Skip to main content

Architecture Overview

Gen0Sec is a multi-layer Active NDR platform that protects infrastructure from kernel level to application layer. The platform consists of four products that work standalone or together for full-stack protection.

Platform Components​

Synapse - Firewall & Reverse Proxy​

High-performance eBPF-powered firewall and reverse proxy built with Rust. Runs on your servers in two modes:

  • Agent Mode - Kernel-level firewall with XDP packet filtering, threat intelligence, TCP fingerprinting, and access rules enforcement. No HTTP proxying.
  • Proxy Mode - Full reverse proxy with all agent features plus WAF, JA4+ fingerprinting, CAPTCHA, content scanning, TLS management, and upstream load balancing.

Cerebrum - Inline Hardware Sensors​

A line of two appliances, both running stock Synapse in native XDP mode.

Cerebrum Edge — 1U distributed sensor for branch, SASE and SD-WAN edges. Single NXP LX2160A (16 ARM Cortex-A72 cores, 8× 1G + 8× 10G) or dual (32 cores, 12× 1G + 12× 10G), plus one mandatory OCP NIC — 4× SFP+ 10G, or 2× QSFP28 100G on the dual board. Forwarding capacity is 100 Gb/s maximum.

That ceiling is the platform's, not the front panel's: fitting the 100G OCP NIC gives you more port bandwidth than the box forwards. Size against the 100 Gb/s figure.

Cerebrum Max — 2U core and aggregation sensor. NVIDIA Grace C1 on MGX with 72 Neoverse V2 cores and 256 GB LPDDR5, three PCIe Gen5 x16 slots taking BlueField-3 DPUs or ConnectX-7 NICs, 800 Gb/s wire speed.

Both carry the IDS/IPS engine and JA4+ fingerprinting inline. Both are edge appliances for north-south traffic — neither runs inside Kubernetes. For cloud and Kubernetes sites, Synapse in proxy mode covers north-south instead.

Cerebellum - Self-hosted Platform​

The enterprise Gen0Sec platform, running in your own Kubernetes cluster. Three Helm charts install the operators, the data plane and the dashboard.

  • Runs entirely in your cluster — Postgres, Kafka, object store and dashboard included
  • Cross-site correlation across every sensor and agent reporting to it
  • Policy and rule distribution — access rules, WAF rules and ML models reach agents from here
  • ASN and country resolution — policy written against a network or a country is resolved to IP ranges here, so agents only ever receive addresses
  • Install from the registry, or build an offline bundle

See Cerebellum for the full installation and operations guide.

Jailer - Process Sandboxing​

eBPF LSM-powered application isolation:

  • Mandatory Access Control per process
  • File access control - restrict read/write/execute per role
  • Network control - limit connections and listeners
  • Exec control - prevent unauthorized program execution
  • Zero performance overhead, no code changes needed

How It All Connects​

Internetnorth-southtrafficNetwork edgeCerebruminline hardware sensorEdge 100 Gb/sMax 800 Gb/sruns Synapse in native XDPOr nothingcloud and Kubernetessites skip the applianceSynapse proxy covers north-southYour serversSynapseagent or proxy modesix engines: capture, detect,classify, map, decide, enforcesee the component pagesJailerper-process sandboxing via BPF LSMYour applicationsweb, API, databaseProcessesfile, network, exec controlCerebellum — your Kubernetes clusterrules, models and resolved IP ranges down · events and fingerprints upHardwareSoftwareControl planeIsolationInternetnorth-south trafficCerebruminline hardware sensorEdge 100 Gb/s · Max 800 Gb/scloud sites skip thisSynapseagent or proxy modesix engines in one processon your serversJailerper-process sandboxingYour applicationsweb · API · databasepolicy down, events upCerebellumyour Kubernetes clusterrules, models, resolved rangesHardwareSoftwareControl planeIsolation
Traffic runs left to right. Policy and models come down from the cluster; events and fingerprints go up.

Traffic Flow​

  1. Inbound traffic hits the Cerebrum sensor at the network edge
  2. XDP filtering drops known-bad traffic before routing, ahead of the kernel network stack
  3. Cerebrum performs JA4+ fingerprinting and IDS/IPS inspection inline
  4. Clean traffic flows to your servers where Synapse applies access rules, WAF, and threat intelligence
  5. Jailer sandboxes application processes with eBPF LSM — file, network, and exec control
  6. Cerebellum receives metadata from all sensors and servers, runs ML inference, and pushes updated threat verdicts back

Deployment Models​

ModelComponentsUse Case
Agent OnlySynapse (agent mode)Kernel-level firewall on existing servers
ProxySynapse (proxy mode)Reverse proxy with WAF, TLS, load balancing
Edge + ServerCerebrum + SynapseHardware sensor at edge + server protection
Full StackCerebrum + Synapse + Jailer + CerebellumComplete Active NDR with AI-driven correlation

Synapse Internals​

Synapse is not one program with a feature list. It is six engines, each named for a part of the brain, arranged in the order a packet meets them. Every one has its own page; this is the map.

EngineWhat it does
1DendriteCaptures traffic and computes the ten JA4+ fingerprint types. Capture only — it never blocks
2ThalamusMatches Suricata-compatible signatures across thirty-plus application protocols, and emits EVE JSON
3CortexScores behaviour with five small on-device models, so threats with no signature are still caught
4HippocampusBuilds the east-west service graph — what talks to what, and what should
5AmygdalaThe rule engine. Roughly eighty match fields, evaluated in order, first match wins
6HillockMakes the kernel act on the decision — XDP, falling back to nftables then iptables

The split matters for one reason above all: only what is readable from a packet header is compared on the packet path. ASN, country, reputation, ML verdicts and workload identity are resolved either ahead of time by Cerebellum or on the host by Amygdala, and what reaches the kernel is an address, a port, a fingerprint or a rate. That is why an elaborate policy costs no more to enforce than a simple one.

Around them​

  • Reverse proxy — TLS termination or SNI passthrough, upstream selection with health checks, and JA4+ fingerprints forwarded to your backends. See Load Balancing & Proxy
  • WAF — a wirefilter expression language over HTTP requests, with allow, block, challenge and rate-limit actions
  • Threat intelligence and GeoIP — local MaxMind databases, refreshed in the background, so lookups never leave the host
  • Event export — every block, drop, allow and notice from any layer as one stream, in JSON Lines, CEF or OTLP. See Security Event Export

Configuration Reload​

Synapse supports runtime reload via SIGHUP:

kill -HUP $(cat /var/run/synapse.pid)

Hot-reloadable: log level, API credentials, upstreams, security rules, GeoIP databases.

Requires restart: listen addresses, network interfaces, firewall mode, runtime threads, Redis, CAPTCHA, and daemon settings.

Performance​

Forwarding capacityCerebrum Edge: 100 Gb/s maximum. Cerebrum Max: 800 Gb/s
Where packets are droppedAt the XDP hook, before routing — no context switch into user space
Cost per blocked addressA kernel map lookup. It does not grow with the size of the blocklist
Fingerprint coverageTen JA4+ types across TLS, TCP, HTTP, SSH, X.509 and DHCP
Encrypted traffic analysisNo decryption — classification runs on fingerprints and behaviour
ML inferenceOn the host CPU, on models measured in kilobytes. Nothing leaves the machine

Figures are hardware specifications and architectural properties. Per-packet latency depends on your traffic mix, ruleset and hardware, so measure it on your own workload rather than taking a number from a table.