AegisFluxx

AegisFlux is a next-generation, AI-first cybersecurity platform built from scratch. It inherits architectural philosophy from adaptive firewall systems—modular pipelines, adaptive protection, intelligent detection, and high-performance traffic analysis—without reusing any prior implementation code.

Design principles

Principle	Description
Adaptive protection	Policies and enforcement tiers shift in real time from threat telemetry, ML scores, and operator intent.
Modularity	Every stage (decode, classify, score, enforce) is a swappable plugin behind stable traits.
Intelligence plane	ML inference, rules, and heuristics run on a dedicated plane; the dataplane stays lean.
Performance first	Rust dataplane with zero-copy buffers, flow aggregation, and batch scoring.
Observable by default	Structured events, OpenTelemetry hooks, and audit trails for every decision.

Architecture

                    ┌─────────────────────────────────────────┐
                    │           flux-console (UI)              │
                    └────────────────────┬────────────────────┘
                                         │ REST / WS
                    ┌────────────────────▼────────────────────┐
                    │           flux-api (control plane)       │
                    │  policies · tenants · incidents · feeds    │
                    └─────┬───────────────────────┬─────────────┘
                          │ gRPC/HTTP             │
         ┌────────────────▼──────────┐   ┌──────▼──────────────┐
         │   flux-core (dataplane)    │   │  flux-ml (intel)    │
         │  pipeline · adaptive mesh  │◄──│  scoring · models   │
         │  flow store · enforcement  │   │  feature extraction │
         └────────────────┬────────────┘   └─────────────────────┘
                          │
                    [ network traffic ]

Planes

• Dataplane (crates/flux-core): Parses frames, maintains flow state, runs the inspection pipeline, applies adaptive policy decisions at line rate where possible.
• Control plane (services/flux-api): Tenant-scoped configuration, policy versioning, incident lifecycle, integration webhooks.
• Intelligence plane (services/flux-ml): Feature extraction, ensemble scoring, model registry, feedback loop for retraining signals.
• Experience (apps/flux-console): Operator dashboard for live threats, policy editor, and mesh health.

Inspection pipeline

Traffic moves through ordered stages; each stage emits telemetry and can short-circuit:

1. Ingress — normalize timestamps, attach tenant context
2. Decode — L3/L4/L7 framing (extensible decoders)
3. Classify — signature + behavioral tags
4. Score — rules engine + optional ML callback
5. Enforce — allow, rate-limit, challenge, drop, mirror

The Adaptive Policy Mesh (APM) merges static rules, dynamic threat feeds, and ML confidence into a single enforcement tier per flow.

Repository layout

AegisFlux/
├── crates/flux-core/      # Rust dataplane library + CLI
├── services/flux-api/     # TypeScript control API
├── services/flux-ml/      # Python intelligence service
├── apps/flux-console/     # React operator UI
├── contracts/             # OpenAPI + JSON schemas
├── deploy/                # Docker Compose for local stack
└── docs/                  # Architecture deep-dives

Quick start

Prerequisites

• Rust 1.78+
• Node.js 20+ and pnpm 9+
• Python 3.11+
• Docker (optional, for full stack)

Dataplane (Rust)

cd crates/flux-core
cargo run --example demo_pipeline

Intelligence (Python)

cd services/flux-ml
python -m venv .venv
.venv\Scripts\activate   # Windows
pip install -e ".[dev]"
uvicorn flux_ml.app:app --reload --port 8091

Control API + UI

pnpm install
pnpm --filter @aegisflux/api dev
pnpm --filter @aegisflux/console dev

Full local stack

docker compose -f deploy/docker-compose.yml up --build

Configuration

Environment templates live in deploy/.env.example. Copy to .env and adjust ports and API keys before running Compose.

License

MIT — see LICENSE.