GladiosWAF

Abstract

Modern applications face an increasingly complex threat landscape driven by:

• AI-generated attack payloads
• Obfuscated exploit techniques
• API-first architectures
• GraphQL complexity
• Multi-encoding evasions
• Automated attack mutation

Traditional application security approaches rely heavily on:

• Signature-based detection
• Regex-heavy validation
• Static WAF rules
• Handcrafted filtering logic
• Continuous rule maintenance

This creates growing operational burdens for development and security teams.

GladiosWAF introduces an autonomous runtime protection architecture designed to reduce the dependency on manually maintained security filtering systems by emphasizing:

• Behavioral analysis
• Structural inspection
• Runtime intent interpretation
• Autonomous security decisioning

This paper explores:

• The limitations of traditional validation-centric security models
• The distinction between business validation and security validation
• The rise of evasive and AI-generated attacks
• The concept of decision-layer security
• How autonomous runtime protection changes modern application defense

Executive Summary

Modern applications are exposed to increasingly sophisticated attack traffic. Traditional Web Application Firewalls depend heavily on static signatures, regex-based rules, manually maintained policies, and predefined attack patterns. These approaches remain useful, but they create growing operational complexity as attacks become more evasive and application structures become more dynamic.

GladiosWAF introduces an autonomous runtime decision-layer security model. Instead of relying only on exact payload signatures, GladiosWAF evaluates the structure, behavior, and intent characteristics of incoming HTTP requests in real time.

Designed as a drop-in security layer, GladiosWAF is application-agnostic and integrates through a standard HTTPS API. It supports integration across modern backend stacks and infrastructure layers, including Node.js, Python, Go, Java, .NET, Ruby, PHP, API gateways, reverse proxies, serverless environments, and service-mesh architectures.

Rather than simply matching signatures, GladiosWAF evaluates how requests behave, how payloads are composed, and whether their characteristics resemble malicious intent. This allows the platform to detect and respond to modern attack techniques with reduced operational overhead and without the constant maintenance burden associated with traditional WAF rule management.

The Problem with Traditional WAFs

Most conventional WAFs operate using signature databases, regex matching, predefined attack rules, pattern heuristics, and static anomaly thresholds. These techniques are effective against many known payloads, but they struggle when attackers mutate, encode, fragment, or distribute attacks across request components.

Modern attacks can split malicious intent across parameters, hide exploit syntax inside nested JSON, mutate payloads using AI, and encode the same attack multiple times. This creates a mismatch between static rule systems and dynamic runtime behavior.

Operational Burden

• Continuous WAF rule updates and tuning
• False-positive investigation and exception management
• Security regexes duplicated inside application code
• Specialist dependency for rule writing and maintenance
• Frequent retesting whenever applications or APIs change

Example of Rule-Heavy Security Validation

              if (input.includes("../")) block();
              
              if (/union\s+select/i.test(input)) block();
              
              if (input.includes("<script>")) block();

This kind of handcrafted detection logic becomes difficult to maintain as payloads mutate and attack structures become less predictable.

The Evolution of Modern Threats

Traditional Application Security Lifecycle

A typical secure application development lifecycle includes building the application, implementing validation logic, mitigating OWASP Top 10 risks, performing VAPT, and deploying a WAF in front of the application.

Build Application
      │
      ▼
Add Application Validation
      │
      ▼
Address OWASP Top 10 Risks
      │
      ▼
Perform VAPT / Security Testing
      │
      ▼
Deploy WAF Protection

This process remains important. However, much of the operational complexity comes from security validation code and WAF rule maintenance. GladiosWAF is designed to reduce that specific burden, not remove the need for secure application design.

Business Validation vs Security Validation

A key architectural distinction is the difference between business validation and security validation.

Business Validation

Business validation ensures that the application behaves correctly according to its own rules. This must remain inside the application.

