Download the PHP package rafalmasiarek/threat-detector without Composer

rafalmasiarek/threat-detector

Heuristic, modular threat detection (signal-only) with weighted float scoring, predefined thresholds, and PSR-15 middleware for PSR-7 applications.

⚠️ This library is a signal generator. It does not replace proper validation/sanitization/escaping, CSP, prepared statements, etc.

Features

• 🧩 Modular scanners — each category (XSS, SQLi, SSRF, …) in a separate class.
• ⚖️ Weighted float scoring — per-category weights; combine multiple signals.
• 🎚️ Predefined thresholds — LOW, MEDIUM, HIGH (or custom floats).
• 🧵 PSR-15 middleware — scan query, body, headers, cookies; annotate request; optional header X-Threat-Suspect.
• 📝 phpDocs & comments — production-friendly code with clear docs.
• ✅ Unit tests — a couple of quick checks to get you started.
• 📂 Examples — basic HTML form + PSR-15 middleware demo.

Requirements

• PHP 8.1+
• ext-mbstring

Installation

Using Composer:

If you are using this repository locally (path repo):

Quick Start (Core)

Example output:

Quick Start (PSR-15 Middleware)

Example result:

Scoring

• Weights: per category (e.g., SQLI=2.0, CMD_INJECTION=2.5, CRLF=1.0).

• Score formula:

• Threshold: request is suspect when score ≥ threshold.

Predefined thresholds

Examples

• <script>alert(1)</script>
  Hits: XSS=[TAG_SCRIPT, HTML_TAGS]
  Score: 1.5 × 2 = 3.0 → suspect at MEDIUM

• UNION SELECT password FROM users
  Hits: SQLI=[UNION_SELECT]
  Score: 2.0 × 1 = 2.0 → not suspect at MEDIUM, suspect at LOW

Categories & Scanners

• XSS — inline event handlers, <script>, javascript: URIs.
• SQLI — UNION SELECT, SLEEP(), INFORMATION_SCHEMA, etc.
• CMD_INJECTION — subshells, ;, &&, wget/curl, redirects.
• PATH_TRAVERSAL — ../, URL-encoded traversal, file://, wrappers.
• CRLF — header injection sequences.
• SSRF — URLs to localhost, 127.0.0.1, RFC1918 ranges.
• XXE — <!DOCTYPE>, <!ENTITY>, external SYSTEM.
• NOSQL — Mongo-like operators $where, $regex.
• LDAP — wildcards, null bytes.
• SERIALIZATION — PHP serialized payload patterns.

Integration Ideas

• Add to Slim/Mezzio pipeline as PSR-15 middleware.
• Run against form input before sending mail (contact forms).
• Log suspect inputs into a security audit trail.
• Flag suspicious requests in rate-limiting / WAF logic.

Tests & Examples

• PHPUnit tests included (tests/):
  • TruePositiveDetectionsTest.php
  • FalsePositiveHeuristicsTest.php
• Example apps in examples/:
  • basic/ (HTML form demo)
  • psr15/ (middleware demo)

Run tests:

Security Notice

This library generates signals only.
Always combine with:

• Prepared statements for SQL queries
• Proper HTML escaping and CSP
• Strong input validation

Folder Structure

License

MIT