DEV Community: Mustafa Güngör

How I Rewrote Synapse Shield in Rust: Achieving Sub-Millisecond Kinematic Biometrics & 15 Multi-Platform Native Wheels with Maturin

Mustafa Güngör — Thu, 24 Sep 2026 19:38:42 +0000

When building an in-process Web Application Firewall (WAF) and bot mitigation system, your margin for latency error is practically zero.

Traditional CAPTCHAs degrade user experience, and cloud-based WAFs (like Cloudflare or AWS WAF) often inject 100ms to 250ms of network round-trip overhead. With Synapse Shield, my objective was clear: zero user friction (no puzzles, no clicks) and zero external network hops.

Everything had to happen inside the application process within microseconds.

In earlier versions (v0.6.x – v0.7.x), the core engine was written entirely in Python. While Python excels at rapid prototyping, orchestrating async web requests, and serving ML inference, it hit a brick wall when handling high-throughput kinematic feature extraction and concurrent state verification under botnet load.

Here is the technical deep-dive into how I re-engineered Synapse Shield’s core into Rust (synapse-core-rs), dropped feature extraction latency from 123 µs to 22 µs, replaced SQLite disk bottlenecks with an atomic two-bucket in-memory nonce cache, and automated the cross-compilation of 15 multi-platform native wheels using Maturin and GitHub Actions.

1. The Bottlenecks: Why Pure Python Reached Its Limit

To distinguish synthetic mouse and keyboard movements (generated by Puppeteer, Playwright, or Selenium) from biological humans, Synapse Shield extracts 24 kinematic and biometric features over time-series telemetry:

Third-order derivatives (Jerk: $d^3x/dt^3$): Detecting neuromuscular micro-tremors (8–12 Hz) that algorithmic bots either omit or fake with naive Gaussian jitter.
Fitts’ Law Terminal Deceleration: Biological motor control naturally decelerates in the final 25% of a ballistic trajectory as visual feedback guides the cursor to the target.
Euclidean Straightness & Curvature: Ratio of displacement to path length ($\frac{D}{\sum \Delta s}$).
Power Spectral Density & Spectral Entropy: Discrete Fast Fourier Transforms (RFFT) on velocity vectors.

       [ Client Telemetry (x, y, t) ]
                      │
                      ▼
   ┌─────────────────────────────────────┐
   │        Kinematic Differentiation    │
   │  Velocity (dx/dt) -> Accel -> Jerk  │
   ├─────────────────────────────────────┤
   │     Spectral Analysis (RFFT/PSD)    │
   ├─────────────────────────────────────┤
   │   Two-Bucket Nonce Replay Check     │
   └─────────────────────────────────────┘
                      │
                      ▼
             [ Bot / Human Score ]

The Problems Encountered:

GIL and Loop Overhead: Iterating over 150–300 trajectory points, calculating trigonometric arc distances, and running continuous numerical differentiations in Python loops incurred significant interpreter overhead.
Memory Allocation Churn: Dynamically allocating dozens of temporary lists per request under 5,000 req/s triggered aggressive Python garbage collection cycles.
SQLite Disk Locks under DDoS: To prevent replay attacks, nonces were originally written to an atomic SQLite table with WAL mode. Under concurrent spikes, SQLite file lock contention (sqlite3.OperationalError: database is locked) degraded throughput and increased p99 latency to over 15ms.

The solution was obvious: Extract the CPU-intensive numerical math and the high-concurrency state management into a compiled, memory-safe Rust extension.

2. Re-engineering Kinematics in Rust

In Rust (crates/synapse_core_rs/src/kinematics.rs), we process raw telemetry without heap allocations wherever possible, passing continuous slices and pre-allocating vectors with Vec::with_capacity.

Calculating Neuromuscular Jerk ($d^3x/dt^3$)

Synthetic curves (like Bézier or linear interpolation) look smooth to the naked eye, but in the 3rd derivative, their jerk profile collapses to zero or produces unnatural step functions.

