Rust and WebAssembly Accelerators

How AIWAF works: system architecture

aiwaf-rust and aiwaf-wasm are versioned independently from the Python and Node packages. The published Rust/Python version is 0.2.7; WASM is 0.2.5. They share rust/crates/aiwaf_core/; PyO3 bindings live in rust/src/lib.rs, and WASM bindings in rust/crates/aiwaf_wasm/.

Python bindings

aiwaf-rust exposes the shared Rust core through PyO3 and ABI3 wheels for Python 3.8 and newer.

pip install aiwaf-rust

The module provides:

• validate_headers and validate_headers_with_config
• KeywordMatcher and RouteMatcher
• request-record construction and six-feature extraction
• incremental feature extraction with explicit state
• recent-behavior analysis
• IsolationForest training, scoring, prediction, retraining, and JSON state

import aiwaf_rust

reason = aiwaf_rust.validate_headers({
    "HTTP_USER_AGENT": "Mozilla/5.0",
    "HTTP_ACCEPT": "text/html",
})

forest = aiwaf_rust.IsolationForest(
    n_estimators=100,
    max_samples="auto",
    contamination="auto",
    max_features=1.0,
    bootstrap=False,
    random_state=42,
    warm_start=False,
)
forest.fit([[0.1, 1.0], [0.2, 1.1], [9.0, 9.0]])
score = forest.anomaly_score([9.0, 9.0])
state = forest.to_json()
restored = aiwaf_rust.IsolationForest.from_json(state)

For a local native build, run these from the monorepo root in a virtual environment:

python scripts/stage_rust_package_files.py
python -m pip install maturin
maturin develop --release --locked --manifest-path rust/Cargo.toml

The first command copies the shared README and license files into rust/. The copies are ignored by Git, and release automation stages the same files before building wheels and the source distribution. Changing the Rust code? See Proposing Rust changes.

WebAssembly bindings

aiwaf-wasm exposes the shared Rust core to browsers and Node-compatible bundlers.

import {
  IsolationForest,
  KeywordMatcher,
  RouteMatcher,
  analyze_recent_behavior,
  extract_features,
  validate_headers,
} from 'aiwaf-wasm';

const reason = validate_headers({
  'user-agent': 'Mozilla/5.0',
  accept: 'text/html'
});

const forest = new IsolationForest({
  n_estimators: 100,
  max_samples: 'auto',
  contamination: 'auto',
  random_state: 42
});
forest.fit([[0.1, 1.0], [0.2, 1.1], [9.0, 9.0]]);
const score = forest.anomaly_score([9.0, 9.0]);

The WASM API includes header, URL, and content validation; keyword and route matchers; record conversion; batched feature extraction; recent-behavior analysis; and Isolation Forest lifecycle methods. Browser use requires a bundler that understands WebAssembly assets.

Build and test it locally:

cargo test --manifest-path rust/Cargo.toml --locked -p aiwaf_core
cargo test --manifest-path rust/Cargo.toml --locked -p aiwaf-wasm --lib
cd rust/crates/aiwaf_wasm
wasm-pack test --node
wasm-pack build --release --target bundler
cd ../..
python scripts/patch_wasm_pkg.py
cp ../LICENSE crates/aiwaf_wasm/pkg/LICENSE
cp ../NOTICE crates/aiwaf_wasm/pkg/NOTICE
cp -R ../licenses crates/aiwaf_wasm/pkg/

Continue

• Binding API and scoring semantics
• Build, tests, and packaging