Mirage CD Enterprise

Autonomous cyber deception mesh delivering sub-50ms edge threat ingestion, real-time Supabase pgvector telemetry, and zero-trust enterprise operator control.

Comment

MIRAGE CD: Autonomous Decoy Threat Telemetry & Security Control Room

🚀 Inspiration & Problem Statement

As cloud-native architectures scale globally, modern applications face relentless automated bot reconnaissance, credential stuffing, and sophisticated zero-day attack vectors. Traditional static firewalls and perimeter defenses are no longer enough; modern security teams need active defense mechanisms that not only deflect malicious actors but also capture actionable telemetry in real time without overwhelming security operations teams with alert fatigue.

Mirage CD is an enterprise-grade, edge-native deception mesh and threat telemetry control room designed to deploy lightweight security decoys, trap automated attacks (SQLi, RCE, Path Traversal), persist high-fidelity payload telemetry, and execute autonomous shadow schema mutations across global nodes.

🛠️ What It Does

  • Global Decoy Meshes: Autonomous worker nodes deployed to disorient automated scanner reconnaissance and absorb edge attacks before they touch core production infrastructure.
  • Autonomous Ingestion & Deflection (/api/ingest): Captures intrusion attempts, normalizes attack signatures, and streams live telemetry instantly into Supabase Postgres vector tables.
  • Intelligent Alert Deduplication: Features an in-memory sliding-window cooldown engine that prevents webhook spam by grouping identical attack vectors over a 5-minute threshold.
  • Real-Time Security Ops Integration: Dispatches rich, instant critical threat alerts directly to Slack channels (#security-ops) with severity badges and payload snippets.
  • Live Command Center (/command-center & /dashboard): Provides security engineers with a tactical, dark-mode visualization matrix showing source IPs, attack signatures, severity tiers, and trust index velocity.
  • Mesh Topology Mutation (/api/mutate): Allows administrators to trigger instant shadow schema rotations across active global edge nodes to deceive recurring botnets.

⚙️ Architecture & Tech Stack

  • Frontend & UI: Next.js (App Router, Server Components, force-dynamic real-time rendering), Tailwind CSS, featuring a cyberpunk-inspired enterprise operator console.
  • Database & Persistence: Supabase PostgreSQL (public.threats and vector tables, Row-Level Security policies, and SSR integration via @supabase/ssr).
  • Infrastructure & Deployment: Containerized using Docker and deployed serverlessly on Google Cloud Run (Node 22-alpine containerization), automated via GitLab/GitHub CI/CD pipelines.
  • Telemetry & Notifications: Custom REST endpoints coupled with secure Slack Webhook integrations and real-time WebSocket event streams.

🧗 Challenges Overcome

  1. Schema Caching & SSR Resolution: Migrated to @supabase/ssr and established clean relational table bootstrapping to bypass initial schema cache errors (PGRST205), ensuring zero-downtime database reads during rapid incident ingestion.
  2. Alert Fatigue Mitigation: Engineered an in-memory sliding-window deduplication map directly into the Next.js API ingest route, ensuring security teams are alerted to new threat signatures without being flooded by automated script loops.
  3. Build-Time & Edge Reliability: Managed Next.js static asset collection while ensuring environment variables initialized lazily without breaking container compilation, paired with stateless server-side fetching for instant dashboard updates.

🏆 Accomplishments That We're Proud Of

  • Successfully deployed a fully functional, enterprise-grade cloud security portal live to Google Cloud Run.
  • Verified end-to-end telemetry flow: an incoming simulated RCE or SQL injection attack is trapped, logged to Supabase, pushed to the command center UI, and broadcasted to Slack in under 300 milliseconds.
  • Built a clean separation of concerns using a dual-repo strategy with robust environment hardening and zero-trust operator controls.

🌍 Global Multi-Zone Topology

Mirage CD operates across 3 distributed availability zones to ensure zero-latency interception and regional threat containment:

  • Americas Edge (us-central1): Primary ingestion gateway and control room command center.
  • Europe Edge (eu-west): Regional decoy mesh absorbing EU-targeted bot reconnaissance and credential stuffing.
  • Asia Edge (asia-east): High-throughput telemetry collector managing localized zero-day payload probes.

🔮 What’s Next for Mirage CD (Phase 2 Roadmap)

  • Autonomous LLM-Driven Decoy Mutation: Integrating Gemini API inference at the edge to dynamically rewrite decoy API routes, fake database error messages, and fake Swagger documentation on the fly. If an attacker probes a specific vulnerability, the decoy mutates its structure to mimic an even juicier, custom-tailored target.

  • Intelligent Adaptive Tarpitting: Deploying dynamic latency injection that scales response times based on payload threat scores. Instead of instantly failing requests, automated botnets and vulnerability scanners are trapped in infinite, resource-draining slow loops, starving their compute budgets.

  • Graph-Based Campaign Attribution (pgvector + Clustering): Utilizing Supabase vector embeddings (pgvector) to cluster polymorphic payload signatures. This maps out lateral movement and stitches together disparate attacking IPs into unified threat actor campaigns automatically.

  • Canary Token & Honey-Credential Poisoning: Embedding invisible digital tripwires (such as fake cloud IAM keys, canary tokens, and hidden web bugs) inside decoy response payloads. If an attacker attempts to exfiltrate or reuse these fake credentials downstream, Mirage CD triggers an instant high-priority network quarantine.

  • Autonomous WAF & Edge Blocklist Generation: Automatically converting trapped attacker signatures and behavioral fingerprints into zero-day blocking rules, instantly synchronizing firewall policies across all active global edge nodes (us-central1, eu-west, and asia-east).

Built With

Share this project:

Updates

Submission history