Try Agumon v1.0

Paste a raw HTTP request. A 2B language model decides allow or block.

227 / 8,192 bytes

Examples

How it performs

of attacks blocked: 98.1%
of legitimate requests blocked: 0.004%
unseen sites tested: 510

Attacks blocked

Higher is better

Agumon v1.0OWASP CRS 4.20 PL1open-appsec 1.1.36 basic

Held-out test510 unseen sites

Agumon v1.0: 98.1%

OWASP CRS 4.20 PL1: 87.4%

open-appsec 1.1.36 basic: 91.9%

CIC-IDS2017XSS

Agumon v1.0: 96%

OWASP CRS 4.20 PL1: 96%

open-appsec 1.1.36 basic: 96%

HttpParams

Agumon v1.0: 97.4%

OWASP CRS 4.20 PL1: 98.3%

open-appsec 1.1.36 basic: 99.9%

CSIC 2010SQLi / XSS

Agumon v1.0: 95.1%

OWASP CRS 4.20 PL1: 100%

open-appsec 1.1.36 basic: 100%

WAF Comparison Projectsample

Agumon v1.0: 85.3%

OWASP CRS 4.20 PL1: 91.4%

open-appsec 1.1.36 basic: 99.7%

GoTestWAF

Agumon v1.0: 40.3%

OWASP CRS 4.20 PL1: 45.9%

open-appsec 1.1.36 basic: 92%

OWASP CRS at paranoia level 1 and open-appsec with its bundled basic model, both at their defaults.

Read the write-upThe research behind Agumon v1.0 Model on Hugging FaceWeights and model card Engine and benchmark harnessCode on GitHub

PaperarXiv submission in progress

Digimon is a trademark of Bandai. Agumon character ©Akiyoshi Hongo, Toei Animation. Eurobase is not affiliated with or endorsed by Bandai or Toei Animation.