Documentation · Detection

Tier 2 evasion report

Generated by scripts/evasion_report.py against tier2-heuristic-1.0. Regenerate it after any detector change; tests/unit/test_evasion_corpus.py fails when a result here goes out of date.

What this is. A measurement of one heuristic detector (SQL, command and template injection, path traversal and XSS in the request path and query) against well-known evasion techniques. It shows what the detector catches and what it misses. What it is not. A detection rate on real traffic, a benchmark against other products, or a statement about the DNS, beaconing, exfiltration and TLS detectors, which are stateful and are not covered here.

Two thresholds: caught is a finding of at least 0.3 with the right label, the detector's floor. Alert-grade is at least 0.5, where the control plane raises an alert by itself without a matching rule (0.5 for these web-injection labels, policy.classifier_alert_threshold = 0.7 for the rest). No detector can block: a rule a human approved is what enforces.

43 cases: 24 alert-grade, 4 caught below alert grade, 15 missed (28 of 43 detected).

Headline findings

• 4 of 43 cases are labelled but do not raise an alert (between 0.3 and 0.5). The label is stored on the flow, but Tier 2 alone raises an alert only at 0.5 or more; a high Tier 1 anomaly score can still raise one.
• The starter rule that blocks web injection needs 0.9. Only payloads that trip two or more rules reach it, so blocking stays conservative on purpose: a miss costs an alert you did not get, a wrong block costs a legitimate request. The alert threshold is a setting; the block threshold is a rule a person approves.
• 15 cases are missed outright. Mostly encodings and spellings the normaliser does not undo (versioned SQL comments, full-width letters, HTML entities, wildcards and quote-splitting in shell words) and thresholds a lone weak rule does not reach.
• The detector is a first line, not a verdict. NeuraWall's design assumes this: a model or heuristic can only raise an alert, and a person approves any rule that blocks.

SQL injection

Command injection

Template injection

Path traversal

XSS

Known gaps, in plain words

• SQL injection, MySQL versioned comment. the comment stripper removes the whole /!.../ block, including the keyword inside it
• SQL injection, full-width Unicode keywords. lower-casing does not fold full-width letters, and no rule fires without the keywords
• Command injection, quote splitting. c'a't defeats the command-name rule; /etc/passwd alone scores 0.27, under the floor
• Command injection, wildcards instead of names. neither a known command name nor a literal sensitive path appears
• Command injection, newline separator, no sensitive file. a newline is not in the separator list
• Template injection, Jinja expression. a lone {{7*7}} probe scores 0.27, under the 0.3 floor
• Template injection, obfuscated JNDI. the JNDI rule does not fire, and the template-expression rule alone scores 0.27
• Template injection, Jinja statement block. only {{ }}, ${ }, <% %> and #{ } are recognised
• Path traversal, absolute sensitive path. a reference to /etc/passwd alone scores 0.27, under the 0.3 floor
• Path traversal, single level. two or more consecutive ../ are required
• Path traversal, Tomcat ..;/ form. Not recognised.
• Path traversal, nested ....// form. a filter that strips ../ once turns this into ../../.. on the server; the detector does not recognise it
• XSS, HTML-entity encoded tag. entities are not decoded
• XSS, javascript: with an entity. Not recognised.
• XSS, ontoggle handler. only error, load, mouseover and focus handlers are listed

These are heuristics, so every pattern has a bypass. That is why NeuraWall never lets a detector block on its own: a miss costs an alert you did not get, and a false positive costs nothing until a person approves a rule for it.

Back to what NeuraWall detects