aiwaf 0.1.9.1.5__py3-none-any.whl → 0.1.9.1.7__py3-none-any.whl

aiwaf/__init__.py

@@ -1,6 +1,6 @@
 default_app_config = "aiwaf.apps.AiwafConfig"
 
-__version__ = "0.1.9.1.5"
+__version__ = "0.1.9.1.7"
 
 # Note: Middleware classes are available from aiwaf.middleware
 # Import them only when needed to avoid circular imports during Django app loading

aiwaf/management/commands/check_dependencies.py

@@ -498,7 +498,9 @@ class Command(BaseCommand):
                 else u['package']['name'] 
                 for u in safe_upgrades
             ])
-            self.stdout.write(f"Command that would be executed:\n   {upgrade_cmd}")
+            self.stdout.write(f"Commands that would be executed:")
+            self.stdout.write(f"   {upgrade_cmd}")
+            self.stdout.write(f"   pip cache purge  # Clear pip cache after upgrades")
             return []
             return []
         else:
@@ -537,6 +539,20 @@ class Command(BaseCommand):
             self.stdout.write(f"\n🎉 Upgrade complete: {success_count}/{len(safe_upgrades)} packages upgraded successfully")
             
             if success_count > 0:
+                # Clear pip cache after successful upgrades
+                self.stdout.write(self.style.HTTP_INFO("\n🧹 Clearing pip cache..."))
+                try:
+                    cache_result = subprocess.run(['pip', 'cache', 'purge'], 
+                                                capture_output=True, text=True, timeout=60)
+                    if cache_result.returncode == 0:
+                        self.stdout.write(self.style.SUCCESS("   ✅ Pip cache cleared successfully"))
+                    else:
+                        self.stdout.write(self.style.WARNING(f"   ⚠️  Cache clear warning: {cache_result.stderr}"))
+                except subprocess.TimeoutExpired:
+                    self.stdout.write(self.style.WARNING("   ⚠️  Pip cache clear timed out"))
+                except Exception as e:
+                    self.stdout.write(self.style.WARNING(f"   ⚠️  Could not clear pip cache: {e}"))
+                
                 self.stdout.write(self.style.HTTP_INFO("\n💡 Recommendations after upgrade:"))
                 self.stdout.write("   1. Run tests to ensure everything works correctly")
                 self.stdout.write("   2. Run 'python manage.py check_dependencies' again to verify")

aiwaf/middleware.py

@@ -17,7 +17,7 @@ from django.urls import get_resolver
 from .trainer import STATIC_KW, STATUS_IDX, path_exists_in_django
 from .blacklist_manager import BlacklistManager
 from .models import IPExemption
-from .utils import is_exempt, get_ip, is_ip_exempted
+from .utils import is_exempt, get_ip, is_ip_exempted, is_exempt_path
 from .storage import get_keyword_store
 
 MODEL_PATH = getattr(
@@ -191,10 +191,12 @@ class AIAnomalyMiddleware(MiddlewareMixin):
         key = f"aiwaf:{ip}"
         data = cache.get(key, [])
         path_len = len(request.path)
-        if not path_exists_in_django(request.path) and not is_exempt(request):
+        
+        # Use the same scoring logic as trainer.py
+        known_path = path_exists_in_django(request.path)
+        kw_hits = 0
+        if not known_path and not is_exempt_path(request.path):
             kw_hits = sum(1 for kw in STATIC_KW if kw in request.path.lower())
-        else:
-            kw_hits = 0
 
         resp_time = now - getattr(request, "_start_time", now)
         status_code = str(response.status_code)
@@ -206,11 +208,60 @@ class AIAnomalyMiddleware(MiddlewareMixin):
         
