web3 / 2026
Kaizen — Real-Time EVM Threat Detection & Autonomous Mitigation
Real-time EVM security platform that intercepts pending mempool transactions, computes a 21-field behavioral feature vector, runs an Isolation Forest + Random Forest ML ensemble, and executes autonomous protocol-level defense before exploits confirm.
Feature signals per tx
21 (flow, caller, gas & anomaly signals)
ML detection ensemble
Isolation Forest (unsupervised) + Random Forest
Defense contracts
KillSwitch · AntonTimeLock · DelegatedAuthority
Data architecture
4 purpose-built stores (PostgreSQL, InfluxDB, MongoDB, Redis)
01 / The Mempool Defense Window: Shifting Security Left
The Mempool Defense Window: Shifting Security Left
Most decentralized finance exploits execute within a single transaction, leaving security teams and automated monitors in a purely forensic posture. Post-incident alerts arrive only after blocks have finalized and protocol reserves have already been depleted. Kaizen operates on the premise that virtually all smart contract attacks emit measurable behavioral anomalies during their broadcast phase in the public mempool—unusual gas auctions, rapid caller rotation, sudden liquidity drains, or unauthorized governance calls. By intercepting and analyzing transactions during the critical window between network broadcast and block inclusion, Kaizen creates an operational window for automated intervention, transforming security from retrospective autopsy to proactive runtime mitigation.
- Monitors the unconfirmed mempool via WebSocket RPC to identify adversarial patterns before block inclusion
- Eliminates the multi-second latency of block-level monitoring where mitigation is already too late
- Hot-path contract filtering via low-latency Redis sets discards irrelevant network traffic immediately
- Reconstructs full transaction parameters dynamically when providers emit hash-only broadcast notifications
02 / Multi-Dimensional Feature Engineering & Anomaly Scoring
Multi-Dimensional Feature Engineering & Anomaly Scoring
To distinguish legitimate protocol usage from sophisticated adversarial exploits at mempool velocity, Kaizen computes a 21-dimensional statistical feature vector for every relevant transaction. The extraction engine evaluates three core signal dimensions: financial liquidity velocity (tracking net flow, cumulative outflow, and single-transfer magnitude), caller behavior (evaluating novel sender ratios, call frequency per address, and caller dispersion entropy), and protocol privilege abuse (detecting unauthorized admin function invocations and governance delegation spikes). These metrics are normalized against rolling statistical baselines using z-score deviations and persisted at nanosecond precision in InfluxDB, providing both instantaneous anomaly signals and granular historical context for longitudinal trend analysis.
- 21 typed feature signals span capital outflow velocity, caller dispersion, and gas market anomalies
- Z-score normalization against rolling time windows flags statistical outliers in real time
- Nanosecond-precision InfluxDB persistence enables sub-minute aggregations and historical trend audits
- Dynamic ABI fingerprinting at registration tailors monitoring sensitivity to each contract's capability profile
03 / Dual-Stage Machine Learning & Graduated Escalation
Dual-Stage Machine Learning & Graduated Escalation
Raw transaction metrics are evaluated through an ensemble inference service engineered to balance novel exploit discovery with strict precision. The first stage employs an unsupervised Isolation Forest model, trained to identify anomalous structural deviations without requiring labeled historical attack signatures—enabling the detection of zero-day attack methodologies. The second stage utilizes a supervised Random Forest classifier trained on historical exploit datasets to categorize known attack topologies, such as flash-loan attacks, reentrancy drains, and administrative takeovers. Rather than forcing binary decisions, the ensemble outputs calibrated continuous risk scores mapped to a four-tier escalation ladder: silent audit logging, stakeholder notification, manual pause recommendation, or autonomous protocol defense.
- Isolation Forest detects novel zero-day exploit patterns without requiring labeled attack signatures
- Random Forest categorizes known attack archetypes with calibrated multi-class probability scores
- Four-tier escalation ladder: LOG_SILENT → ALERT_ONLY → ALERT_RECOMMEND_PAUSE → AUTONOMOUS_KILL_SWITCH
- Sub-100ms inference turnaround in FastAPI ensures real-time evaluation within mempool propagation windows
04 / Hybrid Messaging Topology: Telemetry Streaming vs. Defensive Execution
Hybrid Messaging Topology: Telemetry Streaming vs. Defensive Execution
The core engineering challenge in real-time threat response is reconciling high-throughput, loss-tolerant telemetry streaming with deterministic, zero-failure defensive execution. Kaizen resolves this tension through a hybrid messaging topology. High-volume security telemetry—comprising thousands of enriched transaction events, feature vectors, and inference payloads per second—streams through Apache Kafka's partitioned, replayable log. Conversely, high-risk mitigation jobs (such as emergency contract pausing or circuit breaker activation) are routed through RabbitMQ persistent queues. This deliberate separation guarantees that telemetry volume spikes never introduce queue latency into time-critical defensive interventions, while dead-letter queues and Redis worker heartbeats provide fault-tolerant execution.
