Dendroaspis
The product emerging from my thesis: an efficient on-device Mamba agent that learns normal endpoint behavior, filters anomalies at the edge, and escalates compact evidence for central semantic reasoning.
One-sentence proposition
Do high-rate behavioral sequence modeling where telemetry is born, then send only what deserves context to a central engine that correlates, reasons, and coordinates response.
From thesis to product
Dendroaspis is the product direction emerging from my master's thesis on efficient behavioral anomaly detection. The thesis is testing whether selective state-space models can learn normal endpoint behavior well enough to detect anomalous sequences within the compute and memory limits of general-purpose edge hardware. The final product is an efficient on-device Mamba agent built around the answer to that research question—not a claim that the research is already finished.
The edge as a reflex arc
A monitored endpoint sees its own behavior first and at the highest fidelity. Dendroaspis gives that endpoint a lightweight causal sequence model that consumes behavioral telemetry continuously, keeps bounded internal state, and scores how surprising new behavior is in context. The edge agent is deliberately a high-recall novelty filter, not a malice oracle: unusual is evidence, not a verdict.
Let the edge do the heavy lifting
The product thesis is to process the high-rate stream where it is created. Decode, represent, sequence-model, and score locally; escalate compact anomaly evidence instead of shipping every raw event to an expensive central reasoning layer. That makes compute cost, memory, latency, throughput, privacy, and bandwidth part of the detector's design rather than after-the-fact infrastructure concerns.
The center as an association cortex
What leaves the edge is meant to enter a central semantic organizational engine. That layer can correlate anomaly packages across entities, connect them to identity and asset context, reason over history and relationships, decide what deserves investigation, and coordinate the next action. This is the other half of the original architecture: filter at the edge, reason at the center. The current thesis deliberately evaluates the edge tier; the central reasoning hub remains a future product layer.
Research discipline becomes the product contract
Dendroaspis is being designed around an effectiveness-versus-efficiency frontier, not a benchmark headline. Detection quality has to be evaluated beside p99 latency, throughput, memory use, transfer behavior, false-alarm burden, and named baselines. The goal is to know what the edge model can responsibly decide, what evidence it should package, and what must remain a central reasoning problem.
Current status
The edge system is in active thesis development, with the current work focused on trustworthy telemetry, dataset construction, controlled evaluation, and a causal Mamba inference path. The venture is the bridge from that defensible research result to a deployable endpoint agent and, later, the central semantic engine that can reason over a fleet without requiring the fleet to centralize everything it sees.