We use cookies to ensure our website works properly and to personalise your experience. Cookies policy
Department of CSE (Cyber Security), Sri Venkateswaraa College of Technology, Sriperumbudur, Tamil Nadu, India
The rapid growth of web applications and Software-as-a-Service (SaaS) platforms has increased the need for strong and intelligent cybersecurity solutions. Traditional security systems such as firewalls, intrusion detection systems, and web application firewalls mainly protect network boundaries, but they often fail to detect modern attacks that exploit application logic, user behavior, and compromised identities. Threats such as account takeovers, credential stuffing, insider misuse, and business logic abuse frequently appear as legitimate actions and bypass conventional defenses.To solve this problem, this paper proposes EndoGuard, an open-source embedded security framework designed for real-time threat detection and prevention inside web applications. Unlike perimeter-based security systems, EndoGuard integrates directly into the application layer using lightweight SDKs and continuously monitors user actions and internal system events. It captures contextual information such as user identity, IP address, device details, and action type to identify suspicious patterns and abnormal behavior.The framework uses PHP, PostgreSQL, and the Fat-Free Framework for lightweight and scalable implementation. A rule-based engine evaluates events against predefined and customizable security rules and assigns a dynamic risk score to classify activities as low, medium, or high risk. Based on the risk level, the system can trigger actions such as account suspension, multi-factor authentication, or administrator review.EndoGuard improves application-level protection by shifting cybersecurity from external defense to internal monitoring and behavioral analysis. The system is developer-friendly, efficient, and suitable for modern web applications, fintech systems, and enterprise platforms.
In today’s digital world, web applications and SaaS platforms are used in banking, e-commerce, healthcare, education, and enterprise systems. These applications process large amounts of sensitive data and critical transactions, making them major targets for cyberattacks.Traditional security solutions such as firewalls, IDS, and WAFs mainly focus on protecting the network perimeter. They are effective against known external attacks like SQL injection and cross-site scripting, but they are weak against identity-based attacks and business logic abuse.Modern attackers often use stolen credentials obtained through phishing or credential stuffing. Since these credentials are valid, traditional systems treat these actions as normal. This creates a serious security gap where attackers can perform fraud, unauthorized transactions, and data theft without detection.To overcome these limitations, embedded security is required. Embedded security integrates protection directly inside the application and continuously monitors user behavior. It odellin user actions, devices, IP addresses, and historical activity to detect suspicious behavior in real time.EndoGuard is designed based on this concept. It provides application-level security by monitoring internal activities, assigning risk scores, and responding immediately to threats before major damage occurs.
RELATED WORK
Many studies show the limitations of traditional perimeter-based security systems. OWASP Top 10 highlights broken access control, authentication failures, and insecure design as major risks in modern web applications.Behavioral analytics research explains that monitoring login patterns, device usage, and unusual transactions helps detect advanced threats such as account takeovers and insider attacks.Threat odelling and attack tree approaches show that attackers often exploit business logic rather than technical vulnerabilities. These attacks are difficult to detect using traditional firewalls.Machine learning and anomaly detection systems improve threat detection, but many are complex and expensive to deploy. EndoGuard focuses on a lightweight and practical solution using rule-based detection with future support for intelligent models.
PROPOSED SYSTEM
Existing systems mainly rely on authentication, firewalls, and static rule-based detection. Once users are authenticated, their actions are usually trusted without continuous monitoring. This makes systems vulnerable to account hijacking, insider misuse, and logic abuse.
EndoGuard is an embedded security framework that works inside the application layer. It monitors user activities such as login attempts, password changes, account updates, and sensitive transactions.
The system follows four major stages:
Captured events are enriched with contextual data such as IP intelligence, device fingerprinting, and user history. A rule engine then evaluates the event and assigns a dynamic risk score.
This helps reduce false positives and improves response speed.
METHODOLOGY
The system is developed using PHP for backend operations, PostgreSQL for database management, and Fat-Free Framework for lightweight application handling.
Working Process
Figure 1: Workflow Diagram
User Activity
↓
Event Captured by SDK
↓
Context Enrichment
↓
Rule Evaluation
↓
Risk Score Calculation
↓
Low / Medium / High Risk Classification
↓
Security Action Triggered
This workflow explains how every user event moves through the detection pipeline.
The admin dashboard provides audit trails, user timelines, alert queues, and review mechanisms for better monitoring and investigation.
RESULTS AND DISCUSSION
EndoGuard showed strong performance in detecting suspicious activities and reducing delayed threat response.
Key Outcomes
The system successfully handled event monitoring with low overhead and improved threat visibility compared to traditional external security systems. The risk scoring mechanism helped administrators focus on important threats instead of reviewing every activity manually.
