UUSEC WAF

UUSEC WAF is an open-source web application firewall and API security gateway. It provides a three-layer defense system covering the traffic, system, and runtime layers to protect websites and APIs from various vulnerabilities. The software operates as a reverse proxy and is deployed on Linux x86_64 servers using Docker and Docker Compose to ensure a consistent environment for its security components.

Users manage the firewall through a web-based backend where they can add sites, upload SSL certificates, and configure security rules. The system supports the automatic application of rules without requiring a server restart, which allows for immediate updates to the security posture. It includes integrated support for Let's Encrypt to handle SSL certificate issuance and automatic renewal, simplifying the process of securing HTTPS traffic for multiple domains.

Key features

• Machine learning based anomaly detection for 0-day vulnerability defense
• Semantic analysis engines for SQL, XSS, RCE, and LFI detection
• Host Intrusion Prevention System (HIPS) to restrict process communication and file access
• Runtime Application Self-Protection (RASP) for Java JVM and PHP Zend
• Lua script support for creating custom security rules and plugins
• Regular expression matching for URL path cache cleaning
• Deep decoding engines for base64, JSON, and form data
• Integrated Let's Encrypt SSL certificate management

The architecture leverages nginx and luajit for high performance and flexibility. By combining semantic analysis with machine learning, the software identifies attack traffic by learning normal parameter characteristics rather than relying solely on static rule libraries. This approach is intended for security administrators who need to protect web applications from common exploits like SQL injection and cross-site scripting while maintaining low false positive rates. The inclusion of RASP allows the software to track runtime context within the application engine, providing a deeper level of inspection than traditional perimeter firewalls.

UUSEC WAF is positioned as a comprehensive security gateway for protecting web applications and APIs through a combination of traditional rule-based filtering, behavioral analysis, and system-level active defense.