Web Payload Inspector & SIEM Feed

Full-stack Web Application Firewall (WAF) simulation and SIEM log dashboard. Detects SQL injection and XSS payloads via a hybrid ML + heuristic pipeline. Built to demonstrate end-to-end security engineering: detection algorithm, structured audit logging, and real-time SOC-style visualization.

---

Architecture

frontend/          React + Vite + Tailwind CSS
  ├─ Sandbox       Interactive payload inspector (single request / response)
  └─ SIEM Feed     Live log dashboard polling the backend audit stream

backend/           FastAPI + Scikit-Learn
  ├─ Detection     TF-IDF vectorizer + Logistic Regression classifier
  ├─ Heuristics    Regex-based signature checks (override / promote ML score)
  ├─ Normalization URL-decode + HTML-unescape before classification
  └─ Audit Logger  Append-only JSONL log, structured for Splunk / ELK / Wazuh

Two-module frontend design separates interactive testing from passive monitoring, mirroring real SOC tooling conventions.

---

Detection Pipeline

raw payload
    │
    ▼
normalize()         # URL-decode, HTML-unescape
    │
    ▼
TF-IDF vectorize    # trained on CSIC2010 + custom payload corpus
    │
    ▼
LogisticRegression  # binary + multi-class (safe / xss / sqli)
    │
    ▼
heuristic_check()   # regex signatures — can promote or override ML verdict
    │
    ▼
AuditLogger         # JSONL line: timestamp, action, severity, confidence, basis

Heuristic-assisted promotion is applied when the ML confidence is below threshold but a deterministic signature matches. This reduces false negatives on known attack patterns without retraining. Both the ML verdict and the promotion reason are surfaced in the API response for full auditability.

---

Stack

Layer	Technology	Version
Backend API	FastAPI + Uvicorn	0.115.x
ML	Scikit-Learn (TF-IDF + LR)	1.x
Data wrangling	Pandas	2.x
Frontend	React + Vite	18 / 5
Styling	Tailwind CSS	3.x
Charts	Recharts	3.x
Linting	Ruff (Python), ESLint v9 (JS)	latest
CI	GitHub Actions (lint + build + secrets-scan)	—

---

Prerequisites

Requirement	Minimum version
Python	3.11
Node.js	20
npm	9
Git	2.x

---

Local Setup

Backend

cd backend
python -m venv .venv

# Windows
.venv\Scripts\activate
# Linux / macOS
source .venv/bin/activate

pip install -r requirements.txt
copy .env.example .env        # Windows
# cp .env.example .env        # Linux / macOS

# Optional: retrain the model (pre-built artifact is included)
python train_model.py --no-synthetic-fallback

# Start API server
python run_local_api.py
# equivalent: uvicorn app.main:app --host 127.0.0.1 --port 8010

API docs: http://127.0.0.1:8010/docs

Frontend

cd frontend
npm install
copy .env.example .env        # Windows
# cp .env.example .env        # Linux / macOS
npm run dev

Dashboard: http://127.0.0.1:5180

---

API Contract

POST /analyze

Request:

{ "payload": "username=admin' OR '1'='1' --" }

Response:

{
  "is_attack":      true,
  "type":           "SQLi",
  "verdict":        "Attack Detected",
  "confidence":     0.9441,
  "confidence_band":"High",
  "risk_level":     "High",
  "decision_basis": "Heuristic-assisted promotion",
  "summary":        "The final backend decision was promoted to SQLi because a matching attack signature was found."
}

GET /health

{ "status": "ok" }

---

CI Pipeline

Three jobs defined in .github/workflows/ci.yml:

Job	Tool	Scope
lint	Ruff / ESLint	backend/app/, frontend/src/
build	Vite	Production bundle validation
secrets	Gitleaks	Full commit history scan

Local pre-push validation: powershell ./scripts/validate_local.ps1

---

Dataset

Training data is sourced from two corpora:

• CSIC 2010 — HTTP dataset for web attack detection (place raw files under backend/data/raw/csic2010/ per the directory README)
• Custom payload corpus — backend/data/raw/payloads/payload_full.csv

A pre-trained model artifact is included (backend/models/). To reproduce:

python backend/train_model.py --no-synthetic-fallback

---

Security Notes

• API is restricted to 127.0.0.1 (localhost only) via TrustedHostMiddleware.
• CORS is locked to configured origins in .env.
• Rate limiting: 30 requests / 60 seconds (configurable).
• Maximum request body: 4 096 bytes.
• Payloads are vectorized mathematically; none are executed.

---

Disclaimer

Built for educational and portfolio purposes. Operates as a passive detection pipeline only.