         # Only use AI model if it's available
         if self.model is not None and self.model.predict(X)[0] == -1:
-            # BlacklistManager.block() now checks exemptions internally
-            BlacklistManager.block(ip, "AI anomaly")
-            # Check if actually blocked (exempted IPs won't be blocked)
-            if BlacklistManager.is_blocked(ip):
-                return JsonResponse({"error": "blocked"}, status=403)
+            # AI detected anomaly - but analyze patterns before blocking (like trainer.py)
+            
+            # Get recent behavior data for this IP to make intelligent blocking decision
+            recent_data = [d for d in data if now - d[0] <= 300]  # Last 5 minutes
+            
+            if recent_data:
+                # Calculate behavior metrics similar to trainer.py
+                recent_kw_hits = []
+                recent_404s = 0
+                recent_burst_counts = []
+                
+                for entry_time, entry_path, entry_status, entry_resp_time in recent_data:
+                    # Calculate keyword hits for this entry
+                    entry_known_path = path_exists_in_django(entry_path)
+                    entry_kw_hits = 0
+                    if not entry_known_path and not is_exempt_path(entry_path):
+                        entry_kw_hits = sum(1 for kw in STATIC_KW if kw in entry_path.lower())
+                    recent_kw_hits.append(entry_kw_hits)
+                    
+                    # Count 404s
+                    if entry_status == 404:
+                        recent_404s += 1
+                    
+                    # Calculate burst for this entry (requests within 10 seconds)
+                    entry_burst = sum(1 for (t, _, _, _) in recent_data if abs(entry_time - t) <= 10)
+                    recent_burst_counts.append(entry_burst)
+                
+                # Calculate averages and maximums
+                avg_kw_hits = sum(recent_kw_hits) / len(recent_kw_hits) if recent_kw_hits else 0
+                max_404s = recent_404s
+                avg_burst = sum(recent_burst_counts) / len(recent_burst_counts) if recent_burst_counts else 0
+                total_requests = len(recent_data)
+                
+                # Don't block if it looks like legitimate behavior (same thresholds as trainer.py):
+                if (
+                    avg_kw_hits < 2 and           # Not hitting many malicious keywords
+                    max_404s < 10 and            # Not excessive 404s
+                    avg_burst < 15 and           # Not excessive burst activity
+                    total_requests < 100         # Not excessive total requests
+                ):
+                    # Anomalous but looks legitimate - don't block
+                    pass
+                else:
+                    # Block if it shows clear signs of malicious behavior
+                    BlacklistManager.block(ip, f"AI anomaly + suspicious patterns (kw:{avg_kw_hits:.1f}, 404s:{max_404s}, burst:{avg_burst:.1f})")
+                    # Check if actually blocked (exempted IPs won't be blocked)
+                    if BlacklistManager.is_blocked(ip):
+                        return JsonResponse({"error": "blocked"}, status=403)
+            else:
+                # No recent data to analyze - be more conservative, only block on very suspicious current request
+                if kw_hits >= 2 or status_idx == STATUS_IDX.index("404"):
+                    BlacklistManager.block(ip, "AI anomaly + immediate suspicious behavior")
+                    if BlacklistManager.is_blocked(ip):
+                        return JsonResponse({"error": "blocked"}, status=403)
 
         data.append((now, request.path, response.status_code, resp_time))
         data = [d for d in data if now - d[0] < self.WINDOW]

{aiwaf-0.1.9.1.5.dist-info → aiwaf-0.1.9.1.7.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aiwaf
-Version: 0.1.9.1.5
+Version: 0.1.9.1.7
 Summary: AI-powered Web Application Firewall
 Home-page: https://github.com/aayushgauba/aiwaf
 Author: Aayush Gauba
@@ -249,6 +249,7 @@ python manage.py check_dependencies --upgrade --check-security --update-requirem
 - ✅ **Dry run mode** for testing upgrade plans
 - ✅ **AIWAF compatibility validation**
 - ✅ **Automatic requirements.txt updates** after successful upgrades
+- ✅ **Pip cache clearing** to prevent cache-related issues
 
 **Safe Upgrade System:**
 
@@ -305,6 +306,9 @@ The upgrade system is designed to maintain AIWAF stability while keeping your pa
 
 🎉 Upgrade complete: 2/2 packages upgraded successfully
 
+🧹 Clearing pip cache...
+   ✅ Pip cache cleared successfully
+
 📝 Updating requirements.txt...
    📋 Backup created: requirements.txt.backup
    📦 pandas: pandas>=1.3 → pandas>=1.5.3
@@ -323,6 +327,7 @@ The upgrade system is designed to maintain AIWAF stability while keeping your pa
 - 🧪 **Dry Run Mode**: Test upgrade plans before execution
 - ⚠️ **Clear Blocking Reasons**: Explains why upgrades are blocked
 - 📝 **Requirements.txt Updates**: Automatically updates dependency files
+- 🧹 **Cache Management**: Clears pip cache after successful upgrades
 
 **Recommended Upgrade Workflow:**
 
@@ -361,6 +366,7 @@ The system uses a multi-layer decision process:
 - **Layer 3**: Analyze cross-package dependencies  
 - **Layer 4**: Select highest safe version within constraints
 - **Layer 5**: Execute with error handling and rollback capability
+- **Layer 6**: Clear pip cache and update requirements.txt after success
 
 This will ensure the IP is never blocked by AI‑WAF. You can also manage exemptions via the Django admin interface.
 