Here is how we calculate discrete accelerations and absolute jerk:

// Accelerations & Jerk extraction in Rust
if velocities.len() >= 2 {
    let mut accelerations = Vec::with_capacity(velocities.len() - 1);
    for i in 1..velocities.len() {
        accelerations.push((velocities[i] - velocities[i - 1]) / dts[i]);
    }

    let acc_count = accelerations.len() as f64;
    let avg_acc: f64 = accelerations.iter().sum::<f64>() / acc_count;
    feat.avg_acceleration = avg_acc;
    feat.acceleration_var = accelerations.iter()
        .map(|&a| (a - avg_acc).powi(2))
        .sum::<f64>() / acc_count;

    if accelerations.len() >= 2 {
        let mut jerks = Vec::with_capacity(accelerations.len() - 1);
        for i in 1..accelerations.len() {
            jerks.push((accelerations[i] - accelerations[i - 1]) / dts[i + 1]);
        }

        if !jerks.is_empty() {
            let jerk_sum: f64 = jerks.iter().map(|&j| j.abs()).sum();
            feat.avg_jerk = jerk_sum / (jerks.len() as f64);
        }
    }
}

Discrete Spectral Analysis (RFFT) Without Heavy External BLAS

Rather than pulling in massive C-libraries (like FFTW) which complicate cross-compilation, we implemented a lightweight Discrete Real Fourier Transform optimized for small sequences ($N \le 300$ points):

pub fn compute_spectral_features(velocities: &[f64], avg_vel: f64, feat: &mut ExtractedFeatures) {
    let n = velocities.len();
    let num_freqs = n / 2 + 1;
    let mut psd = Vec::with_capacity(num_freqs);
    let v_centered: Vec<f64> = velocities.iter().map(|&v| v - avg_vel).collect();

    for k in 0..num_freqs {
        let mut re = 0.0;
        let mut im = 0.0;
        let angle_factor = 2.0 * std::f64::consts::PI * (k as f64) / (n as f64);
        for (t, &val) in v_centered.iter().enumerate() {
            let angle = angle_factor * (t as f64);
            re += val * angle.cos();
            im -= val * angle.sin();
        }
        let power = (re * re + im * im) / (n as f64);
        psd.push(power);
    }
    // Compute Spectral Purity & Spectral Entropy...
}

3. Sub-Microsecond Nonce Cache: The Two-Bucket Architecture

To prevent token replay attacks without touching the disk or invoking SQLite locks, we engineered a Two-Bucket In-Memory State Engine wrapped in an RwLock:

pub struct StateEngine {
    current_bucket: HashSet<String>,
    previous_bucket: HashSet<String>,
    last_rotation: Instant,
    window_duration: Duration,
    ip_bans: HashMap<String, u64>,
}

Why Two Buckets?

If you store nonces in a single hash set with individual TTLs, you must either run a background sweep thread (which causes locking pauses) or store timestamps with every entry (increasing memory overhead).

With Two Buckets:

Nonces are inserted into current_bucket.
When window_duration (e.g., 60 seconds) expires, previous_bucket is replaced with current_bucket via std::mem::replace, and a new, clean current_bucket is initialized.
Checking a nonce requires checking current_bucket.contains() or previous_bucket.contains().
Time Complexity: $O(1)$ lookups and $O(1)$ rotation, zero disk I/O, sub-microsecond latency ($< 0.8\ \mu s$).

pub fn consume_nonce(&mut self, nonce: &str) -> bool {
    self.maybe_rotate();

    // Check if seen in either active window
    if self.current_bucket.contains(nonce) || self.previous_bucket.contains(nonce) {
        return false; // Replay attack detected!
    }

    self.current_bucket.insert(nonce.to_string());
    true
}

4. Bridging Rust to Python via PyO3

Using PyO3, exposing our Rust engine to Python required zero boilerplate.

use pyo3::prelude::*;
use pyo3::types::{PyDict, PyAny};

#[pyfunction]
fn extract_features_rs<'py>(py: Python<'py>, telemetry: &Bound<'py, PyAny>) -> PyResult<Bound<'py, PyDict>> {
    let raw = parse_python_telemetry(telemetry);
    let feat = compute_kinematics(&raw);
    features_to_pydict(py, &feat)
}

