Web_Application_Firewall

WAF

Comment

🛡️ ML-Based Web Application Firewall

A lightweight Web Application Firewall (WAF) built with Python, Flask, Machine Learning, and rule-based security detection. The application analyzes URLs for potentially malicious activity such as Cross-Site Scripting (XSS) and SQL Injection (SQLi) attacks.

The project uses a hybrid detection approach that combines predefined attack signatures with a Logistic Regression machine learning model trained on URL-based features.

📌 Project Overview

Web applications are frequently targeted by attacks such as XSS and SQL Injection. Traditional rule-based security mechanisms can identify known attack patterns but may struggle with variations of malicious inputs.

This project implements a hybrid WAF that combines:

  • 🔍 Rule-based XSS detection
  • 💉 Rule-based SQL Injection detection
  • 🤖 Machine Learning-based detection
  • 🌐 Flask web interface
  • 🔌 REST API for URL analysis
  • 📊 Dataset-driven model training
  • ✅ URL validation
  • 🏥 Health-check API

The system evaluates a submitted URL and determines whether it should be allowed or blocked.

✨ Features

🔐 XSS Detection

The application checks URLs for common XSS indicators, including:

  • <script> tags
  • javascript: URLs
  • Event handlers such as onerror and onload
  • document.cookie
  • <img> payloads
  • <iframe> payloads
  • <svg> payloads
  • eval() expressions

💉 SQL Injection Detection

The WAF contains rule-based signatures for common SQL Injection patterns, including:

  • UNION SELECT
  • OR 1=1
  • AND 1=1
  • SQL comments
  • Stacked queries
  • DROP, DELETE, UPDATE, and other SQL commands
  • xp_cmdshell
  • SLEEP()
  • BENCHMARK()
  • information_schema
  • Common authentication-bypass patterns

🤖 Machine Learning Detection

A Logistic Regression classifier is trained using the provided dataset.csv.

The system extracts numerical features from URLs, such as:

  • URL length
  • Number of < and > characters
  • Occurrences of script
  • Occurrences of javascript
  • onerror
  • onload
  • eval
  • alert
  • iframe
  • img
  • %
  • =

The model is trained when the Flask application starts.

🌐 Web Interface

The project provides a simple browser-based interface where users can:

  1. Enter a URL.
  2. Submit the URL for analysis.
  3. Receive an immediate security decision.
  4. View the reason for blocking when an attack is detected.

🔌 REST API

The application exposes an API endpoint for programmatic URL analysis.

Endpoint:

POST /api/check

Example request:

{
  "url": "https://example.com/page?id=1"
}

The API returns information about:

  • URL validity
  • Whether the URL is blocked
  • XSS rule detection
  • SQL Injection detection
  • ML detection
  • Overall security decision

🏥 Health Check

A health endpoint is also provided:

GET /api/health

Example response:

{
  "status": "ok",
  "model_loaded": true
}

🏗️ System Architecture

                   ┌──────────────────────┐
                   │      User / Client   │
                   └──────────┬───────────┘
                              │
                              ▼
                   ┌──────────────────────┐
                   │    Flask Web App     │
                   └──────────┬───────────┘
                              │
                              ▼
                   ┌──────────────────────┐
                   │     URL Validation   │
                   └──────────┬───────────┘
                              │
                ┌─────────────┴─────────────┐
                │                           │
                ▼                           ▼
       ┌─────────────────┐        ┌─────────────────┐
       │ Rule-Based WAF  │        │ ML Detection    │
       │                 │        │                 │
       │ XSS Signatures  │        │ Feature         │
       │ SQLi Signatures │        │ Extraction      │
       └────────┬────────┘        │       │         │
                │                 │ Logistic        │
                │                 │ Regression      │
                │                 └───────┬─────────┘
                │                         │
                └────────────┬────────────┘
                             ▼
                  ┌──────────────────────┐
                  │   Decision Engine    │
                  └──────────┬───────────┘
                             │
                  ┌──────────┴──────────┐
                  │                     │
                  ▼                     ▼
             🚫 BLOCKED              ✅ ALLOWED

📂 Project Structure

Web_Application_Firewall-master/
│
├── app.py
├── MajorProject_WAF_GUI.py
├── dataset.csv
├── requirements.txt
│
├── static/
│   ├── style.css
│   └── script.js
│
└── templates/
    └── index.html

File Description

File Description
app.py Main Flask application, ML model, detection engine and REST API
MajorProject_WAF_GUI.py Desktop GUI implementation using Tkinter
dataset.csv Dataset used to train the Logistic Regression model
requirements.txt Python dependencies
templates/index.html Web application's HTML interface
static/style.css Frontend styling
static/script.js Frontend API communication and result handling

⚙️ Technologies Used

Technology Purpose
Python Core programming language
Flask Web framework and REST API
NumPy Numerical feature processing
Pandas Dataset loading and processing
Scikit-learn Machine Learning model
Logistic Regression URL classification
HTML5 Web interface
CSS3 UI styling
JavaScript Frontend interaction
Tkinter Optional desktop GUI

🚀 Installation

1. Clone the repository

git clone https://github.com/YOUR-USERNAME/Web-Application-Firewall.git
cd Web-Application-Firewall

2. Create a virtual environment

Windows

python -m venv venv
venv\Scripts\activate

Linux/macOS

python3 -m venv venv
source venv/bin/activate

3. Install dependencies

pip install -r requirements.txt

▶️ Running the Application

Start the Flask application:

python app.py

The server runs on:

http://localhost:5000

Open the address in a web browser to access the WAF interface.

🔎 How It Works

When a user submits a URL, the following process occurs:

Step 1 — URL Validation

The application verifies that the submitted URL contains a valid http or https scheme and a network location.

