Aegis-docs

Adversarial Defense

Anti-spoofing and fraud safeguards for automated payouts—designed so honest workers are not penalized.

Threat Model

Aegis assumes an attacker can coordinate many accounts to exploit automated payouts by faking GPS and triggering events in the same H3 cell.

Detection Signals (Multi-Layer)

  • GPS drift + cross-check vs expected H3/tower coherence
  • shared device/identity fingerprints at scale (ring structure)
  • H3 zone presence must be earned (verified history, not only current claim)
  • physics checks (impossible travel / velocity constraints)
  • hybrid ML score on top of hard filters
Fraud detection service — scoring pipeline

Attack mitigation is handled by a layered approach (H3 presence, device/identity patterns, physics checks, then hybrid ML).

Hybrid Fraud Scoring

Fraud probability is combined into a single operational score:

Score = 0.5 * anomaly + 0.3 * supervised_prob + 0.2 * rule_severity

Response Protocol

ConfidenceEvidenceAction
confirmed cleanhistory + device integrity + physicsauto-approve
suspicious individualpartial signals, no ring linkhold/manual review
ring connectedgraph links to flagged clusterfreeze + investigate
confirmed fraudclone + velocity + ringblock/suspend/quarantine

The decision outcomes are mapped to operational actions: auto-approve, manual review, hold, or block/suspend/quarantine.

Coverage Matrix (Attack -> Detection -> Response)

Attack VectorDetectionResponse
Single GPS spoofGPS drift + H3 consistencyflag + review
Coordinated ringdevice + registration clusteringbatch hold + quarantine
First-time zone claimzone presence history requirementblock until history exists
Impossible velocityinter-ping velocity analysishard block
Emulator-based fakeaccelerometer/battery/network coherencedevice integrity failure -> reject
Payout launderingUPI/bank beneficiary graph (2-hop)destination quarantine

On this page