#[pymodule]
fn synapse_core_rs(m: &Bound<'_, PyModule>) -> PyResult<()> {
    m.add_function(wrap_pyfunction!(is_rust_core_active, m)?)?;
    m.add_function(wrap_pyfunction!(extract_features_rs, m)?)?;
    m.add_function(wrap_pyfunction!(consume_nonce_rs, m)?)?;
    m.add_function(wrap_pyfunction!(is_ip_banned_rs, m)?)?;
    Ok(())
}

Seamless Python Fallback

In Python, we gracefully detect whether the native binary is present. If someone installs on an unsupported embedded architecture, it smoothly falls back to pure Python:

try:
    import synapse_core_rs as _core
    RUST_CORE_AVAILABLE = True
except ImportError:
    _core = None
    RUST_CORE_AVAILABLE = False

def extract_features(telemetry: dict) -> dict:
    if RUST_CORE_AVAILABLE:
        return _core.extract_features_rs(telemetry)
    return _python_fallback_extract_features(telemetry)

5. Shipping 15 Multi-Platform Native Wheels with Maturin

The biggest hurdle with compiled C/Rust extensions in Python is user distribution. If a user does pip install your-package and their machine triggers cargo build without a Rust toolchain installed, the installation fails.

We solved this by using Maturin paired with GitHub Actions matrix builds to generate pre-compiled binary wheels for:

Linux: manylinux_2_17 and musllinux_1_1 (x86_64, aarch64) across CPython 3.9, 3.10, 3.11, 3.12, and 3.13.
macOS: universal2 (supporting both Apple Silicon M-series and Intel x86_64).
Windows: MSVC x86_64.

The GitHub Actions Workflow Snippet:

name: Build Native Wheels
on:
  push:
    tags: ['v*']

jobs:
  build_wheels:
    name: Wheel on ${{ matrix.os }} (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
          - os: macos-latest
            target: universal2-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Build Wheels with Maturin
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist -m crates/synapse_core_rs/Cargo.toml
          manylinux: auto

When users run pip install synapse-shield, pip automatically pulls the pre-built .whl for their exact OS and Python ABI. Zero C++ compilers, zero Rust toolchains required on the client machine.

6. Benchmarks: 10,000-Request Stress Test

To validate the architecture, we ran an adversarial benchmark simulating a high-rate botnet assault (10,000 continuous requests across 50 worker threads).

Metric	Pure Python (v0.7.x)	Rust Core (`synapse-core-rs` v0.8.2)	Improvement
Feature Extraction Latency	`123.4 µs`	`21.8 µs`	~5.6x faster (82% reduction)
Replay Nonce Verification	`1,240.0 µs` (SQLite)	`0.7 µs` (Two-Bucket)	~1,700x faster
Max Throughput (RPS)	`2,450 req/s`	`11,200 req/s`	4.5x higher capacity
P99 Defense Latency	`18.2 ms`	`0.84 ms`	Sub-millisecond guaranteed
Dropped / Locked Requests	`0.42%` (SQLite lock)	`0.00%`	100% Reliability

Under saturated load, the pure Python version choked on SQLite locks and GIL context switching. The Rust native engine kept CPU utilization flat and processed all 10,000 requests without a single dropped packet.

Key Lessons for Systems Engineers

Don't rewrite everything—isolate the hot paths: Python is fantastic for FastAPI middleware, configuration parsing, and routing. Rust is unmatched for high-frequency differentiation, cryptographic hashing, and atomic concurrency. PyO3 gives you the best of both worlds.
Disk I/O has no place in microsecond security pipelines: Moving replay attack prevention from SQLite into an in-memory double-buffering scheme (Two-Bucket) provided the single largest latency win.
Maturin makes shipping Rust wheels delightful: Building cross-platform binary wheels used to require terrifying Docker setups. With maturin-action, distributing native extensions to PyPI is now as straightforward as publishing pure Python packages.

Links & Source Code

📦 PyPI: synapse-shield | synapse-core-rs
💻 GitHub Repository: 0xStoic-bit/Synapse_Shield
📝 License: MIT

If you are working on bot mitigation, biometric signal processing, or writing high-performance Python extensions in Rust, feel free to star the repo or leave your thoughts below!

