Une vue technique de la façon dont Shield protège les entrées Web, le chat AI existant, le proxy LLM et les outils MCP: architecture, flux de décision, audit et comparaison avec WAF / reCAPTCHA.
Shield est une couche de protection active et passive pour les formulaires, la connexion, le paiement, les téléchargements, le chat AI, les outils et les API MCP. Le tableau de bord affiche les décisions et les événements afin que vous puissiez ajuster la défense, et non comme un explorateur de journaux. Les événements sont un signal opérationnel, pas un inventaire analytique.
Shield peut s'asseoir devant votre site Web, votre chat AI ou vos outils MCP. Chaque chemin a un point de décision clair et un résultat vérifiable.
Le widget JS et le backend SDK protègent les formulaires de contact, la connexion, le paiement et les téléchargements. Ils collectent les signaux de sécurité, attachent un jeton HMAC et permettent d'autoriser/défier/bloquer avant qu'une requête n'atteigne une logique sensible.
L'invite et la réponse passent par un pare-feu LLM. Shield peut anonymiser les données sensibles, bloquer l'injection rapide, vérifier les fuites d'instructions système et travailler devant le chat que vous utilisez déjà.
Les appels MCP sont évalués par schéma, autorisations et risque d'action. Les appels d’outils destructeurs ou sensibles peuvent nécessiter une porte d’approbation. Chaque décision est consignée dans un journal d'audit à l'échelle du locataire.
Shield ne remplace pas votre protection périmétrique existante. Il se trouve une couche plus profonde.
| Capacité | Shield | WAF | reCAPTCHA / Tourniquet |
|---|---|---|---|
| Détection de robots sans tête | Oui — scoring multi-signal | Partiel (réputation IP) | Oui, au bord |
| Prompt injection contre LLM | Oui – pare-feu sémantique | Non | Non |
| Abus d’agent MCP | Oui — policy engine | Non | Non |
| Spam formulaire / email jetable | Oui — 5 langues | Non | Partiel |
| Scan malware des uploads | Oui — quarantaine | Partiel | Non |
| Payloads SQL injection | Oui — validation AST | Oui — regex | Non |
| Bourrage d'informations d'identification (distribué) | Oui — blocage par compte | Partiel (par IP) | Partiel |
| Journal d'audit inviolable | Oui — exportable | Variable | Non |
Matrice catégorisée complète. Des seuils exacts, des poids de signal et des éléments internes de détection sont disponibles pour les clients sur le portail.
Keystroke dynamics, mouse trajectory R², scroll patterns, touch events, form-fill timing, page-dwell — multi-signal inputs fed into the local scorer and backend scoring pipeline.
Canvas, WebGL, audio context, font detection, navigator fingerprinting fused into a SHA-256 device hash. Detects headless browsers and anti-detect tools.
Short-lived cache snapshot of device_hash, webgl_renderer, user_agent, timezone, screen_resolution at session start. Sensitive events (login, form submit, checkout) compare the live fingerprint; drift adds significant risk signals respectively.
OpenAI- and Anthropic-compatible base URL. Shield scans every prompt before forwarding and every completion before returning, blocks on policy hit, strips PII / secrets on stream.
Embedding-based detection across many attack categories. "Disregard earlier directives" ≈ "Ignore previous instructions" at cosine similarity. Ollama-local embeddings — zero per-request API cost.
Tool-call interception for Claude / Cursor / IDE agents. JSON Schema validation of arguments, chain-step limit, domain allowlist, explicit approval gates on destructive tools. Inspects every invocation against agent-protection rules before execution.
40+ patterns scanning input + output + tool calls before / after the model runs. Runs alongside the Semantic Firewall for layered defence.
5 tools exposed via MCP: shield_get_stats, shield_get_threats, shield_add_rule, shield_get_events, shield_verify_token. Let your Claude / Cursor agent investigate and act on incidents without leaving the chat.
AST-parsed SQL validation. Blocks UNION, INTO OUTFILE, pg_sleep, information_schema. LIMIT capped. Sensitive columns (password, api_key, ssn) auto-redacted. Query fingerprinting and honeytoken trap tables.
Wallet detection: BTC (P2PKH/Bech32), ETH, SOL, TRX, XRP, LTC, DOGE. BIP-39 seed phrase scanning (12/24 word). Signing prompts (EIP-712). Mining domains blocked. Payment redirect patterns.
Bigram gibberish detection (EN / DE / CS / SK / ES), 100+ disposable email domains, spam patterns (repeated chars, ALL CAPS, URL flood), suspicious name detection. Phishing and bad-content corpus covers 9 languages (see Phishing card). Additive scoring with cluster bonuses.
Multi-layered email + attachment scanner. Detects Slovak/Czech/Polish/German/French/Spanish/Serbian bodies stripped of diacritics (the strongest real-world phishing signal), password-hint social engineering across 9 languages, mainframe-mimicry filenames, and password-protected PDF / Office files. Brand-agnostic cluster catches the same shape with any impersonated company name.
check_upload() accepts form_fields. When a file upload is accompanied by form data (title, description, name, message), Content Quality Scoring runs on those fields too. A clean PDF with gibberish metadata still gets rejected at high-confidence score.
Every file passes a quarantine gate — extension allowlist, magic-byte MIME sniffing, Office macro detection, PDF JavaScript / Launch / OpenAction, SVG / HTML script injection. Per-tenant max size and extension list.
Python (FastAPI / Django / Flask), Node.js (Express / Next.js), PHP (WordPress / Laravel). Validates X-Shield-Token on every request. No token → 403. HMAC verify is cached with a short-lived cache per (token, path).
3-state breaker (closed / open / half_open) in all three backend SDKs. After consecutive transport errors → OPEN for a brief interval → 1 HALF_OPEN probe. 4xx doesn't trip the breaker. PHP uses APCu for cross-FPM-worker state. No more timeouts on every request during an upstream incident.
Reason → (machine_code, human_hint) map. /shield/verify and all 3 SDK 403 bodies return remediation + remediation_code. Legit false-positive users see "Your session expired — please reload" instead of a silent 403.
Drop-in PHP plugin: auto-injects the widget, ships middleware that validates Shield tokens on /wp-login.php and admin endpoints. Fail-closed by default, configurable.
Multi-dimensional rate limiting: per-IP, per-device, per-endpoint, with progressive escalation. Server-side counters with sliding windows.
IP geolocation via ip-api.com (short-lived cache). Per-site blocked / allowed country lists. Datacenter and proxy / Tor score modifiers. Page-load hard block with access-denied overlay before widget initialises.
Widget prevents form submission at high-confidence score. Red overlay: "Blocked by Corpilus Shield". Server-signed HMAC-SHA256 tokens auto-attached to fetch() via interceptor.
278 compiled detection patterns scanned automatically on every event — covers all OWASP Top 10 2025 categories. Payload-level inspection happens before scoring.
AI analyzér analyses events continuously. RAG context grounded in a curated security knowledge base. Auto-creates threats and rules from real observations.
Pre-built threat-intel context (mini-CAG). Bot signatures, attack patterns, OWASP samples baked in — new sites are protected from the first page view.
Shield's Security Knowledge collection ships with curated docs (OWASP Top 10, bot detection, incident response). Admins can upload their own company playbooks, post-mortem reports, or domain-specific threat intel. Every upload runs through a multi-layer scan. Clean docs land as trust_state='pending' until an admin explicitly promotes them to 'active'. Only active docs reach the AI analyzer's RAG context.
Anonymised pattern sharing — IPs reduced to /24, PII stripped, maturity gating (experimental → candidate → confirmed). One tenant's confirmed attacker becomes everyone's known threat within minutes.
Widget MutationObserver snapshots all <script> tags at boot. Any subsequently injected script is reported as script_integrity_violation telemetry with src, external/same-origin, content length, stable hash. Capped per page-load. Tenant allowlist for trusted CDNs.
Redis counter per SHA-256(account_id). Each failure over the cap adds significant risk score. A distributed attack that spreads many attempts over thousands of IPs still lands on the same account bucket — the attempt on victim@corp.com triggers challenge regardless of which IP sent it. Counter resets on a successful login.
GET /shield/password/breach-range/{prefix} — client computes SHA-1(password) locally in the browser, sends only the 5-char hex prefix, Shield proxies to api.pwnedpasswords.com and streams back the suffix+count list. Client compares its own suffix locally. Server never sees plaintext OR the full hash.
A/AAAA + MX record check on signup. Fail-open on timeout. Short-lived per-domain cache so rapid signup waves from the same throwaway domain don't re-hammer DNS.
25+ protected brands (Google, Microsoft, Apple, PayPal, Stripe, Meta, LinkedIn, Revolut, SK/CZ banks & insurers). Three-tier detector: 1) normalised exact match via homoglyph map, 2) Levenshtein distance for long brands, 3) brand-substring + decorative suffix (secure/login/support/verify/auth/signin/account/official/help).
Velocity counters per IP and per device. Recent-login requirement: no successful login from this device recently → significant risk signal. Session Continuity: password_change is now in the SENSITIVE event set, so full fingerprint drift blocks immediately. The classic 'attacker grabs session → changes password → locks out user' chain needs to survive all three gates.
Email (HTML), Slack, Discord, generic JSON webhooks. Weekly security report with stats, top threats, block rate. Per-webhook severity gate (low / medium / high / critical).
Every rule change, site config edit, manual block, AI decision is recorded with actor, timestamp, before/after diff. Hash-chained, signed, and exportable as auditor-ready evidence bundle.
HMAC-SHA256 tokens are minted server-side from the per-site secret and returned via /shield/events. The widget never holds the signing secret — a leaked site_key cannot be used to forge valid tokens.
PostgreSQL Row-Level Security forced on all shield_* tables. Each request runs under a tenant-scoped role — no application-layer bypass possible even if the API has a bug.
Tracks attempts per card BIN across rolling windows. Burst patterns consistent with card-testing activate progressive challenge or block. Thresholds are tenant-tunable; defaults are conservative.
When the same PSP-provided card fingerprint appears across multiple devices, sessions or tenants in a short window, attempts are correlated and scored as a coordinated attack. Raw PAN never leaves your PSP.
Tenant-scoped baseline of issuer-country distribution. A sudden concentration of attempts against issuers from a small number of countries — well above baseline — flags probable carding traffic.
Aggregates multiple signals — diverse BIN spread, same device or session, high failure ratio — into a named carding verdict. Upgrades decision severity when confirmed by post-charge PSP feedback.
Slow-burn attacks no longer slip through. Shield watches the whole conversation arc, not just one message at a time. An attacker who chats innocuously for many turns and only then pivots to data extraction or credential phishing is caught at the moment the pattern emerges.
Before your agent runs a tool, Shield asks: is the user's actual intent consistent with calling this tool? A request to summarise a document should not trigger a database export. A travel-booking chat should not be calling a payments tool. Mismatches are gated for review.
Compromised agents and curious LLMs typically scan the environment before acting — listing directories, reading config paths, enumerating environment variables. Shield flags this reconnaissance pattern early, before any data leaves the box.
A single conversation can never quietly burn your whole monthly AI budget. Shield enforces a per-session ceiling on tokens, tool calls and elapsed time. When the cap is reached the session is paused or terminated and the operator is notified.
Shield learns what normal looks like for each user — typical hours, typical actions, typical pace — and quietly flags the day that pattern breaks. A logged-in session that suddenly behaves nothing like the real user is treated as a possible takeover.
