AI-Powered Threat Mitigation — 5-Tier Graduated Response with Provable FP Bounds

Most blackhole pipelines are a single heuristic threshold and an audit log. RoutePulse v4.32 replaces the binary “block / don’t block” decision with a 5-tier graduated response (Observe → Monitor → Rate-Limit → FlowSpec → Blackhole) driven by Conviction Engine v2 — the first BGP+security platform that ships provable false-positive bounds. Dempster-Shafer fusion across 18 ML models, Thompson Sampling for per-action outcome learning, and Conformal Prediction for FDR-controlled cut-offs replace gut-feel thresholds with a rigorous statistical guarantee.

Every blackhole inject walks through an 8-Gate Conviction Pipeline: SPRT evidence accumulation, Thompson posterior sampling, conformal p-value test, role-catalog scope check, cloud-ASN guard (Google / Cloudflare / AWS / Meta / Akamai / Microsoft / Apple require score ≥60), research-scanner exclusion (Censys / Shodan / BinaryEdge), peer-active sanity, dual-stack enforcement (IPv4 /32 + IPv6 /128), and finally a Claude AI Gate 8 narrative review. Once the gates clear, persistent SSH RouterShell sessions to Juniper MX and Huawei NetEngine routers inject the route in <3 seconds (102-prefix bulk in ~7 s, replacing the legacy 10-minute multi-session path). MTTD has fallen from 84 hours to 17 seconds in production; FP rate is 84 % lower than the v4.7-era heuristic engine.

Conviction Engine v2 — SPRT + Thompson + Conformal

The engine ingests evidence from 18 ML models plus 39 threat feeds and runs three concurrent statistical procedures. Sequential Probability Ratio Test (SPRT) accumulates log-likelihood evidence until it crosses an operator-tunable confidence boundary — no fixed N samples required, decisions arrive as fast as evidence permits. Thompson Sampling maintains a Beta(α,β) posterior per playbook action; each mitigation outcome (TP / FP via operator feedback or auto-resolution) updates the posterior, so the system learns which actions actually work for which threat classes. Conformal Prediction wraps the final score with a calibrated p-value — the blackhole decision carries a provable upper bound on false-positive rate (configured at FDR ≤ 5 % in production). All three procedures live in src/api/services/conviction-engine.ts with full audit trail in the WORM chain.

5-Tier Graduated Response

Not every threat deserves a /32 blackhole. The pipeline picks proportionate action: Observe (telemetry only, baseline learning), Monitor (raise watch flag, Telegram digest), Rate-Limit (FlowSpec rate-limit at upstream), FlowSpec (granular L4 drop rule), Blackhole (RFC 7999 community 65535:666). The choice is computed by Dempster-Shafer fusion combining ML confidence + threat-feed corroboration + behavioural baseline drift + operator role context. Same IP can move up and down the ladder as evidence evolves — with Thompson learning the per-tier success rate.

☁️ Cloudflare Magic Transit Integration

On-demand DDoS protection integrated natively, replacing 4 legacy Python daemons with a single TypeScript service. Webhook endpoint receives 11 Cloudflare alert types (L3/L4 DDoS, MNM auto-advertisement, tunnel health, BGP hijack). Advertise/withdraw 5 on-demand prefixes (4 IPv4 + 1 IPv6) with auto-withdraw after a 15-minute calm period. 124 searchable DDoS L3/L4 rules with 70 service presets and wirefilter editor. GRE/IPsec tunnel monitoring, CNI V2 Equinix ZH4 interconnect, 14 static routes with priority-based failover.

Key Capabilities

• Conviction Engine v2 — SPRT evidence accumulation + Thompson Sampling Beta posteriors + Conformal Prediction with FDR ≤ 5 % provable bound
• 8-Gate Blackhole Pipeline: SPRT → Thompson → Conformal → Role Scope → Cloud-ASN Guard → Scanner Exclusion → Peer Sanity → Claude AI Gate 8 narrative review
• 5-tier graduated response: Observe / Monitor / Rate-Limit / FlowSpec / Blackhole via Dempster-Shafer fusion (v4.9+)
• Persistent SSH RouterShell to Juniper MX & Huawei NetEngine: single inject <3 s, bulk 102 prefixes in ~7 s (was 10 min via 204 sessions)
• BGP community 65535:666 (RFC 7999) signalling to upstream transit; dual-stack /32 + /128 enforcement
• Progressive ban escalation 7 → 14 → 28 → 365 days with 48-hour observation window between cycles
• Cloud-ASN protection gates require score ≥60 for Google / Cloudflare / AWS / Meta / Akamai / Microsoft / Apple
• Research-scanner exclusion list (Censys / Shodan / BinaryEdge / Project25499) hard-blocks auto-blackhole
• Auto-reconciliation every 2–3 minutes verifies on-router state matches intent; drift alerts to Telegram
• AES-256-GCM encrypted SSH credentials; PIN authentication required for every manual operation
• RTBH page: inject/withdraw IPv4 /32+/24 and IPv6 /128 via persistent SSH; per-router verification via live query
• Cloudflare Magic Transit: 11 alert types, on-demand prefix advertise/withdraw, 15-minute auto-calm; 124 DDoS L3/L4 rules + 70 service presets
• WORM audit chain: every inject / withdraw / FlowSpec rule / threshold change appended with SHA-256 hash chain (replayable for NIS2/DORA audits)
• Production stats v4.32.117: <3 s mitigation latency, 84 % FP reduction vs v4.7, MTTD 84 h → 17 s

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →