AegisView-SOC
TypeScript · React · Kafka · MITRE ATT&CK · Gemini 2.5 Flash
ProblemSOC analysts need every network event triaged and mapped to a MITRE ATT&CK technique before they look at it.
ConstraintThe system supports analyst-in-the-loop investigation, not autonomous blocking — so the design favors high sensitivity and explainability over ML-grade precision.
Key decisionZ-score statistical detection as the first pass, then recover recall in layers: per-IP behavioral baselines make thresholds adaptive per device, external threat feeds (Emerging Threats, Feodo, URLhaus) supply the context the statistics can't see, and a Gemini 2.5 Flash SOC agent re-analyzes each anomaly for a narrative and ATT&CK attribution.
TradeoffPure statistical detection misses low-amplitude, distributed attacks that stay near the mean — accepted, because the analyst plus AI enrichment adjudicates true vs. false positives; for autonomous blocking or a tighter false-positive SLA, this design would be insufficient and would need ML.
Verified resultFull TypeScript/React pipeline from raw telemetry to a configurable, ATT&CK-attributed alert feed, with multi-signal confidence fusion (Z-score + compliance rules + protocol breakdown + forensic chain integrity).
HaloSpec
Rust · Adaptive control · HTTP API
ProblemSpeculative-decoding throughput has to be measured against latency stability, but p99 latency swings hard under real runtime contention.
ConstraintThe harness ran as a single local process against one inference endpoint, with contention simulated by a single CPU busy-loop thread and every other knob pinned (max_tokens, step counts, draft-length bounds). No cluster and no hardware headroom to absorb latency spikes — the controller had to stay stable on its own.
Key decisionDrive draft-length convergence with an EMA-smoothed adaptive controller instead of a fixed threshold, deriving dynamic thresholds from smoothed latency percentiles under non-stationary runtime conditions.
TradeoffEMA smoothing lags sudden load spikes by design — accepted, because that damping is exactly what cut p99 variance under contention.
Verified result30% p99 latency variance reduction under CPU load injection, with an SLO-aware scoring model quantifying throughput-vs-stability tradeoffs.