Decoy records, files and credentials are planted in places only an attacker would dig. Real users never see them. The moment one is touched, accessed or used, Shield has a high-confidence breach signal with effectively zero false positives.
Attackers hide malicious payloads inside layered encodings — base64, hex, percent-encoding, unicode escapes — to slip past simple string filters. Shield unwraps these layers before scoring, so the underlying attack is matched against the same protections as a plain-text version.
Before any rule, model or scorer update ships, it is run against a continuously growing corpus of real-world attack scenarios. If a release accidentally weakens detection on a known threat shape, the change is blocked at CI — not after a customer is breached.
Every security decision and config change is written to a tamper-evident chain. Edits and deletions are mathematically detectable. Auditors, regulators and incident responders get a trustworthy timeline even in the worst-case scenario where an attacker reaches admin credentials.
When something happens, you do not want to spend hours collecting logs. One click produces an encrypted, time-stamped bundle of the relevant tenant state — events, rules, decisions, recent traffic — ready to hand to your security team, lawyer or regulator.
Shield does not lock you into one AI vendor. Bring your own OpenAI / Anthropic / Google key, point at a dedicated Ollama instance, or run fully local. Set hard cost caps and routing rules. Your data flows only to providers you explicitly approve.
For your highest-risk actions Shield can require a hardware-rooted gesture: Touch ID, Windows Hello, a hardware security key. These are physical-presence checks that an LLM-powered agent or remote attacker cannot solve, no matter how clever the prompt.
For regulated, classified or disconnected environments Shield ships as a self-hosted package with signed release artifacts and a fully offline install path. Nothing has to talk to the public internet, but you still get rule, model and intel updates on your own schedule.
Shield can flag form, message and document submissions that look machine-generated rather than human-typed. Combined with behaviour and timing signals, this gives operators a clear answer to "is this real?" on application forms, CVs, support tickets and reviews.
The widget snapshots fetch, XHR, navigator and userAgent at boot and re-checks periodically. If a browser extension, injected script or third-party tag flips navigator.webdriver, wraps fetch, replaces XHR or mutates navigator descriptors, Shield reports the tampering and can refuse to issue a token. Per-attribute form.action / hidden-input change tracking is roadmap, not wired today.
Every request is checked in O(1) against 48,000+ real-time threat indicators refreshed frequently. No customer setup — platform-funded. Adds score boost on match.
Premium reputation services lookup on suspicious events only. Per-tenant Fernet-encrypted keys; no platform-shared keys, lookups happen on your quota.
All ten 2025 OWASP categories addressed — A01 access control, A02 misconfig, A03 supply chain, A04 crypto, A05 injection, A06 design, A07 auth, A08 integrity, A09 logging, A10 exception handling. Pattern set sourced from OWASP CRS v4, nuclei templates, PayloadsAllTheThings.
Identifies bots from OpenAI, Anthropic, Google-Extended, Perplexity, ByteDance, CommonCrawl, Meta, Apple, Cohere, Mistral, AllenAI, You.com and more. Tenant chooses block / monitor / allow per vendor.
log4j JNDI gadgets (${jndi:ldap://...}), LDAP injection, XML External Entity, MongoDB-style NoSQL operator injection — all blocked at the /shield/events ingest before reaching your backend.
Read-only view of all 278 patterns Shield runs on every request, grouped by category. Customers see exactly what's protecting them — no marketing claims to verify.
Cliquez sur une carte pour afficher la description technique et le threat model.
Le journal d'audit est l'épine dorsale juridique et médico-légale de Shield. Conçu pour que même un administrateur compromis ne puisse pas réécrire l'historique sans qu'il soit visible.
Chaque enregistrement d'audit contient le hachage SHA-256 de l'enregistrement précédent ainsi que l'événement en cours canonique. La suppression ou la modification de tout événement passé interrompt chaque hachage en aval et la chaîne refuse la vérification.
