Fwaf is an open-source web application firewall that uses machine learning to detect malicious queries with high accuracy. Released by Fsecurify on GitHub, it classifies incoming HTTP requests as benign or hostile instead of relying only on hand-written signatures. The repository has around 440 stars; it is a 2017-era research project and is no longer actively maintained.
Traditional web application firewalls match requests against rule sets for known attack patterns, which struggles with novel or obfuscated payloads. Fwaf takes a data-driven approach: it trains a machine learning model on examples of legitimate traffic and attack queries — SQL injection, cross-site scripting and similar web exploits — and then scores live requests, flagging those that look malicious. The project was published as a proof of concept showing that a relatively small ML pipeline could separate attack traffic from normal requests with high measured accuracy, and it circulated widely as a learning reference for ML-driven security tooling. Because development stopped in 2017, it is best treated as an educational codebase and a starting point for experiments rather than a production shield for modern applications.
The project documents its training approach, so students can reproduce the experiments and test how detection quality changes with different algorithms or feature sets. It is frequently cited in tutorials and coursework on machine learning for cybersecurity as a minimal, understandable example of the genre — small enough to audit end to end in an afternoon.
Fwaf is free and open source, with no paid tier, hosted version or support plan.
Security students, researchers and developers curious about applying machine learning to web traffic analysis and WAF prototyping.