VANGUARD EDGE PROXY & AUTONOMOUS AI SOC AGENT & WAF ENGINE

## Inspiration

This project was originally created as part of my application to the Computer Science program at Kasetsart University. Having a strong passion for coding, I wanted to build a custom protection system similar to Cloudflare from scratch, without using any frameworks. The project went through continuous development until its previous iteration, which unfortunately did not meet the university's requirement of being a contest-entered or award-winning project. However, when I discovered this AI competition, I thought integrating AI into my existing system would be incredible. That inspiration is what led to the current version of the project. so I didn't build this entirely on my own, though. Throughout the development process, I used AI as my mentor and instructor—asking it how certain blocks of code should be written, what specific errors meant, and how to troubleshoot various technical challenges along the way. This collaborative learning experience helped me shape the project into what it is today.

## What it does

Vanguard v2 is an autonomous AI Security Operations Center (SOC) agent and high-performance C++17 WAF. When malicious traffic hits the edge proxy, the agent autonomously:

1. Captures and analyzes blocks of live log streams in context.
2. Uses Gemini 3.5 Flash to classify threats and extract attacker IPs.
3. Automatically writes firewall rules, hot-reloads and restarts the C++ proxy, and logs threat intelligence to Google Cloud Firestore — all with zero human intervention.

## How we built it

• C++17 Edge Proxy: Built from scratch using Linux epoll non-blocking I/O, zero-copy parsing with std::string_view, and a thread-safe Token Bucket rate limiter.
• Python / PyQt6 Control Center: A cyberpunk HUD providing real-time RPS tracking, process discovery via psutil, and an interactive AI thought process terminal.
• Autonomous AI Agent: Powered by the Google GenAI SDK (google-genai) with structured JSON outputs and robust retry mechanics.
• Cloud Telemetry: Persists audit trails and security metrics to Google Cloud Firestore.

## Challenges we ran into

One of the toughest challenges was ensuring the AI agent didn't misfire on normal heartbeats or loopback traffic. We solved this by transitioning from single-line analysis to a context-aware log sliding window (grabbing the last 15 lines), giving Gemini the full attack sequence to drastically reduce false positives.

## Accomplishments that we're proud of

• Successfully achieving true "Take Action" autonomy where the AI doesn't just recommend—it actively bans IPs and reloads infrastructure processes in real-time.
• Seamlessly integrating low-level C++ socket networking with high-level Python AI agents and Google Cloud storage.

## What we learned

We learned the extreme importance of context-window management in security automation and how combining high-performance systems programming (C++) with modern multimodal AI (Gemini 3.5 Flash) creates lightning-fast, production-ready defense mechanisms.

## What's next for Vanguard v2

• Integrating distributed multi-node proxy clusters.
• Expanding threat intelligence sharing via real-time webhooks and automated SIEM alerts.

Built With

• c++17
• docker
• firestore
• gemini
• platform
• proprietary
• python
• track