{aiwaf-0.1.9.1.5.dist-info → aiwaf-0.1.9.1.7.dist-info}/RECORD

@@ -1,8 +1,8 @@
-aiwaf/__init__.py,sha256=XpqePdxlyW-5RJkAUTNtlGeSUYFl7vaRQ6JrnHU1W-Y,220
+aiwaf/__init__.py,sha256=hhKVupfj0NOn_nRM1Ukd6aUP9mL5OkjKLE-tZ3xGdIE,220
 aiwaf/apps.py,sha256=nCez-Ptlv2kaEk5HenA8b1pATz1VfhrHP1344gwcY1A,142
 aiwaf/blacklist_manager.py,sha256=LYCeKFB-7e_C6Bg2WeFJWFIIQlrfRMPuGp30ivrnhQY,1196
 aiwaf/decorators.py,sha256=IUKOdM_gdroffImRZep1g1wT6gNqD10zGwcp28hsJCs,825
-aiwaf/middleware.py,sha256=4Ox0pUdB7rMT1Sw5XHO6-udQrfqyF9VGdkkkgLioRJ0,12470
+aiwaf/middleware.py,sha256=EMAQA_Gnz0jv4nevlognT921ZeBEro13J_DSv_mQ3Dw,15482
 aiwaf/middleware_logger.py,sha256=LWZVDAnjh6CGESirA8eMbhGgJKB7lVDGRQqVroH95Lo,4742
 aiwaf/models.py,sha256=vQxgY19BDVMjoO903UNrTZC1pNoLltMU6wbyWPoAEns,2719
 aiwaf/storage.py,sha256=HYSnis7S8ETsos_NxWkd05OoiHXMhIWQy8FcFTqO4vk,8408
@@ -15,7 +15,7 @@ aiwaf/management/commands/add_ipexemption.py,sha256=sSf3d9hGK9RqqlBYkCrnrd8KZWGT
 aiwaf/management/commands/aiwaf_diagnose.py,sha256=nXFRhq66N4QC3e4scYJ2sUngJce-0yDxtBO3R2BllRM,6134
 aiwaf/management/commands/aiwaf_logging.py,sha256=FCIqULn2tii2vD9VxL7vk3PV4k4vr7kaA00KyaCExYY,7692
 aiwaf/management/commands/aiwaf_reset.py,sha256=0FIBqpZS8xgFFvAKJ-0zAC_-QNQwRkOHpXb8N-OdFr8,3740
-aiwaf/management/commands/check_dependencies.py,sha256=pxON6cFrBTWtNRzPOzB_S4Jdld1G6q1O_ds3xtbjq8Y,36134
+aiwaf/management/commands/check_dependencies.py,sha256=GOZl00pDwW2cJjDvIaCeB3yWxmeYcJDRTIpmOTLvy2c,37204
 aiwaf/management/commands/clear_cache.py,sha256=cdnuTgxkhKLqT_6k6yTcEBlREovNRQxAE51ceXlGYMA,647
 aiwaf/management/commands/debug_csv.py,sha256=Lddqp37mIn0zdvHf4GbuNTWYyJ5h8bumDcGmFSAioi0,6801
 aiwaf/management/commands/detect_and_train.py,sha256=-o-LZ7QZ5GeJPCekryox1DGXKMmFEkwwrcDsiM166K0,269
@@ -27,8 +27,8 @@ aiwaf/management/commands/test_exemption_fix.py,sha256=ngyGaHUCmQQ6y--6j4q1viZJt
 aiwaf/resources/model.pkl,sha256=5t6h9BX8yoh2xct85MXOO60jdlWyg1APskUOW0jZE1Y,1288265
 aiwaf/templatetags/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 aiwaf/templatetags/aiwaf_tags.py,sha256=XXfb7Tl4DjU3Sc40GbqdaqOEtKTUKELBEk58u83wBNw,357
-aiwaf-0.1.9.1.5.dist-info/licenses/LICENSE,sha256=Ir8PX4dxgAcdB0wqNPIkw84fzIIRKE75NoUil9RX0QU,1069
-aiwaf-0.1.9.1.5.dist-info/METADATA,sha256=7hXUI5PEFAGOTugMBbECEz1SgMHbb8NEnYt_Alg4yFM,21873
-aiwaf-0.1.9.1.5.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-aiwaf-0.1.9.1.5.dist-info/top_level.txt,sha256=kU6EyjobT6UPCxuWpI_BvcHDG0I2tMgKaPlWzVxe2xI,6
-aiwaf-0.1.9.1.5.dist-info/RECORD,,
+aiwaf-0.1.9.1.7.dist-info/licenses/LICENSE,sha256=Ir8PX4dxgAcdB0wqNPIkw84fzIIRKE75NoUil9RX0QU,1069
+aiwaf-0.1.9.1.7.dist-info/METADATA,sha256=P3lYeDWOKfjHCBWcaEoFpN5lJJkj0iP_HWIJjAI-hz0,22145
+aiwaf-0.1.9.1.7.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+aiwaf-0.1.9.1.7.dist-info/top_level.txt,sha256=kU6EyjobT6UPCxuWpI_BvcHDG0I2tMgKaPlWzVxe2xI,6
+aiwaf-0.1.9.1.7.dist-info/RECORD,,