Building a 19D Kinematic Biometrics Engine for Bot Mitigation in FastAPI

Mustafa Güngör — Tue, 15 Sep 2026 19:47:19 +0000

The Problem with Modern Bot Detection

Most web applications rely on standard rate-limiting (Leaky Bucket, Token Bucket) or invasive third-party CAPTCHA widgets.

However, modern automated scrapers and headless browser suites (Playwright, Selenium-Stealth, Undetected-Chromedriver) bypass IP-based rate limiters with cheap residential proxies. Meanwhile, forcing human users to click traffic lights or solve distorted puzzles degrades user experience and leaks privacy.

What if we could identify automation at the middleware layer using pure behavioral biometrics — without storing a single piece of Personally Identifiable Information (Zero-PII)?

Here is how I designed and built a 19-dimensional kinematic engine and cryptographic challenge protocol from scratch.

Architecture Overview: The 5 Defense Layers

Instead of treating incoming HTTP requests as isolated JSON payloads, the engine processes telemetry through a multi-tiered pipeline:

[ Incoming Request ]
         │
         ▼
[ Layer 1: Cryptographic Guard ]   ── HMAC-SHA256 Challenge & Single-Use Nonce
         │
         ▼
[ Layer 2: Anti-Stealth Scanner ]  ── Prototype Unhooking & Runtime Checks
         │
         ▼
[ Layer 3: 19D Kinematics Engine ] ── Jerk Analysis & Fitts's Law Profiling
         │
         ▼
[ Layer 4: Micro-Brain (1D-CNN) ]  ── 60-Step Sequence Pattern Detection
         │
         ▼
[ Layer 5: Network Anomaly Guard ] ── Sliding-Window Poisson & IP Quarantine

1. Kinematics: Why Bots Fail at Third-Order Derivatives

Most bot scripts simulate mouse movements using linear interpolation, Bézier curves, or basic Gaussian jitter. While a Bézier curve looks smooth to the naked eye, its physical properties immediately expose it.

Neuro-Muscular Tremor & Jerk Analysis

Human motor control is naturally imperfect due to neuromuscular lag. When a human moves a cursor:

Position: x(t)
Velocity: v(t) = dx/dt
Acceleration: a(t) = d²x/dt²
Jerk: j(t) = d³x/dt³

Automated scripts trying to minimize jerk (such as Flash & Hogan models) or applying naive random noise generate unnatural velocity spikes or mathematically flat jerk profiles.

In our telemetry extractor, we compute discrete third derivatives over microsecond-stamped coordinates:

import numpy as np

def calculate_jerk_profile(timestamps: np.ndarray, x: np.ndarray, y: np.ndarray):
    dt = np.diff(timestamps)
    # Prevent zero-division on microsecond clamping
    dt = np.where(dt <= 0, 1e-6, dt)

    # Velocities
    vx = np.diff(x) / dt
    vy = np.diff(y) / dt

    # Accelerations
    dt_mid = 0.5 * (dt[:-1] + dt[1:])
    ax = np.diff(vx) / dt_mid
    ay = np.diff(vy) / dt_mid
    a = np.hypot(ax, ay)

    # Jerk (Third derivative)
    dt_jerk = dt_mid[:-1]
    jerk = np.diff(a) / dt_jerk

    return float(np.var(jerk)), float(np.mean(np.abs(jerk)))

Terminal Deceleration (Fitts's Law)

When humans move a pointer to click a target, the final 20–25% of the trajectory exhibits progressive deceleration to stabilize target acquisition.

Bots typically maintain constant velocity until the exact click coordinate or snap abruptly. By calculating velocity ratios in the terminal phase, robotic trajectories are separated with high statistical confidence.

2. Zero-PII Cryptographic Defense

Client-side behavioral collectors are worthless if an attacker can simply capture a real human session and replay the payload.

