AI Augmented Intrusion Detection System

A hybrid architecture employing sequential rule-based and machine learning pipelines to detect, analyze, and classify malicious HTTP traffic in real time.

What is AA-IDS?

Understanding the core mission of our AI-Augmented System.

Real-time Analysis

Processes incoming HTTP logs instantly, classifying traffic flows with an optimal balance of speed and detection accuracy.

Hybrid Security

Combines deterministic OWASP Core Rule Sets with advanced Machine Learning to catch both known and zero-day threats.

Forensic Categorization

Not only detects attacks but categorizes them into specific vectors (SQLi, XSS, Path Traversal) for detailed incident response.

What it does

A sequential three-layer detection pipeline.

1

OWASP CRS Rule Engine

Acts as the first gate. Detects known attack signatures immediately. If an attack is found, traffic is blocked and logged.

Ambiguous / Cleared
2

Random Forest Binary Classifier

Evaluates complex traffic patterns. Fast binary classification (Normal vs Attack). Normal traffic is allowed through.

Attack Confirmed
3

XGBoost Multi-Class Classifier

The forensic engine. Deeply analyzes malicious payloads to accurately categorize the specific attack vector (e.g. SQLi, XSS).

How to use it

Integrate our fast, JSON-based REST API.

Analyze Traffic Endpoint

Pass your HTTP logs to the analysis engine for instant verdicts. Requires your assigned API key via the X-IDS-Key header.

POST /api/v1/analyse
cURL Request Example
curl -X POST http://localhost:5000/api/v1/analyse \
  -H "X-IDS-Key: dev-api-key-12345" \
  -H "Content-Type: application/json" \
  -d '{
    "logs": [{
        "method": "POST",
        "url": "/api/login",
        "query_string": "user=admin' OR '1'='1",
        "headers": {},
        "body": "password=admin",
        "response_code": 200
    }]
}'