AI deployments.
🏛️ Government & Intelligence
Secure inter-agency data flows, classified document handling, and intelligence system protection — with zero-day detection and behavioural anomaly monitoring.
🪖 Military & Defence
Battlefield communications security, command systems protection, and autonomous system integrity — including AI-specific threat coverage for defence AI platforms.
🤖 AI System Protection
Defending AI models, training pipelines, and inference infrastructure against prompt injection, data poisoning, model extraction, and adversarial attacks.
⚡ Critical Infrastructure
Power grid control systems, water infrastructure, and communications networks — where supply chain integrity and outbound monitoring are essential requirements.
🔗 Supply Chain Security
Outbound gate scanning of distributable software, compiled outputs, and shared data to detect compromise before downstream delivery — the supply chain's last line.
☁️ Cloud & Edge Computing
Containerised sentinel deployment on edge devices and cloud instances — low-resource baseline mode keeping security operational without degrading compute performance.
🏥 Healthcare & Finance
Protection for patient records, financial data, and regulated systems — with emergency recovery deployment for rapid restoration after ransomware or compromise.
Why AIRSS Is Fundamentally Different
🛡️ Three-Vector Coverage
The only security architecture scanning inbound, local, and outbound vectors simultaneously. Supply chain attacks and data exfiltration are caught before they leave — a capability absent from virtually every competing solution. One gate missing means adversaries know exactly which route to use.
🤖 Born for the AI Era
The first security system with a dedicated AI-specific threat category, covering prompt injection, adversarial inputs, data poisoning, model extraction, and backdoor triggers. As AI becomes universal infrastructure, AIRSS addresses the attack surface that legacy tools ignore entirely — and that attackers are already actively exploiting.
🔍 Zero-Day From First Principles
AIRSS doesn't need a signature to identify a threat. AI inference from intrinsic and extrinsic attribute relationships — and from mismatches between them — detects novel threats from first principles. Attackers who craft code specifically to evade known signatures are not invisible to AIRSS: their content still has to present itself somewhere.
🧬 Mismatch as the Core Signal
Content that doesn't match its container is a threat. AIRSS systematically exploits this principle — examining the relationship between what a file claims to be and what it actually contains — as a fundamental detection method that no pure signature scanner can replicate. The mismatch signal is attacker-agnostic: it catches new techniques automatically.
📚 Semantic Threat Intelligence
The threat repository is indexed for semantic similarity — not just exact keyword or signature match. Novel threats conceptually related to known patterns are found by semantic proximity. Synonyms, related terms, and vector similarity extend the knowledge base to cover what has never been seen but can be understood by association.
🌐 Collective Defence Architecture
AIRSS improves through experience and shares its discoveries. Newly identified threat patterns are recorded as structured ground truths and can be shared bidirectionally with external repositories. Every deployment makes the ecosystem smarter. Collective defence is not a feature — it is built into the architecture as a core capability from the ground up.
Market Segments & Licensing
Personal & Family Protection
Subscription-based endpoint protection for individuals and families across phones, tablets, laptops, and home systems.
- 3-gate scanning: inbound, local, outbound
- Signature + heuristic + behavioral detection
- Sentinel mode — low-resource, always-on
- Single or multi-device annual/monthly subscription
- Competitive with Norton, McAfee, Avast
SMBs, Professionals & Teams
Per-seat or per-node licensing for small and medium businesses, professional firms, and distributed teams needing business-grade protection.
- Full feature set + management console
- Email & outbound scanning for business workflows
- AI-threat coverage for business AI tools
- Policy-based controls and reporting
- Competitive with Bitdefender Business, Sophos
Organisations, Critical Infrastructure & Defence
Volume or custom licensing for large organisations, government agencies, military, intelligence communities, and critical infrastructure operators.
- Full AIRSS capability + specialist SENN modules
- AI-threat category with domain-specific tuning
- SOC/SIEM integration and API access
- Air-gapped and secure-enclave deployment
- Emergency containerised recovery packages
- Custom threat repository and collective defence feeds
Partners, OEMs & System Integrators
License the core AIRSS engine and IP to embed in third-party security products, platforms, and managed security services.
- Royalty-based or flat-fee licensing available
- White-label integration options
- Access to the patented Intrinsic/Extrinsic Analyzer Engine
- Licensed product gains capabilities competitors cannot legally match
- OEM supply of SENN security modules and threat repository architecture
Why This Opportunity Cannot Be Replicated
The Intrinsic and Extrinsic Attribute Analyzer Engine — the core of AIRSS — is protected by US Patent 12,572,504 B2, issued March 10, 2026, with priority dating to May 2023. This is the legal foundation that makes AIRSS defensible: no competitor can build the same capabilities without a licence.
📈 For Investors
You are looking at a patented, issued-IP position in a $300 billion global market growing at 12% per year. The technology addresses three proven unmet needs simultaneously:
- Zero-day detection without signatures (no current solution provides this via attribute inference)
- Dedicated AI-specific threat coverage (no mainstream product has it)
- Three-vector scanning including outbound (the gap every supply chain attack exploits)
The patent priority dates to May 2023. The competitive window for establishing market position with issued IP is now. Revenue model spans four segments from consumer subscription to government enterprise, with technology licensing adding a parallel royalty revenue stream.
🔑 For Licensing Partners
A licence to the AIRSS core engine gives your security product capabilities that are unavailable anywhere else in the market — not from Palo Alto Networks, CrowdStrike, SentinelOne, or any other vendor. Because those capabilities are patented.
- AI inference from intrinsic/extrinsic attribute mismatches
- Zero-day detection from first principles without prior signatures
- The only AI-specific threat category in the industry
- Outbound gate scanning architecture
Your licensed product goes to market with a legally defensible differentiation that your unlicensed competitors cannot match. SDI is seeking strategic licensing partners to bring AIRSS to market across all segments.
🌍 The Timing
The convergence of three trends creates an unusually large and urgent opportunity:
- AI deployment is universal — every organisation now runs AI systems that have no security coverage for AI-specific attack vectors
- Supply chain attacks are endemic — SolarWinds, XZ Utils, and dozens of others exploited the outbound gap that AIRSS closes
- Regulators are mandating action — NIST, CISA, NIS2, and DoD mandates are forcing organisations to upgrade from legacy signature-only tools
AIRSS arrives with issued patent protection at the exact moment the market is ready for what it delivers. The window to establish market leadership is open now.
The Security Layer for an AI-Native World
AIRSS is the security architecture built for the world as it is now. Intrinsic and extrinsic attribute analysis. AI inference from relationships and mismatches. Zero-day detection without signatures. Three-vector coverage including the outbound gate. A dedicated AI threat category. Sentinel mode for continuous low-resource protection. Emergency containerised recovery. Bidirectional collective defence.
The core technology is not new — it is protected. US Patent 12,572,504 B2, issued March 10, 2026, covers the Intrinsic and Extrinsic Attribute Analyzer Engine that makes all of this possible. Combined with AIRSS patent application 19/686,606 filed May 2026, the IP position spans both the engine and its application to security — providing a layered, durable competitive moat.
Systems Design Innovation is actively seeking investment partners, strategic licensees, and development collaborators to bring AIRSS to all four market segments. Whether you are building a security product and need the engine no one else can legally provide, or seeking an IP-protected position in a $300 billion market growing at 12% annually — the conversation starts with the contact form below.