CONCLUSION
EndoGuard provides a practical solution for modern cybersecurity challenges by embedding security directly into web applications. Traditional perimeter-based security is not enough to handle identity-based attacks, insider misuse, and business logic abuse.By combining real-time monitoring, contextual analysis, behavioral tracking, and dynamic risk scoring, EndoGuard improves application-level security significantly. The system is lightweight, scalable, and easy to integrate into existing platforms.This project proves that embedded security frameworks can offer stronger protection than traditional reactive systems and help organizations build safer and more reliable digital platforms.
FUTURE SCOPE
Future improvements for EndoGuard include:
These improvements can make EndoGuard more powerful for enterprise-level security environments.
SYSTEM ARCHITECTURE AND DESIGN
Figure 1: System Architecture Diagram
The architecture of EndoGuard is designed to provide embedded security directly inside the application layer rather than depending only on external protection systems. The framework is modular, lightweight, and scalable, making it suitable for web applications, SaaS platforms, fintech systems, and enterprise applications.
The architecture mainly consists of the following components:
When a user performs any activity such as login, password reset, fund transfer, profile update, or privilege change, the SDK captures the event and forwards it to the security engine.The context enrichment layer collects additional information such as IP address, browser details, device fingerprint, geolocation, and previous user behavior history. This helps improve decision-making accuracy.The rule engine evaluates the event using predefined and customizable rules. Based on the result, the risk scoring engine calculates a dynamic risk value and classifies the activity.Finally, the response layer performs actions such as logging, administrator alerting, account suspension, or multi-factor authentication.
Figure 2: EndoGuard System Architecture
Module 1: User Authentication Monitoring
This module tracks login attempts, failed logins, password changes, and session activities. It helps detect brute-force attacks, credential stuffing, and account takeovers.
Module 2: Context Enrichment Module
This module gathers supporting information such as IP intelligence, device details, browser fingerprinting, and location tracking. It improves anomaly detection by providing context.
Module 3: Rule-Based Detection Engine
This module applies predefined security rules such as unusual login time, repeated failed attempts, sudden device change, and suspicious transaction behavior.
Module 4: Dynamic Risk Scoring Module
Each event is assigned a numerical score based on severity and abnormality. Higher scores indicate higher security risk.
Module 5: Security Response Module
This module triggers actions based on the risk level. Low-risk activities are logged, medium-risk events are flagged for review, and high-risk activities trigger immediate prevention.
Module 6: Admin Dashboard Module
Administrators can monitor events, review alerts, access audit trails, and investigate suspicious users using a centralized interface.
IMPLEMENTATION DETAILS
Figure 3: Database Design (ER Diagram)
Users
↓
Login Events
↓
Risk Score Table
↓
Alert Management
↓
Admin Review Queue
↓
Audit Trail
This ER-style diagram represents the relationship between core database tables used in EndoGuard.The database stores user information, event logs, risk scores, device history, alerts, and administrator reviews.
Important tables include:
Each event is stored with timestamp, IP address, device details, and action type for future analysis and auditing.
The system implements:
These mechanisms ensure both preventive and detective security.
Figure 2: EndoGuard Deployment Diagram
PERFORMANCE ANALYSIS
Figure 4: Risk Classification Chart
Low Risk → Log EventMedium Risk → Admin ReviewHigh Risk → MFA / Account Suspension
This diagram explains how the system responds based on calculated risk levels.
Figure 5: Admin Dashboard Monitoring Flow
Alerts Generated → Review Queue → Admin Analysis → Decision → Final Action
This shows how administrators handle suspicious events inside the monitoring dashboard.
The system processes user events in real time with minimal latency. Event capture and risk evaluation happen instantly after user interaction, ensuring immediate threat visibility.
Testing showed improved detection of:
Compared to traditional systems, EndoGuard provided better accuracy because it considered user behavior and context instead of only network traffic.
The dynamic scoring system reduced unnecessary alerts and helped administrators prioritize serious incidents first. This improved operational efficiency and reduced false positives.
High-risk activities triggered immediate responses such as MFA requests and account restrictions. This proactive model reduced the damage window significantly.
The lightweight architecture allowed stable performance even with increasing event volume. The modular structure supports future cloud deployment and enterprise-scale expansion.
ADVANTAGES OF PROPOSED SYSTEM
LIMITATIONS
Although EndoGuard provides strong application-level protection, some limitations still exist:
These limitations can be addressed in future versions.
REFERENCES
Dhanuja V.*, Gopika U., Kuraku Vamsidhar, Endoguard: An Embedded Security Framework For Real-Time Threat Detection And Prevention In Web Applications, Int. J. Sci. R. Tech., 2026, 3 (5), 264-270. https://doi.org/10.5281/zenodo.20080119
10.5281/zenodo.20080119