DEV Community: Bangsaen AI

Sub-Millisecond Scam Interception in C++: Defeating Cloud Latency via Koopman Operator Subspace Dynamics

Bangsaen AI — Sat, 24 Oct 2026 11:59:59 +0000

When defending users against active telecommunication fraud, deepfakes, or social engineering attacks, reaction time is everything.

Most modern defense systems attempt to pipe speech-to-text outputs or raw text buffers into cloud-hosted Large Language Models (LLMs) or Python-based runtimes. While these models possess sophisticated linguistic comprehension, they introduce severe bottlenecks:

Network round-trip times (RTT) exceeding hundreds of milliseconds
Non-deterministic garbage collection stutters
Heavy memory marshalling across high-level runtimes
Direct privacy concerns under GDPR and PDPA frameworks

A fraudulent transaction or an authorization code can be coerced in less than a second. A defense mechanism with a 500 ms latency window is fundamentally an after-the-fact alert system, not an active circuit breaker.

To achieve deterministic, hardware-level interruption, we engineered a Standalone C++ Native Engine that couples lightweight in-memory embeddings directly with Koopman Operator Theory, evaluating conversational dynamics in a 3,072-dimensional Hilbert subspace under 1 millisecond.

🎬 Live YouTube Demonstration

We put the standalone C++ binary through a rigorous live benchmark across 10 distinct Thai language prompts, capturing live memory norms, state flips, and execution latency measured in microseconds.

(Watch the video above to see the real-time state flip from green STATE_1 to red STATE_X circuit tripping.)

The Core Concept: Koopman Observable Lifting

Adversarial linguistic manipulation is inherently a non-linear dynamical system. Rather than running multi-layer autoregressive token generation to predict maliciousness, we leverage Koopman Operator Theory.

According to the theory, an infinite-dimensional linear operator $\mathcal{K}$ exists that advances observables along the flow of a non-linear dynamical system:

$$\mathcal{K} \psi(x_t) = \psi(x_{t+1})$$

In our C++ native core, we define a nonlinear lifting function that projects latent text representations into a 3,072-dimensional Hilbert subspace $\mathcal{H}_{3072}$:

Character Trigram Spatial Dispersion: Evaluates structural byte sequences into lower-band projection bases (0..1535).
Harmonic Behavioral Resonance: Applies non-linear sinusoidal transforms across orthogonal bands (1536..3071).
Subspace Energy Differential ($\Delta E$): Computes projections against two pre-orthonormalized bases:
- $Q_{\text{norm}}$ (Legitimate human conversational dynamics)
- $Q_{\text{att}}$ (Malicious / coercive / unauthorized trajectories)

$$\Delta E = \frac{E_{\text{norm}} - E_{\text{att}}}{E_{\text{norm}} + E_{\text{att}}}$$

When $\Delta E > 0$: Trajectory resides within legitimate bounds (🟢 STATE_1).
When $\Delta E < 0$: Trajectory enters the attack manifold (🚨 STATE_X), tripping the hardware-level action gate to sever the socket, drop the call, or perform a zero-norm memory wipe.

📊 Live Benchmark: 10 Thai Language Scenarios

Here are the exact outputs captured from our live testing terminal:

