Bot & Threat Detection System

Introduction

PQCrypta's bot and threat detection system is a sophisticated, multi-layered security architecture combining cutting-edge technologies across multiple programming languages and paradigms. The system achieves 99.5% threat detection accuracy through ensemble machine learning, real-time pattern matching, and behavioral analysis.

Key Features

• Real-time OWASP Top 10 attack detection
• Quantum-resistant neural network threat classification
• Database-backed adaptive WAF patterns
• Honeypot-based malicious IP tracking
• Multi-source threat intelligence integration
• Automated IP blocking with dynamic rules
• ML-powered behavioral analysis
• Rate limiting with adaptive thresholds

System Architecture

The threat detection system employs a layered defense-in-depth strategy, with each layer written in the most appropriate language for its specific task. This polyglot architecture maximizes both performance and security.

Live System Statistics

Real-time metrics from the threat detection system:

Layer 1: Rust WAF (Web Application Firewall)

Overview

The Rust WAF layer provides the first line of defense, intercepting all incoming HTTP requests before they reach application code. Built with Axum and Tokio for maximum performance, it can process thousands of requests per second while maintaining microsecond-level latency.

File Location

/var/www/html/public/ent/api/src/middleware/waf.rs

Attack Types Detected

• SQL Injection: Pattern matching for UNION SELECT, DROP TABLE, etc.
• XSS: Detection of <script>, javascript:, onerror=
• Path Traversal: ../, ..\\, %2e%2e patterns
• Command Injection: Shell metacharacters, backticks, pipes
• LDAP Injection: LDAP filter characters
• XML/XXE: DOCTYPE, ENTITY declarations
• SSRF: Internal IP ranges, localhost variants
• Header Injection: CRLF injection attempts
• File Upload Attacks: Malicious file extensions

Rate Limiting Configuration

Database Integration

WAF patterns are dynamically loaded from PostgreSQL, allowing real-time updates without service restart. Patterns are cached and reloaded every 5 minutes.

SELECT id, name, attack_type, pattern, severity, threat_score
FROM waf_patterns
WHERE is_active = true
ORDER BY threat_score DESC;

Layer 2: PHP Honeypot System

Overview

The honeypot layer monitors access to 28 common attack targets that don't exist on this server. Any access to these paths indicates malicious intent and triggers automatic IP blocking.

File Location

/var/www/html/public/security/process-honeypot-logs.php
/var/www/html/public/security/honeypot-handler.php
/var/www/html/public/security/generate-dynamic-rules.php

Monitored Honeypot Patterns (28 Total)

Processing Workflow

Layer 3: Python ML/AI Threat Detection

Overview

Advanced machine learning threat detection using state-of-the-art neural networks specifically designed for quantum-resistant pattern recognition. Achieves 99.5% accuracy through ensemble methods and adversarial robustness.

File Location

/var/www/html/public/ent/ml/advanced_threat_detection.py

Neural Network Architecture

class QuantumResistantNeuralNetwork(nn.Module):
    - Input Layer: Variable dimensions based on feature extraction
    - Hidden Layers: Deep network with residual connections
    - Batch Normalization: Stabilizes training
    - Dropout (30%): Prevents overfitting
    - ReLU Activation: Non-linear transformations
    - Adversarial Defense Layer: Protects against adversarial attacks
    - Attention Mechanism: Feature importance weighting
    - Softmax Output: Probability distribution over threat classes

Threat Categories Classified

• Quantum Attack: Post-quantum cryptanalysis attempts
• Classical Cryptanalysis: Traditional crypto attacks
• Side-Channel Attack: Timing, power analysis
• Protocol Vulnerability: TLS, HTTPS exploits
• Implementation Flaw: Code-level vulnerabilities
• Advanced Persistent Threat (APT): Sophisticated campaigns
• Zero-Day Exploit: Unknown vulnerabilities
• DDoS Attack: Distributed denial of service

Ensemble Methods

Layer 4: JavaScript Threat Intelligence

Overview

Integration with 10+ external threat intelligence sources provides real-time context on known malicious IPs, domains, and malware campaigns.

