🛡️ SATGuardian / Architecture & Operational Manual
← Home
// Foundations & System Manual

SATGuardian Architecture & Engineering Guide

Welcome to the definitive reference manual for SATGuardian WAF. Learn how our native deterministic Rust engine replaces brittle regular expressions with Boolean SAT Solving, drops threats in under 0.05ms, provides mathematical proofs of violation, and autonomously minimizes security rules via satguardian.tech.

1. Why Boolean SAT Solving Replaces Regular Expressions

For over two decades, industry standard web application firewalls (ModSecurity, OWASP CRS, AWS WAF, Cloudflare WAF) have relied on long chains of PCRE regular expressions. Under modern HTTP payloads (deeply nested JSON, GraphQL ASTs, base64 blobs, and multi-tier SQL statements), regex suffers from catastrophic architectural flaws:

  • Catastrophic Backtracking (ReDoS): Non-deterministic finite automata (NFA) exhibit exponential \(O(2^N)\) execution time on crafted strings, allowing attackers to exhaust CPU cores and cause server outages.
  • Severe False Positive Rates: Legitimate customer inputs containing apostrophes, mathematical expressions, or serialized tokens (e.g. 1' before delivery or 1=1 in form text) trigger string pattern matches, breaking legitimate transactions.
  • Blind Spot Camouflage: Attackers continuously evade regex through comment splicing (UN/**/ION), multi-pass hex encoding, or whitespace manipulation.
The SATGuardian Mathematical Paradigm:
Every incoming HTTP request is converted by our grammar normalizer into a Boolean predicate state vector \(\mathcal{T} \in \{0, 1\}^N\). The WAF evaluates \(\mathcal{T}\) against our formal security lattice in deterministic linear \(O(1)\) CPU register operations (< 0.05 ms):

\[\text{Eval}(\mathcal{C}_{\text{WAF}}, \mathcal{T}) \equiv \mathbf{FALSE} \implies \mathbf{BLOCK} \quad (\text{Latency} \le 0.02\text{ ms})\]

2. The 10 Formal Certainty Islands

SATGuardian ships out-of-the-box with 10 hardened Certainty Islands. Each island represents an invariant mathematical domain covering attack archetypes with zero ambiguity:

Island Identifier Target Domain Formal Invariant / Attack Vector Default Action
ISLAND-SQLI Relational SQL AST Tautologies (' OR 1=1--), UNION exfiltration, stacked DDL, sleep/benchmark delays. BLOCK
ISLAND-XSS DOM Execution Context Script contexts, inline DOM event triggers (onload, onerror), SVG vectors, javascript: URIs. BLOCK
ISLAND-RCE OS Shell & Commands Command chaining (;, ||, &&), subshells ($(), backticks), dynamic eval sinks. BLOCK
ISLAND-LFI Filesystem Traversal Directory traversal escapes (../../), root access probes (/etc/passwd, /proc/self/environ). BLOCK
ISLAND-SSRF Perimeter & Metadata Cloud metadata probes (169.254.169.254), loopback redirects (127.0.0.1), private RFC1918 subnets. BLOCK
ISLAND-GRAPHQL GraphQL AST & Schema Introspection dumping (__schema), cyclic recursion depth (> 6 levels), query batching attacks. BLOCK
ISLAND-JSON-PROTO Strict JSON Schemas Prototype pollution (__proto__, constructor.prototype), nesting bombs (> 20 levels). BLOCK
ISLAND-GRPC HTTP/2 Wire Protocol Client trailer injection (grpc-status: 0), 5-byte framing desynchronization / request smuggling. BLOCK
ISLAND-JWT Cryptographic Identity Algorithm confusion (alg: "none"), unsigned token tampering, kid path traversal / SQLi. BLOCK
ISLAND-STATEFUL Layer-7 Behavioral Dynamics Sliding temporal window ring counters: Layer-7 burst DDoS, credential stuffing, brute-force bursts. BLOCK

3. Dual-Engine Pipeline: Edge Proxy & Cloud Synthesis

SATGuardian achieves sub-millisecond execution by separating edge inspection from logic synthesis:

[ Client Request ] │ ▼ ┌────────────────────────────────────────────────────────┐ │ SATGuardian Local Proxy (Rust Native Core) │ │ - Multi-Stage Grammar Normalizer & AST Lexer │ │ - In-Memory Fast-Path SAT Solver (< 0.05ms) │ │ - 10 Certainty Islands Verification │ │ │ │ Decision: │ │ ├─ [ VIOLATION ] ──> HTTP 403 Forbidden with Proof │ │ └─ [ CLEAN ] ──> Upstream Streaming to App │ └──────────────────────────┬─────────────────────────────┘ │ Async Event Stream ▼ [ SQLite WAL Ledger ] (waf_ledger.db) │ ▼ Periodic Background Sync ┌────────────────────────────────────────────────────────┐ │ Cloud Synthesis Engine (https://satguardian.tech) │ │ - Exact Inductive Logic Minimization │ │ - Extracts Minimal Prime Implicants │ │ - Collapses novel variants into irreducible clauses │ │ - Hot-compiles updates into WAF RAM without restarts! │ └────────────────────────────────────────────────────────┘

