Northstar

• 

🛡️ What It Does

NorthStar is a working prototype of an adaptive security risk engine that evaluates behavioral security signals, incorporates historical risk context, and generates explainable security decisions.

🔍 Behavioral Threat Detection

NorthStar evaluates signals including:

• New or unfamiliar devices
• Changes in location
• Unusual activity velocity
• Failed authentication attempts
• Account recovery attempts
• Previous critical-risk events
• Historical verification and restriction decisions

The engine combines current-event signals with historical context to produce a risk assessment.

🧠 Adaptive Risk Evaluation

NorthStar calculates an initial risk score from the current event and applies a bounded historical adjustment when configured escalation conditions are met.

Conceptual risk model:

Adaptive Risk = min(100, Base Risk + Historical Adjustment)

Where:

• Base Risk: Risk calculated from the current event
• Historical Adjustment: Additional risk derived from qualifying historical behavior
• Adaptive Risk: Resulting risk score

Risk scores are bounded to the supported 0–100 range.

🛡️ Explainable Security Decisions

NorthStar maps evaluated risk to three security outcomes:

Risk Level	Decision	Meaning
LOW	ALLOW	No additional intervention recommended
MEDIUM	ADDITIONAL_VERIFICATION	Additional verification recommended
CRITICAL	RESTRICT_AND_REVIEW	Restriction and security review recommended

These are prototype recommendations, not evidence of enforcement against real production accounts.

🔄 Historical Context That Changes Decisions

One of NorthStar's central capabilities is demonstrating how historical behavior can influence an otherwise low-risk event.

In the working demonstration, a login event initially receives a base risk score of zero.

Ordinarily, the engine would return ALLOW.

However, the same simulated actor has:

• Two previous critical-risk events
• Two previous restriction decisions

NorthStar evaluates this historical context and applies an adjustment:

Evaluation	Score
Base risk	0
Historical adjustment	+30
Adaptive risk	30

Resulting decision:

ALLOW → ADDITIONAL_VERIFICATION

The demonstration also explains:

Historical behavior increased risk by 30 points.

This illustrates NorthStar's central capability: historical security context can influence a current decision, and the resulting change remains visible to reviewers.

🔌 Model Context Protocol (MCP) Integration

NorthStar includes a Model Context Protocol (MCP) server implementation.

MCP provides a standardized interface through which compatible clients can discover and invoke exposed tools.

Integration tests demonstrate:

• MCP initialization
• Tool discovery
• Base security evaluation scenarios
• Adaptive risk escalation
• Actor history isolation
• Invalid input rejection
• Untrusted origin rejection

The supplied test output confirms these integration checks passed.

Security boundary: These results establish expected behavior for the tested implementation, not comprehensive production security or deployment readiness.

📋 Explainable Decisions and Audit Records

NorthStar produces structured decision information, including:

• Event identifiers
• Actor identifiers
• Event types
• Risk scores and classifications
• Recommended security actions
• Contributing signals and weights
• Evaluation timestamps

The prototype demonstrates audit record generation, storage, and retrieval.

This makes security decisions easier to inspect, debug, and review.

---

🛠️ How I Built It

I developed NorthStar using JavaScript and Node.js, with GitHub for version control and GitHub Actions for automated testing.

The implementation separates security responsibilities into modular components:

• Behavioral signal evaluation
• Risk scoring and classification
• Security decision logic
• Audit record generation and storage
• Historical behavior analysis
• Adaptive risk evaluation
• Dashboard-oriented data preparation
• Decision explanations and transitions
• MCP server integration

This modular structure helps keep the evaluation process understandable, testable, and extensible.

⚙️ Risk Scoring Methodology

NorthStar applies configured weights to supported security signals.

A simplified representation of the base scoring approach is:

Base Risk = min(100, Sum of Weighted Signal Contributions)

Demonstrated signal weights include:

Security Signal	Weight
New device	15
Location change	20
Unusual velocity	30
Recovery attempt	25
Five failed attempts	25
Account recovery event	15

Multiple contributing signals can produce a critical-risk classification.

🧪 Automated Testing

GitHub Actions executes automated checks against NorthStar's implementation.

Demonstrated test coverage includes:

• Base risk evaluation
• Audit record generation
• Audit storage and retrieval
• Historical behavior analysis
• Adaptive risk adjustments
• Adaptive evaluation and decision changes
• Sequential security event evaluation
• Dashboard data generation
• Dashboard adapters and transitions
• Decision explanations

A separate MCP integration test validates initialization, tool discovery, security evaluation, history isolation, and rejection of invalid inputs and untrusted origins.

The supplied GitHub Actions logs show the automated test suites passing.

📊 Demonstration Scenarios

NorthStar includes five connected demonstration scenarios:

Scenario	Risk Score	Decision
Low-risk login	0	ALLOW
Medium-risk login attempt	35	ADDITIONAL_VERIFICATION
Critical account recovery	100	RESTRICT_AND_REVIEW
Repeated critical activity	100	RESTRICT_AND_REVIEW
Adaptive follow-up login	30	ADDITIONAL_VERIFICATION

The fifth scenario demonstrates how historical context can change a security decision.

All demonstration events use simulated data.

Technical transparency: NorthStar currently uses deterministic, programmed risk-scoring and decision logic rather than a trained machine-learning model.

Built With

• access-control
• adaptive-security
• api-security
• audit-logging
• audit-trail
• authentication
• behavioral-analysis
• cybersecurity
• github
• github-actions
• identity-security
• javascript
• json
• mcp-server
• model-context-protocol
• node.js
• risk-assessment
• security-automation
• security-engineering
• threat-detection