WYVRN Security API

Runtime API Security, Threat Detection & Automated Threat Control

WYVRN is a runtime API security layer that sits between clients and an API to detect, assess, and respond to security threats in real time.

Instead of relying only on static vulnerability detection, WYVRN analyzes API requests and responses, calculates contextual risk, applies automated security policies, correlates related events, and streams security activity to a live dashboard.

---

What WYVRN Detects

WYVRN currently detects:

• SQL Injection
• BOLA / IDOR
• Authentication Abuse
• Rate Abuse
• Sensitive Data Exposure
• Excessive Data Exposure
• Behavioral Anomalies

Security decisions are based on contextual risk and can result in:

ALLOW
MONITOR
RATE_LIMIT
BLOCK

---

Architecture

                    CLIENT
                       │
                       ▼
              ┌─────────────────┐
              │ WYVRN MIDDLEWARE│
              └────────┬────────┘
                       │
              ┌────────▼────────┐
              │    DETECTORS    │
              └────────┬────────┘
                       │
              ┌────────▼────────┐
              │   RISK ENGINE   │
              └────────┬────────┘
                       │
              ┌────────▼────────┐
              │  POLICY ENGINE  │
              └────────┬────────┘
                       │
              ALLOW / MONITOR /
             RATE_LIMIT / BLOCK
                       │
                       ▼
                ┌─────────────┐
                │  TARGET API │
                └──────┬──────┘
                       │
                       ▼
                   RESPONSE
                       │
                       ▼
              RESPONSE DETECTORS
                       │
                       ▼
                RISK + CORRELATION
                       │
             ┌─────────┼─────────┐
             ▼         ▼         ▼
         EVENT STORE  CAMPAIGN  WEBSOCKET
                                  │
                                  ▼
                              DASHBOARD

---

Key Features

Runtime Threat Detection

Analyzes API traffic in real time for common API security threats.

Risk-Based Decisions

Multiple findings are combined with confidence and contextual factors to produce a risk score from 0–100.

Automated Protection

The policy engine converts risk into an enforcement action:

ALLOW  MONITOR  RATE_LIMIT  BLOCK

Behavioral Analysis

WYVRN builds endpoint-level baselines and detects unusual response size, latency, and server behavior.

Attack Correlation

Multiple suspicious events from the same client can be correlated into a larger ATTACK_CAMPAIGN.

Real-Time Dashboard

Security events are exposed through REST APIs and a WebSocket stream for live dashboard updates.

---

Project Structure

Trojan-Horses/
├── target_api/
│   └── main.py
├── wyvrn/
│   ├── middleware.py
│   ├── risk.py
│   ├── policy.py
│   ├── correlation.py
│   ├── simulator.py
│   └── detectors/
│       ├── auth.py
│       ├── bola.py
│       ├── injection.py
│       ├── rate_limit.py
│       ├── sensitive_data.py
│       ├── excessive_data.py
│       └── anomaly.py
├── tests/
│   ├── test_auth.py
│   ├── test_detectors.py
│   ├── test_risk.py
│   ├── test_policy.py
│   ├── test_anomaly.py
│   └__ test_excessive_data.py
|   |__ test_injection.py
|   |__ test_integration.py
|   |__ test_sensitive_data.py
|   |__ test_wyvrn.py
|
├── requirements.txt
├── pytest.ini
└── README.md

---

Setup

Requirements

• Python 3.10+
• pip

---

1. Clone the Repository

git clone <YOUR_REPOSITORY_URL>
cd Trojan-Horses

---

2. Create a Virtual Environment

Windows

python -m venv .venv
.venv\Scripts\activate

macOS / Linux

python3 -m venv .venv
source .venv/bin/activate

---

3. Install Dependencies

pip install -r requirements.txt

---

Running WYVRN

WYVRN uses two local services.

Terminal 1 — Target API

uvicorn target_api.main:app --host 127.0.0.1 --port 8000

Terminal 2 — WYVRN

uvicorn wyvrn.main:app --host 127.0.0.1 --port 9000

---

Dashboard

Open:

http://127.0.0.1:9000/dashboard/

The dashboard provides:

• live security events
• risk scores
• detection statistics
• policy actions
• attack campaigns
• attack simulator controls

---

API Documentation

Interactive API documentation:

http://127.0.0.1:9000/docs

Alternative documentation:

http://127.0.0.1:9000/redoc

---

Quick Demo

Once both services are running, traffic can be sent through the WYVRN proxy.

Normal Traffic

curl http://127.0.0.1:9000/proxy/health

SQL Injection

curl "http://127.0.0.1:9000/proxy/search?q=%27%20OR%201%3D1%20--"

BOLA / IDOR

curl http://127.0.0.1:9000/proxy/users/1

Sensitive Data Exposure

curl http://127.0.0.1:9000/proxy/profile

Authentication Abuse

curl -X POST "http://127.0.0.1:9000/proxy/login?username=alice&password=wrong-password"

Repeated failed attempts can trigger authentication-abuse detection.

The dashboard can also be used to trigger the built-in attack simulator.

---

Testing

Run the complete test suite with:

pytest -q

Tests cover the detector, risk, policy, integration, anomaly, sensitive-data, and dashboard/API components.

---

Security Note

The target_api application is intentionally vulnerable.

It exists only as a controlled target for demonstrating WYVRN's detection and response capabilities.

Do not expose the vulnerable target API directly to the public internet.

---

Why WYVRN?

Traditional API security often focuses on identifying individual vulnerabilities.

WYVRN focuses on the runtime security decision:

DETECT
   ↓
ASSESS
   ↓
DECIDE
   ↓
CORRELATE
   ↓
RESPOND

A suspicious request is not treated in isolation.

WYVRN combines detector findings, confidence, behavioral context, endpoint context, recent activity, and correlated events to determine what should happen next.

---

WYVRN

Runtime API Security

Detect → Score → Decide → Correlate → Respond