File Location

/var/www/html/public/js/threat-intelligence.js

Integrated Threat Intelligence Sources

• AlienVault OTX: Community-driven threat exchange (1000 req/hour)
• SANS ISC DShield: Global sensors data (100 req/hour)
• Binary Defense ATIF: Malicious IP banlist (updated daily)
• CINS Score: Collective Intelligence malicious IPs
• Feodo Tracker: Botnet C2 tracking (Emotet, Dridex)
• URLhaus: Malware URL sharing platform
• SSL Blacklist: Malicious SSL certificates
• OpenPhish: Phishing URL feeds

Database Schema

threat_intelligence Table

CREATE TABLE threat_intelligence (
    id INTEGER PRIMARY KEY,
    ioc_type VARCHAR(50) NOT NULL,           -- IP, domain, URL, hash
    ioc_value TEXT NOT NULL,                 -- The actual indicator
    source VARCHAR(50) NOT NULL,             -- AlienVault, DShield, etc.
    threat_type VARCHAR(100),                -- malware, phishing, c2, etc.
    malware_family VARCHAR(100),             -- Emotet, Dridex, etc.
    confidence_level INTEGER,                -- 0-100 confidence score
    first_seen TIMESTAMP,
    last_seen TIMESTAMP,
    reference_url TEXT,
    tags TEXT[],
    raw_data JSONB
);

bot_ip_tracking Table

CREATE TABLE bot_ip_tracking (
    id INTEGER PRIMARY KEY,
    ip_address INET NOT NULL,
    user_agent TEXT,
    country_code CHAR(2),
    country_name VARCHAR(255),
    city VARCHAR(255),
    region VARCHAR(255),
    asn INTEGER,
    organization VARCHAR(500),
    request_path TEXT NOT NULL,
    request_method VARCHAR(10),
    http_status INTEGER,
    detection_reason TEXT NOT NULL,
    threat_score NUMERIC(5,4) DEFAULT 0.5,   -- 0.0-1.0 threat score
    first_seen TIMESTAMP DEFAULT NOW(),
    last_seen TIMESTAMP DEFAULT NOW(),
    total_requests INTEGER DEFAULT 1,
    malicious_requests INTEGER DEFAULT 1,
    is_blocked BOOLEAN DEFAULT FALSE,
    blocked_at TIMESTAMP,
    UNIQUE(ip_address, request_path)
);

waf_patterns Table

CREATE TABLE waf_patterns (
    id INTEGER PRIMARY KEY,
    name VARCHAR(100) NOT NULL,
    attack_type VARCHAR(50) NOT NULL,        -- sql_injection, xss, etc.
    pattern TEXT NOT NULL,                   -- Regex pattern
    description TEXT,
    severity VARCHAR(20),                    -- low, medium, high, critical
    threat_score DOUBLE PRECISION,           -- 0.0-1.0 score
    is_active BOOLEAN DEFAULT TRUE
);

Cron Job Integration

Automated Security Processing

Three main cron jobs maintain continuous protection:

Complete Attack Detection Data Flow

When a potentially malicious request arrives, it flows through all detection layers in sequence:

OWASP Top 10 Detection

Comprehensive protection against the OWASP Top 10 most critical web application security risks:

Honeypot Patterns & Detection Rules

Overview

PQCrypta's multi-layered honeypot system combines 222 total security rules across static honeypots, regex patterns, user agent detection, and dynamic ML-generated rules that adapt to emerging threats.

