How we built a sub-50ms AI Decision Engine in Rust

When we first prototyped AEGIS, we used a standard Node.js architecture. It was fast enough for a few hundred servers, but as we scaled to thousands of communities—some with over a million members—we hit a wall. Node's single-threaded event loop couldn't keep up with the sheer volume of message creates, deletes, and role updates happening during a coordinated raid.

The Problem with Traditional Bots

Most Discord security bots operate on simple thresholds: "If a user deletes 5 channels in 10 seconds, ban them." This logic requires keeping state (counters) in memory or Redis. When an attack happens, the latency to fetch, increment, and check these counters often takes over 200ms. By the time the bot sends the ban API call, the attacker has already deleted 30 more channels.

Enter Rust

We needed predictable performance and zero-cost abstractions. We rewrote the core Decision Engine in Rust.

1. **Memory Safety without Garbage Collection:** During massive traffic spikes, GC pauses in Node.js or Go can cause fatal delays. Rust eliminates this entirely. 2. **Concurrency:** We leverage Tokio to handle tens of thousands of concurrent WebSocket streams perfectly. 3. **Sub-50ms Reaction Time:** From the moment Discord dispatches an `EVENT_CREATE`, our payload is deserialized, analyzed against the server's AI baseline, and a mitigation action is fired back in under 45ms.

Here is a simplified snippet of how our incoming event handler in Rust looks:

// 2. Query AI Baseline (Cached in Redis/Memory) let baseline = ai::get_server_baseline(payload.guild_id).await?;

// 3. Score the anomaly let score = ai::score_anomaly(&baseline, payload); if score > THRESHOLD { mitigation::execute_ban(ctx, payload.author_id).await?; log::warn!("Mitigation executed in {:?}", start.elapsed()); }

Ok(()) } ```

This architectural shift wasn't just an optimization; it fundamentally changed what AEGIS could do. It allowed us to move from *reactionary* security (cleaning up after an attack) to *preventative* security (stopping the attack before the 6th channel is even targeted).