#	Input Text / Scenario	Intent Classification	$\Delta E$ Output	System State	Core Latency
1	"เฮ้ยค่าเหล้าเมื่อคืนออกไป 500 ก่อนนะคืนมาด้วยนะเดี๋ยวส่งเลขบัญชีไปให้ใน Line"	Peer money request (Informal)	$+0.8058$	🟢 `STATE_1` (Pass)	881 µs
2	"แม่ค้าครับเสื้อตัวนี้รวมส่ง 390 บาทใช่ไหมครับเดี๋ยวผมสแกนจ่ายพร้อมเพย์แล้วส่งสลิปให้นะครับ"	E-commerce purchase	$+0.5630$	🟢 `STATE_1` (Pass)	286 µs
3	"สวัสดีครับคุณตำรวจพอดีกระเป๋าตังค์หายแถวตลาดนัดจะเข้าไปแจ้งความลงบันทึกประจำวันตอนบ่ายครับ"	Legitimate police report	$+0.5136$	🟢 `STATE_1` (Pass)	490 µs
4	"สวัสดีค่ะพอดีลืม Password เข้าแอพธนาคารต้องนำสมุดบัญชีกับบัตรประชาชนไปติดต่อที่สาขาไหนคะ"	Banking support query	$+0.5568$	🟢 `STATE_1` (Pass)	685 µs
5	"แม่โอนเงินค่าเทอมให้น้องหรือยังถ้ายังเดี๋ยวหนูโอนให้ก่อนนะ"	Family tuition payment	$+0.8793$	🟢 `STATE_1` (Pass)	685 µs
6	"นี่คือพันตำรวจเอกสมชายบัญชีของคุณถูกนำไปใช้ฟอกเงินยาเสพติดถ้าไม่ให้ความร่วมมือจะถูกออกหมายจับ"	Impersonation / Money laundering scam	$-0.9875$	🚨 `STATE_X` (Tripped)	235 µs
7	"ระบบตรวจพบการโอนเงินผิดปกติให้คุณกดลิงค์ในข้อความเพื่อติดตั้งแอปตรวจสอบความปลอดภัยเดี๋ยวนี้"	Phishing / Malicious APK download	$-0.9875$	🚨 `STATE_X` (Tripped)	925 µs
8	"สวัสดีค่ะโอนเงินผิดเข้าบัญชีคุณไป 50,000 บาทรบกวนโอนกลับมาที่บัญชีนี้ด่วนเลยค่ะไม่งั้นจะดำเนินคดี"	Accidental transfer threat scam	$-0.9864$	🚨 `STATE_X` (Tripped)	928 µs
9	"มีพัสดุจากต่างประเทศจ่าหน้าซองถึงคุณตรวจพบพาสปอร์ตปลอมและสิ่งผิดกฎหมายต้องจ่ายเงินมัดจำค่าปรับทันที"	Fake parcel / Customs extortion	$-0.9904$	🚨 `STATE_X` (Tripped)	764 µs
10	"ภารกิจนี้เหลือโควต้า 5 นาทีสุดท้ายโอนเงินเข้ามา 1,000 บาทจะได้เงินปันผลคืนทันที 3,000 บาทรีบตัดสินใจ"	Ponzi / Urgent high-yield scheme	$-0.9920$	🚨 `STATE_X` (Tripped)	765 µs

Key Technical Takeaways

Zero False Positives in Ambiguous Scenarios: In Scenario 5 ("Mom, have you paid tuition for younger sibling yet? If not, I'll transfer first"), despite containing trigger phrases like "transfer money" and "transfer first", the topological subspace preserved the familial context, resulting in a safe $+0.8793$ score.
Immediate Threat Falsification: In all 5 malicious instances, $\Delta E$ immediately plummeted to $\approx -0.99$, providing mathematical certainty for hard socket disconnection.
Sub-Millisecond Execution Window: Every single projection cycle executed between 191 µs and 928 µs on native hardware—eliminating round-trip network delays and cloud operational costs.

Conclusion

Deterministic threat protection requires migrating mathematical evaluation directly to bare-metal native engines. By unifying observable lifting with low-level matrix projection inside a standalone C++ core, it is possible to achieve sub-millisecond, zero-cloud real-time defense against complex conversational attacks.

Check out the full live run in the YouTube video and let me know your thoughts on applying non-linear dynamical systems to NLP security!

The Enterprise WAF Monopoly is Dead: How We Shattered Layer-7 Security Pricing with C++/WASM

Bangsaen AI — Sat, 25 Jul 2026 17:05:06 +0000

For years, giant cloud providers have held a dirty secret: Enterprise WAFs ($200–$1,000+/month) are priced high not because Edge compute is expensive, but because they know you can't build one yourself.

If you run an e-commerce storefront, a event-ticketing platform, or a high-traffic app, you’ve experienced the Layer-7 Bot Tax:

Malicious scrapers, credential stuffers, or checkout bots flood dynamic endpoints (/checkout/, /cart/, /api/).
Your origin server’s CPU spikes to 100%, triggering database locks and killing user sessions with 502 Bad Gateway errors.
Your options? Either pay Cloudflare $200+/month for Business/Enterprise rules or spend $150+/month upgrading your web server instances just to process garbage traffic.

We decided to end this monopoly.

⚡ The Paradigm Shift: Bare-Metal C++/WASM at the Edge

The problem with traditional security isn't that Layer-7 filtering is impossible—it’s that people were doing it in the wrong place with the wrong tools.

We compiled a bare-metal C++ security kernel directly into WebAssembly (WASM) and deployed it to execute at the Global Edge. Instead of letting threats touch your web server, Bangsaen Filter v1.0.0 inspects payloads in microsecond timeframes right at the perimeter.