• Required fields
• Email format checks
• Order quantity limits
• Coupon and discount rules
• Account permissions
• Inventory and workflow checks

if (!email.includes("@")) {
  return "Invalid email";
}

Security Validation

Security validation attempts to detect malicious intent, exploit syntax, obfuscated payloads, encoded attacks, and suspicious request structures.

• SQL injection filters
• XSS detection rules
• SSRF blocking logic
• Path traversal checks
• Encoded payload inspection
• Obfuscation detection

GladiosWAF Philosophy

Rather than asking, “Does this request match a known payload?”, GladiosWAF asks, “Does this request structurally and behaviorally resemble malicious intent?”

• Runtime intent interpretation: Evaluating whether a request resembles malicious behavior at execution time.
• Structural analysis: Studying the composition and shape of payloads rather than relying only on exact signatures.
• Behavioral inference: Identifying suspicious relationships across path, query, headers, body, cookies, and nested structures.
• Autonomous classification: Making allow/block decisions with minimal manual ruleset maintenance.

This positions GladiosWAF as a runtime decision-layer security platform, not merely a traditional rule-based WAF.

GladiosWAF Architecture

Client Request
      │
      ▼
GladiosWAF Middleware / Gateway
      │
      ▼
Machine Learning Inference Engine
      │
      ▼
Intent Classification
      │
 ┌────┴────┐
 │         │
 ▼         ▼
Allow     Block

1. Integration Middleware

GladiosWAF integrates directly into Node.js applications, Express middleware, reverse proxies, API gateways, edge infrastructures, and containerized environments.

2. Machine Learning Inference Engine

The ML inference engine evaluates incoming request structures using trained classification models designed for high throughput, low latency, horizontal scalability, and real-time decision making.

3. Logging and Telemetry Pipeline

GladiosWAF provides request logging, threat telemetry, response timing metrics, intent analytics, and usage aggregation.

API and GraphQL Runtime Protection

Modern applications increasingly communicate through APIs, nested JSON, and GraphQL. This changes how attacks appear. Malicious input may not be visible as a simple query string. It may be hidden inside variables, deeply nested objects, request bodies, or fragmented across multiple fields.

GraphQL Example

  "query": "mutation Login($input: LoginInput!) { login(input: $input) { token } }",
  "variables": {
    "input": {
      "username": "admin",
      "password": "' OR 1=1 --"
    }
  },
  "operationName": "Login"

A traditional rule engine may inspect strings directly, but complex structures require deeper analysis. GladiosWAF is designed to evaluate:

• GraphQL query strings
• Operation names
• Variable payloads
• Nested JSON depth
• Suspicious field values
• Fragmented injection behavior
• Encoded and obfuscated payloads

Nested API Example

  "user": {
    "profile": {
      "settings": {
        "redirect": "http://169.254.169.254/latest/meta-data/"
      }
    }
  }

By flattening and analyzing structured request data, GladiosWAF can evaluate suspicious runtime behavior beyond a single visible parameter.

Threat Coverage

' OR 1=1 --

%2527%2520OR%25201%253D1%2520--

param1=' OR
param2="%253C/script%253E
param3=1=1 --

<ScRiPt>alert(1)</ScRiPt>

  "variables": {
    "input": {
      "search": "' UNION SELECT password FROM users --"
    }
  }

Original attack intent:
' OR 1=1 --

AI-mutated variants:
' OR 'a'='a
admin'/**/OR/**/1=1--
' OR 2>1--
') OR ('x'='x
' || '1'='1

Internet
  │
  ▼
Load Balancer
  │
  ▼
GladiosWAF Gateway Layer
  │
  ▼
Application Infrastructure
            

Analyze → Log → Observe → Tune → Enable Blocking

Incoming Request
      │
      ▼
Middleware Intercepts Request
      │
      ▼
Extract Metadata
(Path, Query, Headers, Body)
      │
      ▼
Forward to ML Engine
      │
      ▼
Inference Classification
      │
 ┌────┴────┐
 │         │
 ▼         ▼
Allow     Block