Synapse Edge Defense

# Risk Scoring Lifecycle

How actor risk accumulates, decays, and triggers actions. Dynamic risk scoring at the edge — sub-millisecond decisions, no backend required.

0–100
Risk Range
40
Challenge Threshold
70
Block Threshold
−10/min
Decay Rate
Risk Score Threshold Model
0–39
ALLOW
40–69
CHALLENGE
70–100
BLOCK
0 40 100
Below threshold — request passes, actor monitored
Interrogator engaged — progressive challenges issued
Blocked on sight — request rejected, tarpit active
Risk Sources — What Adds Points
Challenge Failures
+35
Failed Interrogator challenge
JavaScript execution failed
CAPTCHA timeout / wrong answer
Strong indicator of bot behavior
Campaign Membership
+30
Linked to active campaign
Correlated via fingerprints
Shared attack patterns
Automatic when correlated
WAF Detections
+25
SQLi, XSS, path traversal
Command injection
Protocol violations
Per detection, configurable
Threat Intelligence
+20
Known bad IP lists
Tor exit nodes
Datacenter / VPN ranges
Configurable feeds
Rate Violations
+15
Exceeding request limits
Burst patterns
Endpoint hammering
Scales with severity
Signal Anomalies
+10
TLS / User-Agent mismatch
Session behavior anomalies
Auth token inconsistencies
Per anomaly type
Example — Credential Stuffing Attack
Risk climbing from 0 → 90 in 6 requests
ACTOR: 198.51.100.12 · JA4: a]b1c2d3e4f5 · SESSION: new
EVENT
DELTA
SCORE
Request 1: Rate limit triggered
+15
15
Request 5: Failed login pattern detected
+10
25
Request 10: Campaign correlation link
+30
55
CHALLENGE — Interrogator challenge sent
—
55
Challenge failed — JS PoW not computed
+35
90
BLOCKED — Request rejected · Tarpit engaged
—
90
Decay: 5 minutes of good behavior to return below CHALLENGE threshold (if behavior improves)
Risk Decay — How Risk Reduces
−10 pts/min
Configurable decay rate. Risk decreases every minute of good behavior — legitimate requests with no WAF triggers.
Persistent
Risk survives restarts. Actors can't reset their score by reconnecting or rotating IPs (fingerprint tracking).
Configurable
RISK_DECAY_RATE_PER_MINUTE adjustable via API or config file. Tune for your traffic patterns.
Reward Good Behavior
Returning users who behave see their risk drop naturally. No manual intervention needed.