ML Brain — 18-Model Machine Learning Pipeline

The ML Brain is a 18-model ensemble detection pipeline comprising three tiers: Core (Adaptive Baseline, Isolation Forest, Markov Chain, K-Means, Holt-Winters, Latency Baseline, Threat Intel, Temporal Analyzer, Beaconing Detector, Graph Change), Specialized (Carpet Bomb, DNS Tunnel, Reflector Detection), and Tier 1 Threat Detectors (QUIC Anomaly, Protocol Mismatch, BGP-Traffic Correlation, DGA/Fast-Flux, Encrypted C2 Profiler). The Neural Brain Canvas renders a biologically accurate HTML5 Canvas visualization at 60fps with 1200 ambient neurons, a 25-edge pipeline graph, event-driven synaptic sparks, detection flash rings, and training ripple animations, while the AI Core energy glow responds proportionally to correlation buffer activity.

Adaptive Ensemble Weights automatically adjust model weights based on true-positive and false-positive operator feedback using F1-inspired scoring. The Correlation Engine v5 applies 12 cross-model rules that detect patterns no single model catches, including Host Escalation, Prefix Under Attack, Silent Drop, and AS Instability. ML scores contribute up to 30 points to the 5-pillar Unified Threat Score. Training schedules vary by model: Baseline (1h), IsoForest (30min), Markov (1h), K-Means (2h), Holt-Winters (6h), Latency (continuous), and ThreatIntel (6h). Closed-loop learning ensures detections trigger Claude analysis that auto-generates AI Tuning rules through an operator approval workflow. The system includes 42 built-in ML flow detection rules across 8 behavioral categories — scanning, brute-force, DDoS, exfiltration, C2, lateral movement, protocol abuse, and reconnaissance. A Retrain All button purges tuning rules and retrains every model from scratch, while the model status dashboard tracks per-model health, last training time, detection count, and ensemble weight. The brain canvas legend provides a collapsible panel with data sources, model descriptions, signal semantics, and an ASCII DAG.

Key Capabilities

• 18-model ensemble: Adaptive Baseline, Isolation Forest, Markov Chain, K-Means, Holt-Winters, Latency Baseline, and Threat Intel Model
• Neural Brain Canvas with biologically accurate HTML5 Canvas visualization at 60fps featuring 1200 ambient neurons and 25-edge pipeline graph
• Event-driven synaptic sparks, detection flash rings, training ripple animations, and AI Core energy glow proportional to correlation buffer activity
• Adaptive Ensemble Weights that auto-adjust based on TP/FP operator feedback using F1-inspired scoring
• Correlation Engine v5 with 12 cross-model rules: Host Escalation, Prefix Under Attack, Silent Drop, AS Instability, and more
• ML scores contribute up to 30 points to the 5-pillar Unified Threat Score
• Training schedules: Baseline (1h), IsoForest (30min), Markov (1h), K-Means (2h), Holt-Winters (6h), Latency (continuous), ThreatIntel (6h)
• Closed-loop learning: detections trigger Claude analysis, auto-generate AI Tuning rules, and enter operator approval workflow
• 42 built-in ML flow detection rules across 8 behavioral categories: scanning, brute-force, DDoS, exfiltration, C2, lateral movement, protocol abuse, and reconnaissance
• Retrain All button to purge tuning rules and retrain all models from scratch
• Model status dashboard with per-model health, last training time, detection count, and ensemble weight
• Brain canvas legend with collapsible panel showing data sources, model descriptions, signal semantics, and ASCII DAG

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →