logo Iri-Shield API Security Research

iri-shield

Practical API threat detection inside Node.js.

Iri-Shield combines request hardening, multi-signal identity continuity, static attack rules, behavioral anomaly scoring, attack sequence correlation, automated mitigation, and recursive PII redaction in one Express.js middleware.

Open dashboard Explore demo routes Call public API

97.3%

Attack detection

214 of 220 controlled attacks

0.00%

False positives

Observed on evaluated legitimate traffic

100%

Identity accuracy

500 controlled transition scenarios

100%

Redaction success

500 sensitive payload tests

live-pipeline.json MONITORED 
{
  "request": "GET /api/search?q=' or 1=1",
  "signals": ["sql_injection", "identity", "rate"],
  "riskScore": 82,
  "action": "blocked",
  "explainability": [
    "+30 SQL injection pattern",
    "+20 sensitive query context",
    "+12 sequence correlation"
  ],
  "response": "PII fields redacted before logging"
}

Hero media slot

Place a 20-30 second teaser video or animated dashboard capture here: incoming normal traffic, malicious payload detection, risk score breakdown, automated block, and redacted response shown as one smooth flow.

TL;DR

Seven security layers, one installable middleware.

Traditional API protection often depends on separate controls for authentication, rate limiting, signature matching, logging, and response masking. Iri-Shield studies whether these controls can be combined into a lightweight in-process middleware that produces explainable security decisions for Express.js APIs.

The research evaluation reports strong controlled results: 214/220 attack scenarios detected, no observed false-positive blocks in evaluated legitimate traffic, complete identity-continuity classification in 500 scenarios, and complete required redaction across 500 structured JSON payloads.

01 / Method

Request processing pipeline

Every request passes through a sequential security pipeline before the application response is returned.

01

Hardening

Helmet/CORS headers and baseline HTTP protection.

02

Identity

Client continuity from IP, user agent, sessions, device hints, and fingerprints.

03

Rules

SQLi, XSS, traversal, command injection, scanners, secret probes, and more.

04

Behavior

Rate windows, endpoint flood signals, unusual methods, and failed auth.

05

Correlation

Stateful multi-step attack sequence recognition.

06

Risk

Explainable score, action decision, alerting, and automated blocking.

07

Redaction

Recursive sensitive-field masking before response/log exposure.

02 / Figures and media

Visual slots for the final research site

These are intentional placeholders. Generate polished figures later and replace each block with an image, GIF, or video.

Media brief

Figure A

Overall system architecture

placeholder
Overall system architecture diagram

Figure B

Seven-layer request flow

placeholder
Seven-layer request flow diagram

Figure D

Dashboard overview

placeholder
Dashboard overview screenshot

Video 1

End-to-end demo teaser

placeholder

03 / Experimental results

Controlled evaluation summary

220

Attack scenarios

SQLi, XSS, traversal, command injection, SSTI, NoSQL, scanner bots, secret probes, brute force, and sensitive endpoints.

2,000+

Legitimate requests

Used to observe false-positive behavior under normal application traffic.

500

Identity scenarios

Controlled IP, user-agent, session, device, and fingerprint continuity transitions.

500

Redaction cases

Nested JSON payloads, tokens, emails, phones, secrets, and decoy non-sensitive fields.

Chart slot

Threat detection by category

Replace this with a bar chart using the research results CSV/SVG. It should show category-wise detection rates, highlight the 97.3% overall result, and annotate categories where detection was not complete.

Performance note

Security coverage adds measurable overhead.

The report notes lower throughput and higher latency compared with vanilla Express.js, especially under higher concurrency. Present this honestly as a security/performance trade-off, not as a hidden cost.

04 / Demo API

Routes protected by this middleware

MethodURLPurposeAccess
GET /api/public Public monitored endpoint public
GET /api/products Public product API used for normal traffic public
GET /api/users/1 PII response example for redaction testing public
GET /api/search?q=%27%20or%201%3D1 SQL injection detection test test threat
GET /admin/reports Sensitive endpoint probe scenario test threat
GET /.env Secret discovery probe scenario test threat
POST /login Returns admin JWT for protected APIs authenticated
GET /api/private Requires x-api-key header authenticated
GET /api/jwt-profile Requires Bearer token authenticated
GET /api/stats Private telemetry API authenticated
POST /research/replay Controlled dataset replay authenticated
GET /iri-shield Research dashboard authenticated

Private admin APIs

Stats and metrics require a Bearer token from the demo login endpoint.

curl -X POST https://irishield.intesab.me/login \
  -H "content-type: application/json" \
  -d "{\"username\":\"admin\",\"password\":\"admin\"}"

curl https://irishield.intesab.me/api/stats \
  -H "authorization: Bearer YOUR_TOKEN"

Current deployment settings

Storage
mongodb
Dashboard
admin/admin
Security mode
medium
Testing mode
enabled

05 / Deployment

Vercel-ready with persistent storage guidance

Use MongoDB for persistent dashboard history on Vercel. SQLite in /tmp is only scratch storage and may reset when function instances recycle.

Useful links

Dashboard Live docs Package README NPM package