Adaptive Defense Engine

🧠 Self-learning quarantine

The bot maintains a rolling baseline (Welford online mean + variance) for every(flow, party, device) combination. After 20+ samples, if the last 5 σ-scores stay ≥ 5 it auto-quarantines. It auto-releases when the last 10 σ-scores drop ≤ 1.5.

⚠️ Simulated quarantine. Actions flip rows in theflow_quarantine table and are reflected in this UI and OS-BOT. They do not touch real OS firewall, iptables, or router rules.

Baselines learning

< 20 samples

Baselines ready

≥ 20 samples

Active quarantines

Corpus entries

end-to-end retained

🔁 OS-BOT vector relay

/api/osbot-corpus →

Every OS-BOT reply is converted into a structured verdict + confidence vector and relayed back to the defense engine as a soft bias: malicious vectors loosen the σ threshold for quarantine, benign vectors accelerate release. All Q→A→vector tuples are retained in the corpus for end-to-end accuracy review.

No vectors yet. Ask OS-BOT something on / to seed the relay.

Defense loop

auto-tick (20s)

idle

🚨 Active quarantines (0)

Nothing quarantined. The network looks normal to the bot.

📈 Learned baselines (top 30)

flow	party	device	n	μ σ	last σ	recent

No baselines yet — generate some handshakes on the home page first.

📜 Action log

No actions yet.