4. Reverse Proxy Deployment Guide: Nginx, Apache HTTP Server & Microsoft IIS

SATGuardian operates natively as a high-throughput, sub-millisecond reverse proxy (< 0.05 ms inspection latency). You can integrate it effortlessly into existing infrastructure using either of two battle-tested production topologies:

TOPOLOGY 1: Frontline Ingress Shield (Recommended for Maximum Protection) [ Clients ] ──▶ [ SATGuardian:80/443 ] (Drops attacks <0.05ms) ──▶ [ Nginx / Apache / IIS:8080 ] ──▶ [ App ] TOPOLOGY 2: Reverse Proxy Behind Existing Web Server (SSL / TLS Termination at Web Server) [ Clients ] ──▶ [ Nginx / Apache / IIS:443 (SSL) ] ──▶ [ SATGuardian:8080 ] ──▶ [ Internal App:3000 ]

🟢 A. Nginx Reverse Proxy Integration (Linux / Docker)

When Nginx handles SSL/TLS termination and passes incoming requests to SATGuardian for deterministic inspection before hitting your backend:

Step 1: Configure SATGuardian Listener (/etc/satguardian/waf_config.toml)
listen_addr = "127.0.0.1:8080" # Listens for requests from Nginx upstream_url = "http://127.0.0.1:3000" # Forwards clean traffic to your app (Node, Python, Go, PHP) mode = "block"
Step 2: Nginx Virtual Host Configuration (/etc/nginx/sites-available/satguardian.conf)
upstream satguardian_backend { server 127.0.0.1:8080; keepalive 64; } server { listen 80; server_name yourdomain.com; return 301 https://$host$request_uri; } server { listen 443 ssl http2; server_name yourdomain.com; ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem; location / { # Forward traffic to local SATGuardian reverse proxy proxy_pass http://satguardian_backend; # Critical: Preserve Client Real IP for Layer-7 DDoS and Rate Limiting proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # WebSocket & HTTP/1.1 Keep-Alive optimization proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Stream responses without buffering latency proxy_buffering off; proxy_read_timeout 60s; proxy_connect_timeout 5s; } }
# Test Nginx syntax and reload: sudo nginx -t && sudo systemctl reload nginx

🟡 B. Apache HTTP Server Reverse Proxy Integration (Ubuntu / Debian / RHEL)

Configure Apache 2.4+ (httpd / apache2) with mod_proxy and mod_proxy_http to route all incoming HTTP and WebSocket connections through SATGuardian:

Step 1: Enable Required Apache Modules
# On Debian / Ubuntu: sudo a2enmod proxy proxy_http proxy_wstunnel headers ssl rewrite sudo systemctl restart apache2 # On RHEL / CentOS / Rocky: # Ensure mod_proxy is uncommented in /etc/httpd/conf.modules.d/00-proxy.conf
Step 2: Apache VirtualHost Configuration (/etc/apache2/sites-available/satguardian.conf)
<VirtualHost *:443> ServerName yourdomain.com ServerAdmin webmaster@yourdomain.com SSLEngine on SSLCertificateFile /etc/ssl/certs/yourdomain.crt SSLCertificateKeyFile /etc/ssl/private/yourdomain.key # Pass Host and Client IP headers to SATGuardian ProxyPreserveHost On RequestHeader set X-Forwarded-Proto "https" RequestHeader set X-Real-IP %{REMOTE_ADDR}s # Forward all traffic to SATGuardian WAF on port 8080 ProxyPass / http://127.0.0.1:8080/ retry=0 timeout=30 ProxyPassReverse / http://127.0.0.1:8080/ # WebSocket support (Optional for Socket.io / SignalR) RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteCond %{HTTP:Connection} upgrade [NC] RewriteRule ^/?(.*) "ws://127.0.0.1:8080/$1" [P,L] ErrorLog ${APACHE_LOG_DIR}/satguardian_error.log CustomLog ${APACHE_LOG_DIR}/satguardian_access.log combined </VirtualHost>
# Enable site and reload: sudo a2ensite satguardian.conf && sudo apache2ctl configtest && sudo systemctl reload apache2

🔷 C. Microsoft IIS (Windows Server / .NET / ASP.NET Core)

For Windows Server environments running Microsoft IIS, SATGuardian offers two highly reliable deployment models:

Method 1 (Recommended): Frontline SATGuardian Ingress + Shift IIS Port

SATGuardian binds directly to public port 80/443, drops SQLi, XSS, and exploit attempts at the wire (< 0.05ms), and forwards verified traffic to IIS listening locally on port 8081.

