Agentic DDoS OPS/AI-Powered Operations Layer for GenieATM#

Siarhei Matashuk, Genie Networks

• Why: Not optics, not BGP — it's an early, concrete look at how LLM agents get wired into live NOC operations, and the design patterns (git-versioned markdown skills, a hard privacy boundary, an earned-autonomy trust model) generalize far beyond DDoS tooling, including into the identity and authorization questions agentic systems raise for the PM's own portfolio.
• What: An agent layer ("DjiNN") on top of GenieATM implementing nine virtual NOC/SOC roles as "skills" — Baseline Analyst (continuous detection-threshold tuning with auto-rollback, replacing set-and-forget thresholds), Traffic Analyst (natural-language queries over a 1M-flow in-memory snapshot, e.g., breakdown of a new uplink by origin ASN/protocol with no query syntax), Peering Coordinator (cross-referencing per-AS traffic against PeeringDB to surface peering ROI, e.g., "40% of traffic to AS 13335 rides transit but they're at AMS-IX where you already peer, est. €2,400/month savings"), plus Incident Responder, Platform SRE, and others clearly staged as MVP vs Phase ⅔. Notably honest limitations: LLM latency handled by rule-based fallback for time-critical detection (the LLM does enrichment, not first-trigger); trust via a maturity model from L0 alert-only to L3 autonomous-with-audit-trail, with all destructive actions human-approved; data privacy via an MCP anonymization layer (IP→prefix_UUID, Router→router_XXX) so only tokenized data crosses to the LLM provider, with a local-model option for zero exposure.
• How: Skills are plain ~30-line .md job descriptions in git — a NOC engineer can read and modify one in five minutes, no SDK; an orchestrator routes tasks → skills → tools → data sources; southbound to GenieATM's Snapshot API/NetFlow plus PeeringDB, RIPE RIS, RouteViews, and threat intel.
• Where applicable: The data source is GenieATM-specific and the closing slide recruits for an early-access program (vendor session — discount accordingly), but the skill-file architecture, trust maturity model, and anonymization boundary are platform-agnostic patterns worth borrowing.