Detection Rule Breakdown

File Locations

# Static Honeypot Configuration
/etc/nginx/snippets/honeypot-traps.conf         (23 endpoints)

# Pattern-Based Detection
/etc/nginx/conf.d/bot-protection.conf           (68 URL + 34 UA patterns)

# Dynamic ML-Generated Rules
/etc/nginx/conf.d/dynamic-bot-blocking.conf     (Auto-updated every 5min)

# Processing Scripts
/var/www/html/public/security/honeypot-handler.php
/var/www/html/public/security/process-honeypot-logs.php
/var/www/html/public/security/generate-dynamic-rules.php

Honeypot Response Workflow

Machine Learning Threat Detection

Overview

Advanced threat intelligence engine combining entropy analysis, behavioral detection, external threat feeds, and LLM-powered explanations to achieve 99.5% threat detection accuracy with minimal false positives.

File Location

/var/www/html/scripts/threat-intelligence-engine.php

Detection Components

Risk Scoring Algorithm

Base Confidence Score: 0.0

+ 0.40  Known malicious IP in threat databases
+ 0.30  Entropy analysis indicates synthetic behavior (>70% synthetic probability)
+ 0.25  Honeypot trap triggered
+ 0.05  Advanced pattern recognition flags

-------------------------------------------------------------------
Threshold: 0.80 = Block Recommendation
Threshold: 0.90 = High-Risk Alert + Webhook Notification

Database Tables

Real-Time Threat Analysis Flow

API Rate Limiting & Quota Management

Overview

Comprehensive rate limiting system with per-key hourly/daily quotas, automatic denial on exceeded limits, and real-time usage tracking in PostgreSQL database.

Rate Limit Configuration

Implementation Details

-- API Key Rate Limiting (PostgreSQL)
SELECT rate_limit_per_hour, is_active, expires_at
FROM api_keys
WHERE key_hash = sha256($api_key)
  AND is_active = true
  AND (expires_at IS NULL OR expires_at > NOW());

-- Usage Tracking
INSERT INTO api_usage_logs (
    api_key_id, endpoint, request_count, timestamp
) VALUES ($key_id, $endpoint, 1, NOW())
ON CONFLICT (api_key_id, endpoint, hour_bucket)
DO UPDATE SET request_count = api_usage_logs.request_count + 1;

-- Quota Check
SELECT SUM(request_count) as current_usage
FROM api_usage_logs
WHERE api_key_id = $key_id
  AND timestamp >= NOW() - INTERVAL '1 hour';

-- Deny if current_usage >= rate_limit_per_hour

Rate Limit Response Headers

HTTP/1.1 200 OK
X-RateLimit-Limit: 10000
X-RateLimit-Remaining: 9847
X-RateLimit-Reset: 1699564800
X-RateLimit-Window: 3600

---

HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 10000
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1699564800
Retry-After: 3600

Content-Type: application/json
{
  "error": "Rate limit exceeded",
  "limit": 10000,
  "window": "1 hour",
  "reset_at": "2025-11-10T19:00:00Z"
}

Enforcement Architecture

Adaptive Throttling

The system dynamically adjusts rate limits based on real-time threat analysis:

• Clean Traffic (threat_score < 0.3): Normal 100 req/min limit
• Suspicious Traffic (0.3 ≤ threat_score < 0.8): Reduced to 20 req/min for 5 minutes
• Malicious Traffic (threat_score ≥ 0.8): Immediate IP block, 0 req/min
• Honeypot Trigger: Permanent block added to security_blocklist

System Summary

Technology Stack

• Rust: High-performance WAF middleware with Axum + Tokio async runtime
• PHP 8.4: Honeypot monitoring with GeoIP enrichment
• Python 3.11+: PyTorch-based ML threat detection
• JavaScript ES6: Threat intelligence aggregation
• PostgreSQL 16: Centralized threat database
• Nginx: Reverse proxy with dynamic rule generation
• Cron: Automated background processing

Performance Metrics

• Threat detection latency: <5ms average
• Request throughput: 10,000+ req/sec
• ML classification speed: <50ms per request
• Database query time: <2ms average
• Pattern matching: <1ms per request