Step 2 — URL Decoding

Encoded URL characters are decoded before security analysis so that encoded attack patterns can also be inspected.

Step 3 — XSS Rule Detection

The URL is compared against predefined XSS regular-expression signatures.

Step 4 — SQL Injection Detection

The URL is analyzed against SQL Injection signatures.

Step 5 — Feature Extraction

The URL is converted into numerical features for the machine learning model.

Step 6 — ML Classification

The Logistic Regression model predicts whether the URL resembles a malicious payload.

Step 7 — Final Decision

The WAF blocks the URL if any detection engine identifies malicious activity.

Otherwise, the URL is marked as allowed.

🧠 Hybrid Detection Strategy

The project uses the following decision logic:

Blocked =
    XSS Rule Detection
    OR SQL Injection Detection
    OR ML Detection

In simplified form:

blocked = xss_rule_flag or sqli_flag or ml_flag

This hybrid architecture combines the predictability of signature-based detection with the flexibility of machine learning.

📊 Machine Learning Pipeline

The ML pipeline follows these steps:

dataset.csv
     │
     ▼
Load Dataset
     │
     ▼
Feature Extraction
     │
     ▼
Train/Test Split
     │
     ▼
Logistic Regression
     │
     ▼
Model Training
     │
     ▼
Model Prediction
     │
     ▼
Malicious / Benign

The dataset is divided into training and testing subsets using an 80/20 split.

The model's test accuracy is printed in the terminal when the application starts.

🧪 Example Inputs

Safe URL

https://example.com/products?id=10

Expected result:

Allowed — URL is clean

XSS-like URL

https://example.com/?q=<script>alert(1)</script>

Expected result:

Blocked — intrusion detected

SQL Injection-like URL

https://example.com/login?id=1 OR 1=1

Expected result:

Blocked — intrusion detected

These examples are intended for testing the WAF in a controlled environment.

🔌 API Usage

Check a URL

Request

POST /api/check
Content-Type: application/json

{
  "url": "https://example.com/page?id=1"
}

Possible response

{
  "ok": true,
  "url": "https://example.com/page?id=1",
  "blocked": false,
  "xss_rule_flag": false,
  "sqli_flag": false,
  "ml_flag": false,
  "message": "URL is clean and allowed"
}

For a detected attack, the response can identify which detection mechanisms flagged the URL.

🖥️ Desktop GUI

The repository also contains:

MajorProject_WAF_GUI.py

This provides an alternative Tkinter-based desktop interface.

Run it with:

python MajorProject_WAF_GUI.py

The desktop version provides URL validation, XSS rule-based detection, ML-based detection, and a final WAF decision.

📦 Dependencies

The project uses the following Python libraries:

Flask
NumPy
Pandas
Scikit-learn

They can be installed using:

pip install -r requirements.txt

🔐 Security Scope

This project is designed as an educational and research-oriented WAF prototype.

It demonstrates how rule-based signatures and machine learning can be combined for malicious URL detection.

It should not be considered a production-grade replacement for enterprise WAF solutions without additional security hardening, testing, monitoring, and deployment controls.

⚠️ Limitations

Current limitations include:

  • The ML model is trained at application startup.
  • The ML classifier is based on relatively simple URL features.
  • The provided dataset primarily supports XSS-oriented ML classification.
  • SQL Injection detection is rule-based rather than ML-based.
  • Regular-expression signatures cannot identify every possible attack variation.
  • The system analyzes submitted URLs rather than acting as a full reverse-proxy WAF.
  • Production deployment would require additional security, logging, rate limiting, monitoring, and model-management mechanisms.

🔮 Future Enhancements

Potential improvements include:

  • [ ] Add larger and more diverse security datasets.
  • [ ] Add ML-based SQL Injection classification.
  • [ ] Implement additional attack categories.
  • [ ] Add command injection detection.
  • [ ] Add path traversal detection.
  • [ ] Add automated attack logging.
  • [ ] Add IP-based monitoring and rate limiting.
  • [ ] Add real-time security dashboards.
  • [ ] Compare multiple ML algorithms.
  • [ ] Add model persistence instead of training at every startup.
  • [ ] Add automated unit and security tests.
  • [ ] Deploy behind a production-grade reverse proxy.
  • [ ] Add authentication and role-based administration.
  • [ ] Improve false-positive and false-negative analysis.

🎯 Project Objectives

The primary objectives of this project are to:

  1. Develop a lightweight Web Application Firewall.
  2. Detect common XSS attacks.
  3. Detect common SQL Injection patterns.
  4. Explore machine learning for malicious URL classification.
  5. Combine signature-based and ML-based security mechanisms.
  6. Provide a user-friendly web interface.
  7. Expose the detection engine through a REST API.
  8. Demonstrate the practical application of cybersecurity and machine learning concepts.

📚 Learning Outcomes

This project demonstrates practical experience with:

  • Web application security
  • Web Application Firewall concepts
  • XSS detection
  • SQL Injection detection
  • Regular expressions
  • URL parsing and decoding
  • Feature engineering
  • Logistic Regression
  • Train/test data splitting
  • Model evaluation
  • Flask application development
  • REST API development
  • HTML/CSS/JavaScript integration
  • Python GUI development

👩‍💻 Author

Aditi Bardhan

This project was developed as an academic/technical project demonstrating the integration of Cybersecurity, Web Development, and Machine Learning.

📄 License

This project is intended primarily for educational and research purposes.

If you plan to use the project commercially or as part of a production security infrastructure, additional security review, testing, hardening, and licensing considerations should be performed.

⭐ If You Found This Project Useful

If this project helped you understand Web Application Firewalls, cybersecurity, or machine-learning-based threat detection, consider giving the repository a ⭐ on GitHub.

Built With

Share this project:

Updates