Chaque locataire possède sa propre paire de clés Ed25519. La clé publique est exposée pour une vérification indépendante; la clé privée signe chaque enregistrement d'audit au moment de l'écriture. Un dump de base de données divulgué ne peut pas être falsifié sans la clé privée.
Les têtes de chaîne sont périodiquement ancrées contre une autorité d'horodatage RFC 3161 externe. Cela lie le journal à l'heure absolue de l'horloge murale et prouve que la chaîne existait sous cette forme avant l'horodatage.
Le rôle bouclier_app a uniquement INSERT — UPDATE et DELETE sont REVOKEd au niveau PostgreSQL. Même un attaquant disposant d’informations d’identification complètes pour le contexte de l’application ne peut pas réécrire les lignes; ils devraient passer à un rôle de superutilisateur de base de données, qui est lui-même audité au niveau de la couche plate-forme.
GET /shield/audit/verify reparcourt la chaîne de hachage et valide chaque signature; GET /shield/audit/export diffuse une archive JSON signée et délimitée par des lignes pour les auditeurs internes ou externes. Les deux sont limités au locataire et à un tarif limité.
Fournit les preuves techniques demandées par les cadres de sécurité courants (journalisation immuable, intégrité signée, surveillance, alignement GDPR Art. 32). Shield lui-même n'est pas certifié en externe: l'exportation prend en charge votre audit, elle n'en remplace pas un.
Quand quelque chose ne va pas, vous avez besoin d’une image immuable du moment. Shield le produit en moins d'une minute et le scelle afin que seule votre clé privée puisse l'ouvrir.
Une clé de données AES-256-GCM à usage unique chiffre la charge utile. La clé de données est encapsulée avec RSA-OAEP-SHA256 par rapport à la clé publique du locataire. Seul le détenteur de la clé privée peut récupérer la clé AES et décrypter le bundle. L'infrastructure Shield ne peut pas lire les instantanés antérieurs une fois qu'ils ont quitté le conteneur de production.
Téléchargement des instantanés vers n'importe quel magasin compatible S3 (AWS, Wasabi, MinIO, on-prem). Cron hebdomadaire en option archive automatiquement un nouvel instantané pour une préparation médico-légale continue. La cible MTTR du déclencheur à l’archive scellée et téléchargée est d’environ 60 secondes.
POST /shield/forensic/snapshot déclenche un nouvel instantané; GET /shield/forensic/snapshots répertorie les fichiers existants avec leurs métadonnées, leur taille et leur statut scellé. Les deux sont limités à l’administrateur et produisent des événements d’audit au niveau de la plateforme.
Shield fournit des preuves techniques, des journaux et des mappages. Les certifications formelles ou attestations client dépendent de la portée de déploiement spécifique.
Shield produit des journaux d'audit, des motifs de décision et des exportations qui peuvent prendre en charge l'examen de la sécurité et de la conformité. La certification ou l'attestation formelle est confirmée individuellement en fonction de la portée du client.
Les contrôles techniques peuvent être mappés à votre cadre d’audit interne. Shield lui-même n’est pas certifié en externe.
Les détections peuvent être mappées aux techniques MITRE ATT&CK pertinentes, en particulier l'accès initial, l'accès aux informations d'identification, l'exfiltration et le commandement et le contrôle.
Shield couvre plusieurs classes de menaces automatisées d’OWASP OAT. Une cartographie détaillée est fournie aux clients dans des documents techniques.
Document technique détaillé comprenant des diagrammes d'intégration, une modélisation des menaces et des tests de performances.
Avis sur l'étendue de la protection. Corpilus Shield est une couche de protection AI en temps réel conçue pour étendre les mécanismes de sécurité standard pour les sites Web, les boutiques en ligne et les applications LLM, et non pour les remplacer. Il ne remplace pas un antivirus, un pare-feu, des tests d'intrusion ou un audit de sécurité formel. Pour une protection complète, nous recommandons de combiner plusieurs couches.