icodediac/zils-lite-find-decision-waf

Decision-WAF-V1.1-0.8B

A compact request classifier for a web application firewall. It reads a single HTTP request — method, path, query, and headers inspection; bodies are not inspected — and answers one question: is this request benign, or which attack class is it? It replies with a single letter token, which the decision-waf ingress scores as a probability distribution over the categories.

What it is designed for

• Per-request WAF verdicts at the edge: block-or-allow in one forward pass, with a tunable threshold on the attack score (1 − p(benign)).
• HTTP inspection: classify requests using the method, path, query, and headers without inspecting request bodies.
• Defense in depth, not sole protection: it is one signal in front of real services, alongside TLS, authentication, and backups. It is not an exploit detector or a substitute for patching.

Categories

benign · auth_abuse · file_access · injection · other_attack · recon · ssrf_redirect · xss

Intended use and serving

• Served via llama.cpp (llama-server, build ≥ 11822) with the decision metadata embedded in this GGUF (qwen35.decision.* + the systemone chat template); scored through the /v1/systemone endpoint.
• Recommended threshold: 0.05–0.1 (see evaluation). Q8_0 quantization; ~812 MB.
• Latency: ~0.68 s median on an Apple M4, ~30–70 ms class on an RTX 4000 SFF Ada.

Training

LoRA r=64, α=128, approximately 43M trainable parameters on Qwen3.5-0.8B-Base, merged into the base weights. One-token classification head readout; loss on the answer token only. Trained for 4,591 steps (approximately 14.9 h) on a single RTX 4000 SFF Ada.

Data: approximately 150k labeled HTTP requests, with the evaluation set strictly held out via request-line, query-value, and header-value fingerprints.

Evaluation

The benchmark set (299 requests: 145 benign, 154 attacks) uses the same harness for all models. h2o-lightning-4b and d1-3B numbers are from the official decision-waf-eval reports, jev-latest from api.typesafe.ai (threshold grid 0.05–0.95); Decision-WAF-V1.1-0.8B is computed from per-row scores on the same rows, backend and scoring semantics (attack score = 1 − p(benign)).

Threshold sweep (attack recall / false-positive rate):

threshold	h2o-lightning-4b	d1-3B	jev-latest	Decision-WAF-V1.1-0.8B
0.05	1.000 / 1.000	1.000 / 1.000	1.000 / 0.262	0.916 / 0.014
0.10	0.994 / 0.517	1.000 / 0.945	1.000 / 0.234	0.916 / 0.007
0.20	0.968 / 0.248	0.994 / 0.621	0.987 / 0.166	0.896 / 0.007
0.35	0.961 / 0.221	0.909 / 0.159	0.974 / 0.103	0.877 / 0.007
0.50	0.955 / 0.207	0.799 / 0.055	0.916 / 0.055	0.877 / 0.007
0.70	0.922 / 0.152	0.636 / 0.028	0.909 / 0.055	0.851 / 0.007
0.80	0.903 / 0.131	0.565 / 0.007	0.903 / 0.048	0.844 / 0.007
0.90	0.896 / 0.055	0.461 / 0.000	0.864 / 0.048	0.825 / 0.000
0.95	0.857 / 0.041	0.338 / 0.000	0.851 / 0.048	0.812 / 0.000

Best F1 per model (dots on the chart):

Model	Best F1	at threshold	P / R / FPR	Best recall @ FPR ≤ 1%
h2o-lightning-4b	0.920	0.90	0.945 / 0.896 / 0.055	none (min FPR 4.1%)
d1-3B	0.883	0.35	0.859 / 0.909 / 0.159	0.565
jev-latest	0.941	0.32	0.904 / 0.981 / 0.110	0.799
Decision-WAF-V1.1-0.8B	0.967	0.002	0.974 / 0.961 / 0.028	0.916

It catches header-borne Log4Shell/Shellshock payloads and correctly handles benign requests with non-browser clients, well-known service URLs in parameters, and code-like search terms.

Known limitations:

• Residual misses concentrate on classic probe paths (HNAP1, OWA, swagger.json, robots.txt with scripted clients, router admin panels) under-represented in training (per-label recall @0.9: recon 20/30, injection 54/63, xss 19/23, auth_abuse 6/8, file_access 19/20, ssrf_redirect 9/10); it also leans aggressive on adversarial lookalikes such as SQL keywords in ordinary prose.
• Headers-only: body-borne attacks are out of scope in the current inspection mode.
• Trained on curated and synthetic data; distribution shift (new apps, unusual API shapes, encodings) can move both error directions. Monitor and retrain.
• A WAF classifier can be evaded and can misclassify; use as one layer, keep audit logs, and never let it be the only thing between the internet and a vulnerable service.

Files

• model.safetensors + tokenizer — merged HF weights
• Conversion notes: exclude NextN speculative tensors (--no-nextn); the decision metadata must be present or the decision endpoints are not registered.