openappsec/openappsec

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

What it solves

open-appsec provides preemptive protection for web applications and APIs against zero-day attacks and the OWASP Top 10. It automates the detection of malicious requests by learning normal user interaction patterns, reducing the need for manual rule configuration.

How it works

The system operates as an add-on to existing infrastructure (like NGINX, Kong, APISIX, or Envoy) and processes every HTTP request through a two-phase machine learning pipeline:

  1. Supervised Phase: A pre-trained model analyzes request variables (attack indicators, IP addresses, fingerprints) to compare them against millions of known global attack patterns.
  2. Unsupervised Phase: If a request is deemed suspicious, a second model—trained in real-time on the specific environment's traffic—evaluates the request's URL and user behavior to generate a confidence score for blocking or allowing it.

Who it’s for

Developers and security engineers managing web applications or APIs on Linux, Docker, or Kubernetes who need automated, ML-driven threat protection.

Highlights

  • Multi-platform support: Deploys across NGINX, Kong, APISIX, and Envoy.
  • Hybrid ML approach: Combines a global supervised model with a local, environment-specific unsupervised model.
  • Flexible management: Can be configured via declarative files, Kubernetes Helm charts, or a SaaS Web UI.
  • Broad deployment options: Supports standalone Linux installations, Docker containers, and Kubernetes clusters.

Related

  • Project
    Safe3/uusec-waf

    A high-performance Web Application Firewall that uses machine learning and semantic engines to provide three-layer defense against web attacks and 0-day vulnerabilities.

  • Project
    jx-sec/jxwaf

    An AI-powered Web Application Firewall that uses large model distillation and semantic analysis to detect 0-day attacks and malicious traffic with high accuracy and low latency.

  • Project
    brexhq/CrabTrap

    An HTTP/HTTPS proxy that provides security guardrails for AI agents by evaluating outbound API requests against static rules and LLM-based policies.

  • Project
    stratosphereips/StratosphereLinuxIPS

    A behavioral machine learning-based intrusion prevention system that detects malicious network traffic and command-and-control channels using ML models and threat intelligence.

  • Project
    starbaser/ccproxy

    A transparent network interceptor for LLM tooling that allows for the inspection, transformation, and cross-provider routing of AI API traffic.