Project
Panopticon
Behavioural abuse detection that finds coordinated attacks by clustering on behaviour and JA4 TLS fingerprints instead of IP address, with a population check that flags fleets that look too unique to be real.
Problem
Most rate limiting treats an IP address as a stand-in for a person. An attacker who spreads requests across thousands of rented or residential-proxy addresses keeps each one under the cap, and the limiter blocks none of them.
Approach
Panopticon clusters sources on behaviour and on the JA4 fingerprint of the TLS ClientHello rather than on address, and reports a campaign as one entity with the shared signals listed as evidence. A second, independent check looks at the fingerprint distribution of the whole population: real audiences repeat themselves because they run the same browsers, so a fleet in which almost every source is unique is itself the anomaly.
Design decisions
- No machine learning: fixed, stated rules work from the first request with no training data, cannot be retrained by poisoned traffic, and every flag points at the signals behind it.
- The fingerprint is computed at the network edge, before the connection is proxied; that component is written in Go with no external dependencies.
Limitations
The clustering thresholds are reasoned from how browser populations behave, not fitted to a production traffic corpus; a deployment has to tune them against its own traffic before trusting them.
An attacker who samples real fingerprints and reproduces a realistic distribution, while also varying behaviour convincingly, can stay under both layers; the design raises the cost of evasion rather than ending it.
Security disclosures
Hardening found and fixed three issues, recorded in the repository's threat model: the edge appended to the forwarded-for chain instead of clearing it, which would have let a client inject a false origin; a large enough traffic sample could drive clustering into quadratic memory; and the dashboard schema was reachable in production before it was locked down.