Skip to main content

Cortex

Catch threats no rule has ever seen.

Cortex is the machine-learning inference engine inside the Synapse agent. It scores traffic by behaviour — how a client negotiates a TLS handshake, how it paces requests, how it differs from a known browser. When a model's malicious probability crosses your threshold, Cortex fires the enforcement callback the agent gave it.

On the host — nothing about your traffic leaves itSignalsfingerprintsand flowsFingerprintis this clientmalicious?can enforceFlowdoes this flowbehave badly?can enforceTraffic classwhat kind oftraffic is this?signal onlyverdictverdict7 classesSeverityhow bad, andfor how long?score only, never a TTLPolicy layermaps severity to aban durationdeterministic, auditableEnforcement callbackthe agent's own block pathcrossing the threshold fires it;the class and severity models do notonly two of the models can blockAmygdala→ HillockCan enforceSignal onlyPolicyActionSignalsfingerprints and flowsFingerprint classifieris this client malicious?can enforceFlow classifierdoes this flow behave badly?can enforceTraffic classifierwhat kind of traffic?signal onlySeverity modelhow bad, and how long?score only, never a TTLEnforcement callbackcrossing the threshold fires itonly the top two doPolicy layermaps severity to a ban durationdeterministic, auditableCan enforceSignal onlyActionPolicy
Two models can block. The class and severity models deliberately cannot.

What Cortex is for​

  • Detection without signatures. Find malware, bots, and scrapers before anyone has written a rule for them.
  • On-device inference. Every model is a small ONNX network running on the host's CPU. Nothing about your traffic leaves the machine — no cloud round-trip, no data exfil risk.
  • Proportionate response. A separate severity model decides how long a source stays penalised, so a borderline client is not treated like a confirmed one.
  • Updated without downtime. Models arrive with a signed integrity manifest and are hot-swapped at runtime — no restart, no dropped traffic.

The models​

Cortex is not one classifier. It is a small stack, each part answering a different question.

ModelQuestion it answersShape
Fingerprint classifierIs this JA4+ fingerprint malicious?Binary verdict, can trigger enforcement
Flow classifierDoes this flow behave maliciously?47 features → benign / malicious, ~2 KB
Traffic classifierWhat kind of traffic is this?37 features → 7 classes, ~5 KB
Penalty (severity)How bad is this, and for how long?21 features → severity in [0, 1], ~0.6 KB
JA4-JEPA embedderWhat is this fingerprint near?512-dimensional embedding, no verdict

The models are deliberately tiny — the largest is about 5 KB — with preprocessing baked into the ONNX graph so the agent and the training pipeline cannot drift apart on feature scaling.

Which ones can block​

The fingerprint and flow classifiers expose classify_and_block: cross the threshold and Cortex invokes the callback the agent supplied, which is what turns a score into an XDP or nftables ban.

The traffic classifier deliberately does not gate traffic. Its seven-class output is a parallel signal that informs severity and enrichment; treating a multi-class label as a block/allow decision is out of scope for it by design.

The severity model never emits a ban duration either. It produces a bounded score, and the policy layer maps that to a TTL through a deterministic rule — so the model's role stays auditable and the response stays proportionate.

How it fits​

Cortex is the new-threats detector in the platform. Thalamus catches signatures we already know; Cortex catches the rest. It scores the fingerprints Dendrite produces, and hands its verdicts to the enforcement path.

Inference runs on Linux

Full inference is Linux-only. Cortex compiles on other platforms so the rest of the agent builds and tests cross-platform, but the inference entry points return errors there rather than scoring traffic.

Model maturity varies, and the model cards say so

The runtime paths are production-ready, but the models are at different stages: the traffic classifier is early access, and the severity model currently ships trained on synthetic data. Each model has a card covering training data, evaluation, and limitations — read the card for any model you intend to make a policy decision on.

Use cases​

  • Detect bots without JavaScript challenges — works for APIs, mobile apps, and headless clients.
  • Block credential-stuffing attempts even when the attacker rotates IPs, since the fingerprint survives the address change.
  • Scale the punishment to the offence — a scanner that trips one check gets a short penalty; a source that trips several gets a long one.
  • Score every connection so you can rank investigation queues by ML confidence rather than by alert volume.

See also​