project 02 / AI security
Neuris.
An experimental input firewall built to classify malicious web input—and to find out where learned detection breaks down.
- Status
- Live
- Dataset
- 915,495 samples
- Model
- Transformer + classifier
- Classes
- 5 input categories
01 / what it is
A classifier for the messy space before validation.
Neuris takes an arbitrary input and predicts one of five categories: SAFE, XSS, SQL_INJECTION, PATH_TRAVERSAL, or COMMAND_INJECTION.
It is an experiment, not a replacement for parameterized queries, output encoding, allowlists, or other deterministic controls. The question is whether a model can add a useful signal when inputs are obfuscated, encoded, or shaped differently from known payloads.
02 / why I built it
Signatures are clear. Human input is not.
Web attacks are easy to label when they look exactly like the examples in a payload list. They are harder when the same intent arrives through multiple encodings, unusual whitespace, broken syntax, or fragments mixed with normal text.
The model is useful only if I understand why it calls ordinary traffic malicious—not just when the accuracy number goes up.
Neuris became a way to explore tokenization, dataset balance, normalization, evaluation, and the uncomfortable gap between a clean test split and genuinely unfamiliar traffic.
03 / how it works
Normalize, represent, classify, inspect.
The early version used a manually designed MLP. The current direction uses a custom tokenizer with a Transformer and classifier so the model can learn relationships across longer input sequences.
Dataset snapshot
The largest split used to fit the model.
Used to evaluate tuning decisions.
Held out for final dataset evaluation.
Balanced across safe and four attack families.
04 / what went wrong
65.85% accuracy made the weak spots obvious.
On one roughly balanced 2,000-sample quick test, Neuris reached 65.85% overall accuracy. Safe input was recognized well, but command injection and SQL injection recall fell below half. SQL injection in particular was too easily confused with ordinary text.
High recall here can still hide harmful false positives elsewhere.
More separable than the language-heavy attack classes.
Useful signal, not reliable enforcement.
The clearest warning that the representation needs work.
The bigger issue is evaluation design. Random splits from one generated dataset can look unfamiliar while still sharing the generator’s habits. A strong score there does not prove the model can handle inputs written by people it has never seen.
05 / what I learned
A security model needs adversarial evaluation, not a victory screenshot.
The next step is not to declare success at a prettier training metric. Neuris needs genuinely novel examples, class-level error analysis, and testing against normal human text that happens to contain words or punctuation associated with attacks.
One direction is a privacy-aware public interaction surface that can produce more realistic inputs for review and labeling. Any collection flow would need clear consent and careful handling before it becomes part of training.