jx-sec/jxwaf

What it solves

JXWAF is a Web Application Firewall (WAF) designed to protect web applications from malicious traffic. It solves the problem of detecting and blocking complex web attacks—such as SQL injection, XSS, and 0-day vulnerabilities—while minimizing false positives and maintaining high performance without requiring manual rule writing.

How it works

The system uses a triple-engine approach to analyze and filter traffic before it reaches the business server:

1. AI Security Model: Utilizes a custom multi-dimensional sparse attention mechanism and online distillation. This allows the system to inherit the detection capabilities of large AI models into a local inference engine, enabling the automatic detection of 0-day attacks and automatic handling of false positives.
2. Semantic Analysis Engine: Employs dynamic context semantic analysis to identify attacks based on meaning rather than simple regular expression matching, which increases accuracy for common vulnerabilities like command execution and deserialization.
3. SSL Behavior Analysis Engine: Uses a specialized SSL fingerprinting algorithm and protocol anomaly analysis to identify non-browser traffic, effectively blocking CC attacks and scrapers.

Who it’s for

• Individuals and Small Businesses: Via the Standard Edition for simple, single-server deployment.
• Medium to Large Enterprises: Via the Professional Edition, which supports separated consoles, nodes, and log systems for horizontal scaling.
• Corporate Organizations: Via the Cloud WAF version, which provides multi-tenant management, CNAME automatic integration, and CDN capabilities for managing multiple departments or business lines.

Highlights

• AI-Driven 0-day Detection: Automatically learns to block new attacks via online distillation from large models without manual rule updates.
• High Performance: Capable of handling hundreds of millions of requests per day on modest hardware (e.g., 4C8G server).
• Low False Positives: Achieves high accuracy (up to 99.22% with private models) compared to traditional WAFs.
• Flexible Deployment: Offers options ranging from a single docker compose command for small sites to a distributed cluster for enterprise-grade traffic.