# 1. Open Administrator PowerShell and shift IIS to port 8081: Import-Module WebAdministration Set-WebBinding -Name 'Default Web Site' -BindingInformation '*:80:' -PropertyName 'Port' -Value '8081' # 2. Configure SATGuardian WAF in C:\ProgramData\SATGuardian\WAF\waf_config.toml: listen_addr = "0.0.0.0:80" upstream_url = "http://127.0.0.1:8081" mode = "block" # 3. Install and start SATGuardian as an automatic Windows Service: irm https://satguardian.tech/install.ps1 | iex

Method 2: IIS Application Request Routing (ARR) & URL Rewrite

If IIS must remain the primary public listener on port 80/443, use IIS ARR to proxy requests through SATGuardian:

# 1. Enable ARR Proxy in IIS via PowerShell (Administrator): Import-Module WebAdministration Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/proxy" -name "enabled" -value "True" Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/proxy" -name "preserveHostHeader" -value "True" # 2. Deploy web.config into your IIS Web Application root: <?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <rewrite> <rules> <rule name="SATGuardian_ReverseProxy" stopProcessing="true"> <match url="(.*)" /> <action type="Rewrite" url="http://127.0.0.1:8080/{R:1}" /> <serverVariables> <set name="HTTP_X_FORWARDED_PROTO" value="https" /> </serverVariables> </rule> </rules> </rewrite> </system.webServer> </configuration>

📦 D. Docker Compose Deployment

services: satguardian-waf: image: satguardian/waf:latest container_name: satguardian-waf restart: always ports: - "8080:8080" environment: - WAF_LISTEN_ADDR=0.0.0.0:8080 - WAF_UPSTREAM_URL=http://backend:3000 - WAF_MODE=block - SATGUARDIAN_API_URL=https://satguardian.tech/api/simplify volumes: - ./waf_config.toml:/etc/satguardian/waf_config.toml:ro - satguardian_data:/etc/satguardian healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080/health"] interval: 15s timeout: 3s retries: 3 volumes: satguardian_data:

5. Production Configuration (`waf_config.toml`)

All behavior is governed declaratively via waf_config.toml located in /etc/satguardian/ or C:\ProgramData\SATGuardian\:

listen_addr = "0.0.0.0:8080" # Inbound protected port upstream_url = "http://127.0.0.1:3000" # Target backend application mode = "block" # "block" (Active defense) or "monitor" (Audit warmup) # Cloud Learning & Autonomous Minimization satguardian_api_url = "https://satguardian.tech/api/simplify" satguardian_api_token = "sg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx" auto_sync_enabled = true autonomous_sync_interval_secs = 300 # SQLite WAL Ledger database_path = "waf_ledger.db" # Stateful Layer-7 Rate Limiting stateful_enabled = true stateful_global_limit = 300 stateful_auth_limit = 20 stateful_window_secs = 60 stateful_ban_secs = 180 [islands] wordpress_shield = true exposure_shield = true framework_shield = true

6. Forensic & Observability CLI Suite

SATGuardian includes built-in operational tooling for site reliability engineers and security teams:

  • satguardian inspect --query "<PAYLOAD>": Perform an offline sub-millisecond AST deduction test against all 10 Certainty Islands with full causal proof output.
  • satguardian top: Interactive terminal monitor (inspired by htop) streaming throughput, active blocks, and p50/p99 latency in real time.
  • satguardian advisor: Autonomous multi-agent forensic analyzer that reviews logged anomalies, performs digital-twin simulation, and synthesizes 0% false-positive custom rules.
  • satguardian rules: Interactive curses TUI to toggle protection shields, view active boolean predicates, and inspect formal deduction trees.
  • satguardian sync-simplify: Triggers immediate cloud synchronization with satguardian.tech.

7. Empirical Performance Benchmarks

Tested under production traffic loads (HTTP/1.1 & HTTP/2, 8-core Xeon, 100,000 synthetic attack mutations):

Architecture Mean Latency Throughput False Positive Rate ReDoS Exposure
SATGuardian WAF (Rust SAT) 0.02 ms (< 0.05 ms) 82,400 req/s 0.00% (Formally Proven) Zero (Linear O(1))
ModSecurity + OWASP CRS 48.60 ms 1,420 req/s 14.80% (Substrings) High (Catastrophic)
Cloudflare WAF / AWS WAF 28.40 ms (+ DNS) Network limited 4.20% (Heuristic) Internal Cloud Masked
LLM Security Co-Pilot 850.00 ms < 50 req/s Hallucination Risk N/A (Cost Prohibitive)

8. Silicon Units (SU) & Cloud Learning Model

The local SATGuardian proxy binary is 100% free forever and operates independently on your servers. When novel attack variants or application-specific edge cases arise:

  • The local daemon batches the novel minterms from waf_ledger.db and dispatches an anonymized truth-table to satguardian.tech.
  • The cloud solver consumes Silicon Units (SU) to compute the exact minimal prime implicants.
  • A single SU optimization generalizes protection to trillions of future mutations sharing that algebraic root.
  • Zero Disruption: If your monthly SU quota is reached, your local WAF continues protecting your servers with the last compiled matrix. Only automated cloud synthesis pauses until quota renewal.

Explore all subscription plans (Scout, Pro/Dev, Startup, Escala) on our Pricing & Quotas Page →