nbs-system/naxsiArchived
Naxsi
Naxsi is a web application firewall for NGINX servers designed to protect web applications from attacks by inspecting HTTP traffic for malicious patterns and vulnerability signatures. It functions as a vulnerability signature filter that matches incoming requests against known markers for threats such as SQL injection and cross-site scripting.
The system includes a learning system and an automated rule generation utility to reduce false positives. It analyzes website behavior over time to create traffic whitelists and security exceptions for legitimate traffic patterns.
The project provides a security event analyzer that imports security logs into a database to perform trend analysis. This allows for the identification of offending hosts and the calculation of event ratios through database-driven summaries.
Features
- Web Security - Blocks common security threats such as cross-site scripting and SQL injection to secure web applications from exploitation.
- NGINX Extensions - Runs as a native extension within the NGINX web server to inspect HTTP requests during the processing pipeline.
- Behavioral Learning Systems - Analyzes legitimate website behavior over time to automatically create whitelist exceptions for valid traffic patterns.
- HTTP Request Filtering - Evaluates each HTTP request independently against security policies without maintaining session state between packets.
- Traffic Security Policies - Creates exception rules to permit specific traffic patterns that would otherwise be blocked by security policies.
- Signature-Based Filtering - Implements a request inspection engine that matches incoming traffic against known malicious patterns like SQL injection and XSS.
- Web Application Firewalls - Protects NGINX servers from web attacks by inspecting HTTP traffic for malicious patterns and vulnerability signatures.
- WAF Behavioral Learners - Analyzes website behavior to automatically generate whitelisting rules and reduce false positives.
- Whitelist Management - Creates and refines security whitelists to reduce false positives and permit legitimate traffic during a learning phase.
- Traffic Signature Matching - Inspects incoming traffic against a predefined set of malicious markers to identify and block common web attacks.
- Automated Whitelist Generation - Analyzes website behavior during a learning phase to automatically create whitelisting rules for legitimate traffic.
- Whitelist Heuristics - Generates security exceptions based on statistical database summaries to reduce false positive detections for specific URIs.
- Security Log Analytics - Provides a database-driven system for analyzing security logs to calculate event ratios and identify frequent offending hosts.
- Statistical Whitelist Generation - Creates rule exceptions based on database statistics to reduce false positives for specific URIs or servers.
- Event Log Importing - Provides a tool for ingesting security event logs from files or standard input into a database for detailed analysis.
- Security Event Monitoring - Ingests and analyzes web security logs to identify offending hosts and track attack trends over time.
- Trend Analysis - Provides a utility for producing summaries of database content to identify event ratios and frequent offending hosts.
- Web Application Firewalls - High-performance WAF for NGINX.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
