STEALTHWALL

Self-hosted machine-learning intrusion prevention middleware and firewall. Evaluates sliding-window traffic behavior across 14 normalized statistical features in sub-millisecond time to detect and mitigate automated cyberattacks (SQL injection, directory scans, brute force, exploit probes) before requests reach backend application logic.

Architecture Overview

STEALTHWALL operates as an in-process middleware or reverse-proxy sidecar:

1. Pre-Enforcement Gate: Checks incoming requests against local kernel firewall tables (iptables/nftables) and active cooldown lists. Drops blocked IPs immediately (403 Forbidden).
2. Feature Extraction: Tracks requests in sliding time windows (60 seconds) per source IP. Computes 14 normalized statistical metrics (Shannon entropy, inter-arrival variance, status code distribution, enumeration entropy, signature presence).
3. ML Inference: Evaluates an optimized LightGBM decision model (coldstart.onnx) running on ONNX Runtime with pure-Python fallback.
4. Graduated Response: Implements progressive cooldown tiers (rate_limit -> pow_challenge -> provisional_block -> temp_block -> long_cooldown). Includes shared-IP protection for CGNAT / proxy gateways.

Quickstart

Python (FastAPI / Starlette)

pip install stealthwall

from fastapi import FastAPI
from stealthwall import StealthWall

app = FastAPI()
StealthWall(app)

@app.get("/")
def index():
    return {"status": "online"}

Node.js (Express)

npm install stealthwall

const express = require('express');
const { stealthwall } = require('stealthwall');

const app = express();
app.use(stealthwall());

app.get('/', (req, res) => {
  res.json({ status: 'online' });
});

app.listen(3000);

CLI & Operations Console

# Launch visual monitoring dashboard and WebSocket feed
stealthwall dashboard --port 8000

# Run simulated attack traffic against a target
stealthwall attack --tool sqlmap --target http://localhost:8000

# Print configuration and model artifact status
stealthwall status

# Run full test suite and cross-language parity assertions
stealthwall test

Dashboard Authentication & Docker

When running the dashboard in production, configure admin credentials via environment variables:

export STEALTHWALL_ADMIN_USER="admin"
export STEALTHWALL_ADMIN_PASSWORD="YourStrongPassword123!"
stealthwall dashboard --port 8000

Or deploy the complete stack (Dashboard + Redis + Prometheus) via Docker Compose:

docker compose up -d

Visit http://localhost:8000 to access the real-time dark-theme Operations Console and live incident stream.

Documentation

• Publishing to PyPI & npm
• FastAPI / Python Integration
• Express / Node.js Integration
• Next.js Edge Middleware
• PHP & WordPress Integration
• Nginx Reverse Proxy Integration
• REST & WebSocket API Reference
• Attack Simulator & Penetration Testing
• Changelog

License

MIT License.