FMXExpress has released JevBan, an experimental web security tool that combines traditional attack detection with AI decision models. Inspired by fail2ban, it monitors web server access logs, identifies suspicious clients, and applies firewall bans based on a combination of deterministic rules and contextual AI judgment.
Traditional regex-based filters can recognize known attack patterns but struggle to distinguish between requests that look identical. A WordPress site owner logging in and a bot attempting to guess passwords may both send `POST /wp-login.php`. JevBan evaluates the client’s recent requests alongside a description of the website, giving a decision model additional context to distinguish legitimate activity from suspicious behavior.
The architecture uses a rules-first approach. Requests are decoded and normalized, then scored against weighted security signatures and a database of over 2,400 known-bad paths, including near matches identified using bounded Levenshtein distance. Clear attack signatures trigger strikes without consulting the model, while ambiguous requests are evaluated in batches. The AI cannot override hard security rules.
By default, JevBan runs the OpenJev decision model in-process through `llama.cpp`, keeping access logs on the server without requiring Python or an external inference service. Developers can also configure hosted decision APIs, including TypeSafe, Perplexity, Liquid AI, and Google’s Gemini Decisions API, or operate entirely in rules-only mode.
Built in Object Pascal for Linux and Windows, JevBan supports Apache, nginx, IIS, and JSON access logs, IPv4 and IPv6, persistent bans, and escalating ban durations for repeat offenders. Firewall integrations include iptables, nftables, Windows Firewall, fail2ban, and Cloudflare’s edge.
JevBan is experimental, and incorrectly blocking legitimate visitors remains a risk. Test, dry-run, shadow, and evaluation modes let developers examine model decisions against their own traffic before enabling AI-driven bans. Because detection happens after requests reach the server, JevBan complements rather than replaces existing web security measures.
