Synapse Edge Defense

# Interrogator System

Progressive challenges that escalate based on response — let humans prove themselves, trip up bots. The goal isn't to block everyone suspicious. It's to create asymmetric friction.

3
Challenge Levels
5-Level
Escalation Path
0
Backend Required
Async
Friction Model
Challenge Escalation Flow
Incoming suspicious request · Risk 40–70 · Not block, not allow
L1
EASY
Cookie Challenge
Set-Cookie header · Check if client returns it
CATCHES: curl, wget, simple scripts — anything that ignores cookies
✓ PASS → Allow
✗ FAIL → Level 2
Risk −10 on pass
L2
MEDIUM
JS Proof-of-Work
SHA-256 computational challenge · Client computes hash
CATCHES: headless browsers, basic bots — can't execute JavaScript or fail PoW
✓ PASS → Allow
✗ FAIL → Level 3
Risk −15 on pass
L3
HARD
CAPTCHA
Image recognition · Human interaction required
CATCHES: sophisticated automation — the last gate before enforcement
✓ PASS → Allow
✗ FAIL → Block + Tarpit
Risk −25 on pass (verified human)
BLK
BLOCK + TARPIT
All challenges failed. Connection held open with artificial delays (1–30s). Each failed challenge adds +20 risk. Retry window shrinks progressively. Attack becomes economically unviable.
Tarpit System
After all challenges fail: asymmetric resource drain
Resource Drain
Connection held open 1–30 seconds. Attackers must wait, consuming their resources — not ours.
Progressive Delay
Each subsequent attempt from the same actor gets a longer delay. Retry windows shrink exponentially.
Economic Impact
Attack becomes economically unviable. Their time and infrastructure are wasted. Attackers move on to easier targets.
Two Paths — Asymmetric Friction
✓ Human / Legitimate User
Browser accepts cookie → Level 1 passes → Access granted
Most users never see Level 2 or 3. Friction is minimal — cookie set/return is invisible to the user. Risk reduction: −10 to −25 points based on level passed.
Friction: Minimal
✗ Bot / Attacker
Script ignores cookies → JS fails → CAPTCHA fails → Blocked
Each failed challenge adds risk, reduces retry window. Tarpits make retry economically painful. Risk increase: +20 per failed challenge, eventual permanent block.
Friction: Maximum
Risk Score Impact
−10
Cookie pass (L1)
−15
JS PoW pass (L2)
−25
CAPTCHA pass (L3)
+20
Per failed challenge