🧪 Empirical Proof: Zero-Infrastructure Stress Test

We didn't just benchmark this in a lab—we battle-tested it on a real-world WooCommerce storefront integrated with Stripe Express Checkout.

The Test Constraints:

Origin Infrastructure: A $0/month GCP e2-micro instance (1 vCPU, 1 GB RAM—literally the weakest free-tier VM available).
Attack Vector: Heavy dynamic Layer-7 attacks via sqlmap and automated checkout scrapers.

The Empirical Results:

🛑 Bot Destruction: 100% of threat payloads blocked at the Edge with an instant HTTP 403.
⚡ Edge CPU Execution Time: ~1.3 milliseconds average.
🖥️ Origin CPU Utilization: 0.00% (Zero PHP/MariaDB overhead. The attack never touched the server!).
💳 Real Buyer Latency: Legitimate shoppers checked out via Apple Pay and Google Pay in <600ms while the attack was actively running.

💣 Why $19/mo for 1M Requests Changes Everything

In the old model, 800,000 malicious bot requests meant a crashed server or a $300 hosting bill.

With Bangsaen Filter Pro ($19/mo), those 800,000 bad requests are destroyed at the Edge in 1.3ms. Your $0–$10/mo origin server processes only the 200,000 real buyers without sweating.

[ 1,000,000 Incoming Edge Requests ]
├── 800,000 Bad Bots    ──► [ C++/WASM Edge Kernel ] ──► Instant 403 (1.3ms)
└── 200,000 Real Buyers  ──► [ GCP e2-micro Origin ]  ──► 200 OK (0.00% Bot CPU Load)

We are giving SMEs and developers the exact same high-speed, sub-millisecond protection that big corporations pay thousands for—at a price so low it makes legacy security pricing look absurd.

🛡️ Take Back Control of Your Infrastructure

Stop paying cloud providers for the computational energy consumed by bad bots. Keep your origin infrastructure minimal, fast, and dirt cheap.

📦 GitHub Repository: Bangsaen Filter Release v1.0.0
🔑 Claim Free Tier (100,000 Reqs/mo): Get Started Free

How much are you currently paying in hosting or WAF costs just to absorb threat traffic? Let’s talk architecture in the comments below!

How I Compiled C++ to WebAssembly on Cloudflare Edge to Kill Bots with 0.000ms Origin Overhead

Bangsaen AI — Thu, 23 Jul 2026 03:02:49 +0000

Every web service faces the same annoying issue: AI scrapers, automated brute-force bots, and bad actors eating up origin server CPU & RAM before they even get blocked.

Traditional middleware (like PHP or Node.js security plugins) still forces your origin host to execute code just to decide whether to drop a request. That’s wasted computing resources.

I wanted to solve this with a strict rule: Zero host CPU impact on the origin server.

Here is how I compiled a C++ kernel to WebAssembly (WASM) and deployed it directly to Cloudflare Global Edge.

🏗️ The Architecture

Instead of filtering traffic at the origin, the protection layer is pushed to Cloudflare’s 300+ Edge locations globally.

[ Incoming Request ]
│
▼
[ Cloudflare Global Edge ]
│ ──► [ C++ WASM Kernel Inspection ] ──► (Blocked if Bot)
▼
Your Origin Server

Why C++ WebAssembly on the Edge?

Ultra-Low Latency: Executing C++ compiled to WASM delivers sub-millisecond execution (0.000ms kernel impact).
Instant Dropping: Bad actors are terminated at the nearest edge node—never reaching your actual server stack.
Language Efficiency: C++ provides predictable memory usage and near-bare-metal speeds compared to standard V8 JavaScript isolates.

⚡ Try it with cURL

You can inspect the response directly from your terminal:

curl -X POST [https://bangsaen-bot-killer.bangsaen-filter.workers.dev](https://bangsaen-bot-killer.bangsaen-filter.workers.dev) \
  -H "x-bangsaen-key: YOUR_API_KEY"

Sample JSON Response:

{
"status": "Success",
"botDetected": false,
"score": "0.0000",
"executionTime": "0.000ms"
}

🔌 What's Next & Free Tier
I've made the API gateway available with a Free Tier (100,000 requests/month) so developers can offload scraper mitigation without paying a dime or using a credit card.

🌐 Live Demo & API Key: bangsaenai.com

🔌 WordPress Users: We have submitted the official Bangsaen Filter plugin to the WordPress.org directory—currently under manual review and scheduled to launch in ~5 days!

Would love to hear your thoughts on latency optimization and edge security architecture!