To guarantee zero data storage while maintaining atomic replay resistance:

The server issues a timestamped, HMAC-SHA256 signed token containing a high-entropy random nonce.
The client telemetry payload is signed alongside this nonce.
The middleware verifies that elapsed time exceeds a physiological human threshold (t_elapsed > 1500 ms).
The nonce is consumed atomically via distributed cache (Redis SET key 1 EX 120 NX or local SQLite WAL transactions).
Any subsequent request reusing the same token is rejected with HTTP 403 instantly.

3. Fast In-Process Inference Without Bloat

A security middleware cannot afford 100ms inference latencies. Standard PyTorch or TensorFlow runtimes introduce heavy memory footprints and cold-start penalties.

Instead:

The 1D-CNN sequence classifier was trained offline on trajectory vectors.
Model weights were exported directly to compressed NumPy arrays (.npz).
The forward pass is executed in pure NumPy using vector operations, completing inference in under 2 milliseconds inside the ASGI event loop.

Key Takeaways

Physical laws beat statistical obfuscation: Advanced stealth tools can fake navigator.webdriver, but mimicking human neuromuscular jerk across time derivatives without massive latency overhead is computationally expensive for scrapers.
Stateless cryptography reduces attack surfaces: You don't need user cookies or session tables to verify authenticity.
Keep middleware lean: Pre-compiled arrays and pure matrix operations beat bloated ML runtime dependencies every single time.

What challenges have you faced when dealing with modern automated traffic? Let's discuss in the comments below!

I built an open-source alternative to Cloudflare Turnstile using Fitts's Law and Kinematics

Mustafa Güngör — Tue, 01 Sep 2026 12:23:05 +0000

Hey everyone! 👋

I’ve always hated intrusive CAPTCHAs and expensive proprietary cloud WAFs. Even the "invisible" ones (like Cloudflare Turnstile or reCAPTCHA v3) are black boxes that collect massive amounts of user telemetry.

So, I spent the last few months building Synapse Shield — a completely open-source, self-hosted behavioral bot mitigation engine for Python (FastAPI/Django/Flask) and React.

🔗 GitHub Repository: https://github.com/0xStoic-bit/Synapse_Shield
📦 PyPI Package: https://pypi.org/project/synapse-shield/

🧠 How it works (Kinematics & Math)

Instead of just checking if a mouse moves in a straight line, Synapse Shield analyzes 19D kinematic vectors in sub-milliseconds:

Jerk (3rd Derivative of Position): Human muscles have micro-tremors. Bots (even advanced Bézier curve bots) produce near-zero or static Jerk. The engine looks for biological tremors ($da/dt$).
Fitts's Law Terminal Deceleration: Humans naturally decelerate as the cursor approaches a target to click. We measure the terminal_decel_ratio to catch bots.
Poisson Anomaly Detection: Headless API flooders are caught using a cumulative Poisson distribution algorithm.

✨ Key Features & Hardening (v0.5.0)

⚡ Async Non-Blocking SLA (<0.5ms): Offloaded via asyncio.to_thread so it never blocks the FastAPI/Django event loop.
🔐 Cryptographic Replay Defense: Uses HMAC-SHA256 signed nonces (with SQLite WAL) to ensure tokens can't be replayed.
♿ Accessibility Mode: accessibility_mode=True gracefully scales down kinematic thresholds so motor-impaired users aren't falsely flagged.
⚛️ React & Next.js SSR Support: Native "use client" Drop-in Component and hook to avoid Hydration errors.
📈 Enterprise Prometheus Metrics: Native PROMETHEUS_MULTIPROC_DIR support for Gunicorn/Uvicorn workers.

🚀 Quick Code Example (FastAPI)


python
from fastapi import FastAPI, Request
from synapse_shield import shield_protect, SynapseShieldMiddleware

app = FastAPI()
app.add_middleware(SynapseShieldMiddleware, protected_paths=["/api/auth"])

@app.post("/api/login")
@shield_protect(max_risk_score=50.0, accessibility_mode=False)
async def login(request: Request):
    return {"status": "authenticated"}

I'm a 2nd-year Computer Engineering student, and I built this to bridge the gap between low-level math and modern web frameworks.

I’d love your feedback, code audits, or ideas on how to improve the kinematics engine!