- Kafka partitions handle thousands of security telemetry events per second with replayable offset tracking
- RabbitMQ persistent queues guarantee at-least-once delivery for mission-critical defensive workflows
- Strict queue isolation prevents high-volume telemetry ingestion from delaying emergency mitigation tasks
- Lightweight Redis worker heartbeats enable automatic distributed worker liveness monitoring and failover
05 / Autonomous Protocol Defense & On-Chain Intervention
Autonomous Protocol Defense & On-Chain Intervention
When an exploit passes the highest risk threshold, automated alerting alone is insufficient to prevent catastrophic loss. Kaizen's guardian engine executes protocol-level defensive countermeasures directly on-chain through a suite of purpose-built Solidity contracts. Protocols integrate with standardized guardian components—including KillSwitch for immediate state freezing, AntonTimeLock for time-delayed governance execution, and DelegatedAuthority for multi-signatory permission gating. TypeScript controllers, fortified by Typechain-generated contract bindings, dispatch autonomous mitigation transactions with priority fee bidding, ensuring the defense transaction confirms before the attacker's pending exploit transaction can execute.
- Programmatic KillSwitch invocation executes emergency protocol pauses without waiting for governance quorum
- AntonTimeLock enforces configurable delay windows on high-impact administrative and governance calls
- Typechain compile-time typing guarantees contract interaction safety between off-chain services and Solidity
- Priority gas-market strategies optimize defensive transaction submission to preempt exploit confirmation
06 / Polyglot Persistence & Distributed Service Architecture
Polyglot Persistence & Distributed Service Architecture
Kaizen rejects monolithic database design in favor of polyglot persistence matched to specific operational workloads. PostgreSQL with Prisma manages multi-tenant project configurations, registered contracts, and role-based access controls. InfluxDB ingests high-frequency, time-stamped security metrics and rolling anomaly windows. MongoDB maintains unstructured exploit payloads, transaction calldata, and immutable audit logs. Redis operates as an in-memory hot tier, managing sliding-window rate counters, transaction deduplication keys, and contract monitoring sets. The system runs as a distributed Turborepo monorepo with five independently scalable services, containerized with Docker for robust horizontal scaling and failure isolation.
- Workload-aligned polyglot data architecture: PostgreSQL, InfluxDB, MongoDB, and Redis
- Redis hot tier provides sub-millisecond deduplication and sliding-window state management
- Turborepo monorepo enables independent deployment and scaling of ingestion, ML, and defense services
- Comprehensive audit trails record full transaction payloads and decision rationale for post-incident review
07 / Architecture
System design decisions.
The defining architectural principle in Kaizen is the separation of high-throughput telemetry ingestion from deterministic defensive execution. Mempool telemetry arrives at thousands of events per second and benefits from Kafka's partitioned, replayable log. In contrast, defensive actions—such as executing an emergency pause on an endangered protocol—require guaranteed, prioritized delivery handled via RabbitMQ with exponential backoff and dead-letter routing. Decoupling the telemetry stream from the mitigation queue ensures that network spikes never delay time-critical defense. On the ML tier, combining unsupervised anomaly detection with supervised exploit classification provides defense-in-depth against both novel zero-days and documented attack topologies.
08 / Challenges
The hard parts.
False positive calibration at mempool speed
Overly aggressive anomaly detection risks triggering emergency pauses on legitimate high-value transactions—a catastrophic failure mode for active protocols. Kaizen balances sensitivity with operational safety through multi-signal consensus: isolated anomalies cannot trigger defense execution. Both ML models emit calibrated continuous probabilities, requiring convergent signals across liquidity outflow, caller novelty, and call-tree entropy before escalating to autonomous mitigation.
Maintaining rolling behavioral state at transaction throughput
Evaluating behavioral features—such as per-address transaction counts over 60 seconds or cumulative liquidity outflows over 5 minutes—requires sub-millisecond read-write cycles at mempool ingestion rates. Kaizen delegates sliding time-window state to Redis using sorted sets with epoch timestamp scoring and atomic pipelined increments, keeping the ingestion pipeline stateless and immune to memory leaks.
Recovering transaction context from hash-only node broadcasts
WebSocket mempool feeds occasionally emit hash-only transaction notifications lacking input calldata, value, and address metadata. Kaizen resolves this via an asynchronous fallback to JSON-RPC endpoints, transforming WebSocket connection URIs to HTTP RPC paths dynamically. Transactions returning empty payloads or invalid receipt states are safely dropped to maintain feature vector integrity.
09 / Takeaways
What the build taught me.
- Filtering mempool traffic at the earliest possible stage—using Redis set lookups before triggering deserialization or feature extraction—is vital for sustaining high-throughput ingestion without backpressure.
- Dynamic ABI fingerprinting at contract registration is far superior to runtime introspection, ensuring the hot path remains entirely free of expensive reflection overhead.
- A graduated four-tier escalation ladder (LOG_SILENT → ALERT_ONLY → ALERT_RECOMMEND_PAUSE → AUTONOMOUS_KILL_SWITCH) provides protocol teams with actionable risk control without requiring model retraining.
- Separating telemetry streaming (Kafka) from prioritized defensive execution (RabbitMQ) eliminates the risk of high-volume event bursts delaying time-critical mitigation jobs.
10 / Stack
