ML Brain — 18-Model Ensemble Feeding Conviction Engine v2

A single ML model is one viewpoint on the same telemetry — and one viewpoint is one source of bias. The RoutePulse ML Brain runs 18 specialised detectors in parallel, fuses their evidence through Dempster-Shafer combination, and hands the result to the Conviction Engine v2 (SPRT + Thompson Sampling + Conformal Prediction). The architecture is honest about model health: as of v4.32.98–100, three legacy detectors (host_clustering, traffic_predictor, temporal_embeddings) are flagged DORMANT in the UI and contribute zero weight to the ensemble — a dormant-model visibility audit shipped with Hebbian synapse history view and per-row inference state badges.

The pipeline runs on a 5-minute inference cycle with each model bounded by a 120-second hard timeout; CPU-intensive training is offloaded to ml-training-worker.ts worker threads. Active detectors include Adaptive Baseline, Isolation Forest, Markov Chain, K-Means, Holt-Winters, Latency Baseline, Beaconing Detector, Graph Change, plus specialised Carpet Bomb / DNS Tunnel / Reflector detectors and Tier-1 Threat Detectors (QUIC Anomaly, Protocol Mismatch, BGP-Traffic Correlation, DGA/Fast-Flux, Encrypted C2 Profiler). The Neural Brain Canvas renders 1200 ambient neurons at 60 fps with event-driven synaptic sparks, detection flash rings, training ripples, and AI-Core energy glow proportional to correlation buffer activity — every animation is a live signal, not eye candy.

Three-tier model ensemble

Tier 1 (Core, 10 models) ships generic statistical detectors: Adaptive Baseline (EWMA + z-score), Isolation Forest (anomalous feature combinations), Markov Chain (state-transition unlikeliness), K-Means (cluster-distance outliers), Holt-Winters (seasonal decomposition), Latency Baseline, Beaconing Detector, Graph Change. Tier 2 (Specialised) targets specific attack shapes — Carpet Bomb (multi-target volumetric), DNS Tunnel (size + frequency entropy), Reflector Detection. Tier 3 (Tier-1 Threat Detectors) handles modern threats — QUIC Anomaly, Protocol Mismatch, BGP-Traffic Correlation, DGA / Fast-Flux, Encrypted C2 Profiler. Each detector reports score + confidence + provenance trace.

Adaptive Ensemble Weights with operator feedback

Each model carries a weight that adjusts in response to operator TP/FP feedback through an F1-inspired scoring loop. A detector that consistently fires on real attacks gains weight; one that floods the queue with noise loses it — potentially down to zero (the dormant-model state). Weights are visible on the dashboard so the operator can see exactly which detector is currently steering decisions, and a Retrain All button purges tuning rules and retrains every model from scratch for a clean baseline reset.

Correlation Engine v5 — 12 cross-model rules

Patterns that no single model catches: Host Escalation (same source seen in ≥3 detectors within 10 min), Prefix Under Attack (multi-source carpet on common prefix), Silent Drop (volume collapse + peer down), AS Instability, and 8 more rules. ML scores contribute up to 30 points to the 5-pillar Unified Threat Score that feeds the Conviction Engine.

Key Capabilities

• 18-model ensemble (15 active + 3 DORMANT) in src/api/services/ml/, orchestrated by ml-engine-service.ts with 5-minute inference cycle
• v4.32.98–100 dormant-model visibility audit: host-clustering / traffic-predictor / temporal-embeddings shown as DORMANT (weight=0, no ensemble contribution)
• Hebbian synapse history view + per-row inference state badges (TRAINING / READY / DORMANT / TIMEOUT)
• Tier 1 Core: Adaptive Baseline, Isolation Forest, Markov Chain, K-Means, Holt-Winters, Latency Baseline, Beaconing, Graph Change
• Tier 2 Specialised: Carpet Bomb, DNS Tunnel, Reflector Detection
• Tier 3 Threat: QUIC Anomaly, Protocol Mismatch, BGP-Traffic Correlation, DGA / Fast-Flux, Encrypted C2 Profiler
• Neural Brain Canvas: 1200 ambient neurons, 25-edge pipeline graph, 60 fps HTML5 Canvas, event-driven synaptic sparks
• Adaptive Ensemble Weights auto-adjust on TP/FP operator feedback (F1-inspired scoring); weights visible per model
• Correlation Engine v5: 12 cross-model rules (Host Escalation, Prefix Under Attack, Silent Drop, AS Instability, etc.)
• Training schedules: Baseline 1 h, IsoForest 30 min, Markov 1 h, K-Means 2 h, Holt-Winters 6 h, Latency continuous, ThreatIntel 6 h
• CPU-intensive training offloaded to ml-training-worker.ts worker threads with 120-second hard timeout per model
• Closed-loop learning: detections trigger Claude analysis (ANIE) → auto-generated tuning rules → operator approval workflow
• 42 built-in ML flow detection rules across 8 MITRE behavioural categories (scanning, brute-force, DDoS, exfiltration, C2, lateral movement, protocol abuse, reconnaissance)
• ML scores feed Conviction Engine v2 (SPRT + Thompson + Conformal Prediction) for FDR-controlled blackhole decisions

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →